| services.thanos.rule.objstore.config | Object store configuration
|
| services.thanos.store.objstore.config | Object store configuration
|
| services.thanos.sidecar.objstore.config | Object store configuration
|
| services.thanos.compact.objstore.config | Object store configuration
|
| services.thanos.receive.objstore.config | Object store configuration
|
| services.thanos.downsample.objstore.config | Object store configuration
|
| services.thanos.rule.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.thanos.store.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.thanos.compact.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.thanos.receive.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.thanos.sidecar.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.thanos.downsample.objstore.config-file | Path to YAML file that contains object store configuration
|
| fileSystems.<name>.neededForBoot | If set, this file system will be mounted in the initial ramdisk
|
| image.fileName | Filename of the image including all extensions (e.g image_1.raw or
image_1.raw.zst).
|
| xdg.portal.config | Sets which portal backend should be used to provide the implementation
for the requested interface
|
| services.gammu-smsd.log.file | Path to file where information about communication will be stored
|
| services.i2pd.reseed.file | Full path to SU3 file to reseed from.
|
| services.thanos.rule.tracing.config-file | Path to YAML file that contains tracing configuration
|
| image.filePath | Path of the image, relative to $out in system.build.image
|
| services.snipe-it.config | Snipe-IT configuration options to set in the
.env file
|
| services.spiped.config.<name>.keyfile | Name of a file containing the spiped key
|
| services.gns3-server.log.file | Path of the file GNS3 Server should log to.
|
| services.thanos.query.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.thanos.store.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.bind.zones.<name>.file | Zone file resource records contain columns of data, separated by whitespace, that define the record.
|
| virtualisation.fileSystems.<name>.neededForBoot | If set, this file system will be mounted in the initial ramdisk
|
| services.thanos.sidecar.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.thanos.receive.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.thanos.compact.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.thanos.sidecar.reloader.config-file | Config file watched by the reloader.
|
| services.gitea.dump.file | Filename to be used for the dump
|
| boot.uki.configFile | The configuration file passed to ukify(1) to create the UKI
|
| services.coturn.dh-file | Use custom DH TLS key, stored in PEM format in the file.
|
| services.thanos.sidecar.reloader.config-envsubst-file | Output file for environment variable substituted config file.
|
| services.bookstack.config | BookStack configuration options to set in the
.env file
|
| services.traefik.static.file | Path to Traefik's static configuration file.
|
| services.hardware.pommed.configFile | The path to the pommed.conf file
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| services.thanos.query-frontend.tracing.config-file | Path to YAML file that contains tracing configuration
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| fileSystems | The file systems to be mounted
|
| services.gnunet.fileSharing.quota | Maximum file system usage (in MiB) for file sharing.
|
| services.forgejo.dump.file | Filename to be used for the dump
|
| services.traefik.dynamic.file | Path to Traefik's dynamic configuration file.
You cannot use this option alongside the declarative configuration options.
|
| services.thanos.downsample.tracing.config-file | Path to YAML file that contains tracing configuration
|
| programs.file-roller.enable | Whether to enable File Roller, an archive manager for GNOME.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| fileSystems.<name>.fsType | Type of the file system
|
| programs.file-roller.package | The file-roller package to use.
|
| services.suricata.settings.reference-config-file | Suricata reference configuration file.
|
| security.pam.u2f.settings.authfile | By default pam-u2f module reads the keys from
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set)
|
| services.caddy.configFile | Override the configuration file used by Caddy
|
| services.oauth2-proxy.htpasswd.file | Additionally authenticate against a htpasswd file
|
| services.drbd.config | Contents of the drbd.conf configuration file.
|
| services.filebeat.settings | Configuration for filebeat
|
| services.tahoe.nodes.<name>.sftpd.accounts.file | Path to the accounts file.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| boot.loader.grub.extraFiles | A set of files to be copied to /boot
|
| services.coder.environment.file | Systemd environment file to add to Coder.
|
| security.sudo.configFile | This string contains the contents of the
sudoers file.
|
| services.monica.config | monica configuration options to set in the
.env file
|
| services.netbird.clients.<name>.config | Additional configuration that exists before the first start and
later overrides the existing values in config.json
|
| services.netbird.tunnels.<name>.config | Additional configuration that exists before the first start and
later overrides the existing values in config.json
|
| security.sudo-rs.configFile | This string contains the contents of the
sudoers file.
|
| services.movim.h2o.tls.identity.*.key-file | Path to key file
|
| systemd.tmpfiles.packages | List of packages containing systemd-tmpfiles rules
|
| fileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| services.coturn.static-auth-secret-file | Path to the file containing the static authentication secret.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| services.jicofo.config | Contents of the jicofo.conf configuration file.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| fileSystems.<name>.noCheck | Disable running fsck on this filesystem.
|
| services.gitlab.workhorse.config | Configuration options to add to Workhorse's configuration
file
|
| services.bcg.mqtt.cafile | Certificate Authority file for MQTT server access.
|
| services.hickory-dns.settings.zones.*.file | Path to the .zone file
|
| services.h2o.hosts.<name>.tls.identity.*.key-file | Path to key file
|
| services.karma.configFile | A YAML config file which can be used to configure karma instead of the nix-generated file.
|
| services.agorakit.config | Agorakit configuration options to set in the
.env file
|
| services.restic.server.htpasswd-file | The path to the servers .htpasswd file
|
| services.haproxy.config | Contents of the HAProxy configuration file,
haproxy.conf.
|
| services.znc.configFile | Configuration file for ZNC
|
| fileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| services.gitlab.extraConfig | Extra options to be added under
production in
config/gitlab.yml, as a nix attribute
set
|
| services.ocis.configDir | Path to directory containing oCIS config file
|
| services.snmpd.configFile | Path to the snmpd.conf file
|
| services.bcg.mqtt.keyfile | Key file for MQTT server access.
|
| services.routinator.settings.log-file | A string value containing the path to a file to which log messages will be appended if the log configuration value is set to file
|
| fileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| systemd.services.<name>.confinement.mode | The value full-apivfs (the default) sets up
private /dev, /proc,
/sys, /tmp and /var/tmp file systems
in a separate user name space
|
| services.atalkd.configFile | Optional path to a custom atalkd.conf file
|
| services.orangefs.server.fileSystems | These options will create the <FileSystem> sections of config file.
|
| virtualisation.qemu.drives.*.file | The file image used for this drive.
|
| services.alloy.configPath | Alloy configuration file/directory path
|
| services.dolibarr.h2o.tls.identity.*.key-file | Path to key file
|
| services.speechd.config | System wide configuration file for Speech Dispatcher
|
| services.nginx.config | Verbatim nginx.conf configuration
|
| boot.loader.systemd-boot.extraFiles | A set of files to be copied to $BOOT
|
| services.pgbackrest.repos.<name>.sftp-private-key-file | SFTP private key file
|
| services.searx.settingsFile | The path of the Searx server settings.yml file
|
| services.dbus.packages | Packages whose D-Bus configuration files should be included in
the configuration of the D-Bus system-wide or session-wide
message bus
|
| services.riemann.configFile | A Riemann config file
|
| services.thanos.rule.tracing.config | Tracing configuration
|
| fileSystems.<name>.encrypted.blkDev | Location of the backing encrypted device.
|
| services.orangefs.server.fileSystems.<name>.id | File system ID (must be unique within configuration).
|
| services.bcg.mqtt.certfile | Certificate file for MQTT server access.
|
| services.orangefs.client.fileSystems | The orangefs file systems to be mounted
|
| services.couchdb.configFile | Configuration file for persisting runtime changes
|
| services.thanos.store.tracing.config | Tracing configuration
|
| services.thanos.query.tracing.config | Tracing configuration
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| services.rabbitmq.config | Verbatim advanced configuration file contents using the Erlang syntax
|
| services.nohang.configPath | Configuration file to use with nohang
|
| services.suricata.settings.logging.outputs.file.enable | Whether to enable logging to file.
|
| services.suricata.settings.logging.outputs.file.filename | Filename of the logfile.
|
| services.i2pd.reseed.zipfile | Path to local .zip file to reseed from.
|
| services.keycloak.settings | Configuration options corresponding to parameters set in
conf/keycloak.conf
|
| services.bonsaid.configFile | Path to a .json file specifying the state transitions
|
| fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| virtualisation.fileSystems | The file systems to be mounted
|
| services.teamspeak3.fileTransferPort | TCP port opened for file transfers.
|
| services.freeswitch.configDir | Override file in FreeSWITCH config template directory
|
| services.postfix-tlspol.settings.server.cache-file | Path to the cache file.
|
| fileSystems.<name>.label | Label of the device
|
| services.thanos.rule.query.sd-files | Path to file that contain addresses of query peers
|
| fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.inspircd.config | Verbatim inspircd.conf file
|
| services.sssd.config | Contents of sssd.conf.
|
| services.strongswan-swanctl.swanctl.secrets.rsa.<name>.file | File name in the rsa folder for which this passphrase
should be used.
|
| services.teamspeak3.fileTransferIP | IP on which the server instance will listen for incoming file transfer connections
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| services.xserver.config | The contents of the configuration file of the X server
(xorg.conf)
|
| services.thanos.compact.tracing.config | Tracing configuration
|
| services.thanos.sidecar.tracing.config | Tracing configuration
|
| services.thanos.receive.tracing.config | Tracing configuration
|
| services.ergochat.configFile | Path to configuration file
|
| services.orangefs.server.fileSystems.<name>.rootHandle | File system root ID.
|
| services.autorandr.profiles.<name>.config | Per output profile configuration.
|
| services.asusd.profileConfig.text | Text of the file.
|
| services.postsrsd.settings.secrets-file | Path to the file containing the secret keys.
Secrets are passed using LoadCredential= on the systemd unit,
so this options is read-only
|
| fileSystems.<name>.options | Options used to mount the file system
|
| services.prosody-filer.enable | Whether to enable Prosody Filer XMPP upload file server.
|
| services.parsedmarc.settings | Configuration parameters to set in
parsedmarc.ini
|
| boot.initrd.luks.devices.<name>.keyFileOffset | The offset of the key file
|
| services.factorio.configFile | The server's configuration file
|
| services.grafana.settings.smtp.key_file | File path to a key file.
|
| services.strongswan-swanctl.swanctl.secrets.ecdsa.<name>.file | File name in the ecdsa folder for which this
passphrase should be used.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs8.<name>.file | File name in the pkcs8 folder for which this
passphrase should be used.
|
| fileSystems.<name>.encrypted.label | Label of the unlocked encrypted device
|
| services.bird.config | BIRD Internet Routing Daemon configuration file.
http://bird.network.cz/
|
| services.suricata.settings.threshold-file | Suricata threshold configuration file.
|
| services.aria2.serviceUMask | The file mode creation mask for Aria2 service
|
| services.rabbitmq.configItems | Configuration options in RabbitMQ's new config file format,
which is a simple key-value format that can not express nested
data structures
|
| fileSystems.<name>.encrypted.enable | The block device is backed by an encrypted one, adds this device as a initrd luks entry.
|
| services.osquery.flags.pidfile | Path used for pid file.
|
| power.ups.upsd | Options for the upsd.conf configuration file.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs12.<name>.file | File name in the pkcs12 folder for which this
passphrase should be used.
|
| services.go-neb.config | Your config.yaml as a Nix attribute set
|
| fileSystems.<name>.autoFormat | If the device does not currently contain a filesystem (as
determined by blkid), then automatically
format it with the filesystem type specified in
fsType
|
| services.sogo.configReplaces | Replacement-filepath mapping for sogo.conf
|
| services.lighttpd.cgit.configText | Verbatim contents of the cgit runtime configuration file
|
| services.radvd.config | The contents of the radvd configuration file.
|
| services.go-neb.secretFile | Environment variables from this file will be interpolated into the
final config file using envsubst with this syntax: $ENVIRONMENT
or ${VARIABLE}
|
| services.dae.configFile | The path of dae config file, end with .dae.
|
| services.autorandr.profiles.<name>.config.<name>.dpi | Output DPI configuration.
|
| services.suricata.settings.logging.outputs.file.type | Type of logfile.
|
| services.seafile.seahubExtraConf | Extra config to append to seahub_settings.py file
|
| services.strongswan-swanctl.swanctl.secrets.private.<name>.file | File name in the private folder for which this passphrase should be used.
|
| boot.loader.limine.additionalFiles | A set of files to be copied to /boot
|
| boot.loader.refind.additionalFiles | A set of files to be copied to /boot
|
| services.xserver.filesSection | Contents of the first Files section of the X server configuration file.
|
| services.autorandr.profiles.<name>.config.<name>.mode | Output resolution.
|
| services.autorandr.profiles.<name>.config.<name>.rate | Output framerate.
|
| services.grafana.settings.smtp.cert_file | File path to a cert file.
|
| services.mpd.extraConfig | Extra directives added to to the end of MPD's configuration file,
mpd.conf
|
| services.turn-rs.secretFile | Environment variables from this file will be interpolated into the
final config file using envsubst with this syntax: $ENVIRONMENT or
${VARIABLE}
|
| fileSystems.<name>.autoResize | If set, the filesystem is grown to its maximum size before
being mounted. (This is typically the size of the containing
partition.) This is currently only supported for ext2/3/4
filesystems that are mounted during early boot.
|
| services.gvpe.configFile | GVPE config file, if already present
|
| services.autorandr.profiles.<name>.config.<name>.crtc | Output video display controller.
|
| services.gitlab.pages.settings | Configuration options to set in the GitLab Pages config
file
|
| services.frr.configFile | Configuration file to use for FRR
|
| services.chisel-server.authfile | Path to auth.json file
|
| services.movim.h2o.tls.identity.*.certificate-file | Path to certificate file
|
| services.tika.configFile | The Apache Tika configuration (XML) file to use.
|
| services.matterbridge.configFile | WARNING: THIS IS INSECURE, as your password will end up in
/nix/store, thus publicly readable
|
| services.seafile.seafileSettings.fileserver.port | The tcp port used by seafile fileserver.
|
| services.autorandr.profiles.<name>.config.<name>.scale.y | Vertical scaling factor/pixels.
|
| services.autorandr.profiles.<name>.config.<name>.scale.x | Horizontal scaling factor/pixels.
|
| services.asusd.profileConfig.source | Path of the source file.
|
| services.thanos.query-frontend.tracing.config | Tracing configuration
|
| services.suricata.settings.logging.outputs.file.level | Loglevel for logs written to the logfile.
|
| services.autorandr.profiles.<name>.config.<name>.gamma | Output gamma configuration.
|
| services.bird.preCheckConfig | Commands to execute before the config file check
|
| services.k3s.configPath | File path containing the k3s YAML config
|
| services.nginx.enableReload | Reload nginx when configuration file changes (instead of restart)
|
| fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.ndppd.configFile | Path to configuration file.
|
| services.dante.config | Contents of Dante's configuration file
|
| fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| services.seafile.seafileSettings | Configuration for seafile-server, see
https://manual.seafile.com/config/seafile-conf/
for supported values.
|
| services.dnscrypt-proxy.configFile | Path to TOML config file
|
| services.cntlm.configText | Verbatim contents of cntlm.conf.
|
| services.loki.configFile | Specify a configuration file that Loki should use
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.file | file from which the secret value is read
|
| services.suricata.settings.logging.outputs.file.format | Logformat for logs written to the logfile.
|
| services.hitch.pem-files | PEM files to use
|
| services.mimir.configFile | Specify a configuration file that Mimir should use.
|
| services.h2o.hosts.<name>.tls.identity.*.certificate-file | Path to certificate file
|
| programs.xonsh.config | Extra text added to the end of /etc/xonsh/xonshrc,
the system-wide control file for xonsh.
|
| services.autorandr.profiles.<name>.config.<name>.enable | Whether to enable the output.
|
| services.autorandr.profiles.<name>.config.<name>.rotate | Output rotate configuration.
|
| virtualisation.xen.store.settings.xenstored.log.file | Path to the Xen Store log file.
|
| services.tempo.configFile | Specify a path to a configuration file that Tempo should use.
|
| services.node-red.configFile | Path to the JavaScript configuration file
|
| services.prometheus.remoteRead.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.discourse.siteSettings | Discourse site settings
|
| services.gatus.environmentFile | File to load as environment file
|
| services.bcachefs.autoScrub.fileSystems | List of paths to bcachefs filesystems to regularly call bcachefs scrub on
|
| security.pam.u2f.enable | Enables U2F PAM (pam-u2f) module
|
| services.bcg.environmentFiles | File to load as environment file
|
| services.thanos.downsample.tracing.config | Tracing configuration
|
| services.bind.configFile | Overridable config file to use for named
|
| services.btrfs.autoScrub.fileSystems | List of paths to btrfs filesystems to regularly call btrfs scrub on
|
| services.jigasi.config | Contents of the sip-communicator.properties configuration file for jigasi.
|
| services.prometheus.remoteWrite.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.rke2.configPath | File path containing the rke2 YAML config
|
| users.motdFile | A file containing the message of the day shown to users when they log in.
|
| services.soju.configFile | Path to config file
|
| services.komodo-periphery.configFile | Path to the periphery configuration file
|
| services.nix-serve.secretKeyFile | The path to the file used for signing derivation data
|
| services.cfssl.configFile | Path to configuration file
|
| services.target.config | Content of /etc/target/saveconfig.json
This file is normally read and written by targetcli
|
| services.autorandr.profiles.<name>.config.<name>.scale.method | Output scaling method.
|
| services.mihomo.configFile | Configuration file to use.
|
| services.redis.servers.<name>.logfile | Specify the log file name
|
| services.autorandr.profiles.<name>.config.<name>.primary | Whether output should be marked as primary
|
| services.home-assistant.config | Your configuration.yaml as a Nix attribute set
|
| services.prometheus.exporters.shelly.metrics-file | Path to the JSON file with the metric definitions
|
| hardware.pcmcia.config | Path to the configuration file which maps the memory, IRQs
and ports used by the PCMCIA hardware.
|
| services.gatus.configFile | Path to the Gatus configuration file
|
| services.httpd.configFile | Override the configuration file used by Apache
|
| services.squid.configText | Verbatim contents of squid.conf
|
| services.unbound.checkconf | Whether to check the resulting config file with unbound checkconf for syntax errors
|
| services.yggdrasil.configFile | A file which contains JSON or HJSON configuration for yggdrasil
|
| services.orangefs.client.fileSystems.*.target | Target URL
|
| programs.less.configFile | Path to lesskey configuration file.
configFile takes precedence over commands,
clearDefaultCommands, lineEditingKeys, and
envVariables.
|
| programs.ssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.udev.extraHwdb | Additional hwdb files
|
| services.prometheus.remoteRead.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| virtualisation.fileSystems.<name>.fsType | Type of the file system
|
| services.v2ray.configFile | The absolute path to the configuration file
|
| fonts.fontconfig.includeUserConf | Include the user configuration from
~/.config/fontconfig/fonts.conf or
~/.config/fontconfig/conf.d.
|
| services.autorandr.profiles.<name>.config.<name>.scale | Output scale configuration
|
| services.usbguard.ruleFile | This tells the USBGuard daemon which file to load as policy rule set
|
| services.dolibarr.h2o.tls.identity.*.certificate-file | Path to certificate file
|
| services.dnscrypt-proxy2.configFile | Path to TOML config file
|
| services.tor.tsocks.config | Extra configuration
|
| virtualisation.xen.store.settings.xenstored.accessLog.file | Path to the Xen Store access log file.
|
| boot.resumeDevice | Device for manual resume attempt during boot
|
| services.mysql.configFile | Override the configuration file used by MySQL
|
| services.lact.settings | Settings for LACT
|
| security.pam.oath.usersFile | Set the path to file where the user's credentials are
stored
|
| services.prometheus.remoteWrite.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.buffyboard.configFile | Path to an INI format configuration file to provide Buffyboard
|
| services.filesender.configureNginx | Configure nginx as a reverse proxy for FileSender.
|
| services.seafile.seafileSettings.fileserver.host | The bind address used by seafile fileserver
|
| services.orangefs.client.fileSystems.*.mountPoint | Mount point.
|
| services.geoipupdate.settings | geoipupdate configuration options
|
| services.autorandr.profiles.<name>.config.<name>.position | Output position
|
| services.seafile.user | User account under which seafile runs.
|
| services.jitsi-meet.config | Client-side web application settings that override the defaults in config.js
|
| services.prometheus.scrapeConfigs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| boot.initrd.luks.devices.<name>.keyFileSize | The size of the key file
|
| services.rshim.config | Structural setting for the rshim configuration file
(/etc/rshim.conf)
|
| services.postfix.config | The main.cf configuration file as key value set.
|
| services.documize.key | The key.pem file used for https.
|
| services.go-camo.keyFile | A file containing the HMAC key to use for signing URLs
|
| services.ifm.enable | Whether to enable Improved file manager, a single-file web-based filemanager
Lightweight and minimal, served using PHP's built-in server
.
|
| services.tcsd.stateDir | The location of the system persistent storage file
|
| services.orangefs.client.fileSystems.*.options | Mount options
|
| services.klipper.configDir | Path to Klipper config file.
|
| services.immich.secretsFile | Path of a file with extra environment variables to be loaded from disk
|
| services.artalk.configFile | Artalk config file path
|
| services.biboumi.settings.ca_file | Specifies which file should be used as the list of trusted CA
when negotiating a TLS session.
|
| services.solanum.config | Solanum IRC daemon configuration file.
check https://github.com/solanum-ircd/solanum/blob/main/doc/reference.conf for all options.
|
| services.riemann.config | Contents of the Riemann configuration file
|
| services.onlyoffice.securityNonceFile | File holding nginx configuration that sets the nonce used to create secret links
|
| services.webdav.configFile | Path to config file
|
| virtualisation.fileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| services.netbird.clients.<name>.dir.state | A state directory used by NetBird client to store config.json, state.json & resolv.conf.
|
| services.netbird.tunnels.<name>.dir.state | A state directory used by NetBird client to store config.json, state.json & resolv.conf.
|
| services.udev.extraRules | Additional udev rules
|
| services.angrr.configFile | Path to the angrr configuration file in TOML format
|
| services.seafile.dataDir | Path in which to store user data
|
| services.conman.configFile | The absolute path to the configuration file
|
| systemd.mounts.*.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.units.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.diod.exportall | Export all file systems listed in /proc/mounts
|
| services.documize.cert | The cert.pem file used for https.
|
| services.zwave-js.secretsConfigFile | JSON file containing secret keys
|
| services.prometheus.scrapeConfigs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.seafile.group | Group under which seafile runs.
|
| services.orangefs.server.fileSystems.<name>.troveSyncData | Sync data.
|
| boot.tmp.cleanOnBoot | Whether to delete all files in /tmp during boot.
|
| services.ntopng.configText | Overridable configuration file contents to use for ntopng
|
| services.nsd.zones.<name>.data | The actual zone data
|
| power.ups.upsmon | Options for the upsmon.conf configuration file.
|
| programs.schroot.profiles.<name>.fstab | A file in the format described in fstab(5), used to mount filesystems inside the chroot
|
| services.dnsmasq.configFile | Path to the configuration file of dnsmasq.
|
| services.orangefs.server.fileSystems.<name>.troveSyncMeta | Sync meta data.
|
| programs.xfs_quota.projects.<name>.fileSystem | XFS filesystem hosting the xfs_quota project.
|
| services.powerdns.secretFile | Environment variables from this file will be interpolated into the
final config file using envsubst with this syntax: $ENVIRONMENT
or ${VARIABLE}
|
| services.httpd.phpOptions | Options appended to the PHP configuration file php.ini.
|
| fileSystems.<name>.device | The device as passed to mount
|
| services.inadyn.configFile | Configuration file for inadyn
|
| services.corerad.configFile | Path to CoreRAD TOML configuration file.
|
| services.umurmur.configFile | Configuration file, default is generated from config.service.umurmur.settings
|
| services.lirc.configs | Configurations for lircd to load, see man:lircd.conf(5) for details (lircd.conf)
|
| programs.schroot.profiles.<name>.copyfiles | A list of files to copy into the chroot from the host system.
|
| services.crab-hole.configFile | The config file of crab-hole
|
| services.autorandr.profiles.<name>.config.<name>.transform | Refer to
xrandr(1)
for the documentation of the transform matrix.
|
| systemd.user.units.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.deluge.config | Deluge core configuration for the core.conf file
|
| programs.git.config | Configuration to write to /etc/gitconfig
|
| systemd.slices.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.timers.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.doh-server.configFile | The config file for the doh-server
|
| services.riemann-dash.config | Contents added to the end of the riemann-dash configuration file.
|
| services.opentsdb.config | The contents of OpenTSDB's configuration file
|
| services.orangefs.server.fileSystems.<name>.extraConfig | Extra config for <FileSystem> section.
|
| services.openssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services._3proxy.usersFile | Load users and passwords from this file
|
| services.telegraf.environmentFiles | File to load as environment file
|
| systemd.user.timers.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.slices.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| xdg.portal.configPackages | List of packages that provide XDG desktop portal configuration, usually in
the form of share/xdg-desktop-portal/$desktop-portals.conf
|
| fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.sabnzbd.configFile | Path to config file (deprecated, use settings instead and set this value to null)
|
| services.kanata.keyboards.<name>.configFile | The config file
|
| services.sniproxy.config | sniproxy.conf configuration excluding the daemon username and pid file.
|
| services.akkoma.config | Configuration for Akkoma
|
| systemd.targets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.sockets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.traefik.dynamic.files | Dynamic configuration files to write
|
| services.phpfpm.phpOptions | Options appended to the PHP configuration file php.ini.
|
| services.g810-led.profile | Keyboard profile to apply at boot time
|
| services.duplicati.parametersFile | This file can be used to store some or all of the options given to the
commandline client
|
| security.apparmor.policies.<name>.profile | The profile file contents
|
| services.prometheus.scrapeConfigs.*.file_sd_configs.*.files | Patterns for files from which target groups are extracted
|
| services.seafile.enable | Whether to enable Seafile server.
|
| services.hylafax.faxqConfig | Attribute set of lines for the global
faxq config file etc/config
|
| services.nitter.sessionsFile | Path to the session tokens file
|
| services.cachefilesd.extraConfig | Additional configuration file entries
|
| services.artalk.settings | The artalk configuration
|
| systemd.user.sockets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.targets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.opendkim.configFile | Additional opendkim configuration as a file.
|
| services.oxidized.configFile | Path to the oxidized configuration file.
|
| services.tautulli.configFile | The location of Tautulli's config file.
|
| services.guix.publish.generateKeyPair | Whether to generate signing keys in /etc/guix which are
required to initialize a substitute server
|
| security.tpm2.fapi.profileDir | Directory that contains all cryptographic profiles known to FAPI.
|
| services.rspamd.localLuaRules | Path of file to link to /etc/rspamd/rspamd.local.lua for local
rules written in Lua
|
| services.thanos.rule.rule-files | Rule files that should be used by rule manager
|
| system.copySystemConfiguration | If enabled, copies the NixOS configuration file
(usually /etc/nixos/configuration.nix)
and symlinks it from the resulting system
(getting to /run/current-system/configuration.nix)
|
| services.logcheck.files | Which log files to check.
|
| services.nsd.keys.<name>.keyFile | Path to the file which contains the actual base64 encoded
key
|
| programs.screen.screenrc | The contents of /etc/screenrc file
|
| services.k3s.charts | Packaged Helm charts that are linked to /var/lib/rancher/k3s/server/static/charts before k3s starts
|
| services.ejabberd.configFile | Configuration file for ejabberd in YAML format
|
| services.routedns.configFile | Path to RouteDNS TOML configuration file.
|
| services.syslog-ng.configHeader | The very first lines of the configuration file
|
| services.deluge.authFile | The file managing the authentication for deluge, the format of this
file is straightforward, each line contains a
username:password:level tuple in plaintext
|
| services.matrix-synapse.settings.pid_file | The file to store the PID in.
|
| services.seafile.gc.dates | When to run garbage collection on stored data blocks
|
| power.ups.users.<name>.passwordFile | The full path to a file that contains the user's (clear text)
password
|
| programs.less.lessopen | Before less opens a file, it first gives your input preprocessor a chance to modify the way the contents of the file are displayed.
|
| services.hylafax.hfaxdConfig | Attribute set of lines for the global
hfaxd config file etc/hfaxd.conf
|
| systemd.services.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.suricata.settings.classification-file | Suricata classification configuration file.
|
| services.prometheus.exporters.postgres.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.murmur.environmentFile | Environment file as defined in systemd.exec(5)
|
| systemd.services.<name>.path | Packages added to the service's PATH
environment variable
|
| security.krb5.settings | Structured contents of the krb5.conf file
|
| systemd.tmpfiles.rules | Rules for creation, deletion and cleaning of volatile and temporary files
automatically
|
| services.hardware.openrgb.startupProfile | The profile file to load from "/var/lib/OpenRGB" at startup.
|
| services.factorio.mods-dat | Mods settings can be changed by specifying a dat file, in the mod
settings file
format.
|
| services.rss-bridge.config.FileCache.path | Directory where to store cache files (if cache.type = "file").
|
| services.seafile.gc.enable | Whether to enable automatic garbage collection on stored data blocks.
|
| virtualisation.fileSystems.<name>.options | Options used to mount the file system
|
| networking.supplicant.<name>.configFile.path | External wpa_supplicant.conf configuration file
|
| services.tuned.profiles | Profiles for TuneD
|
| systemd.user.tmpfiles.users | Per-user rules for creation, deletion and cleaning of volatile and
temporary files automatically.
|
| systemd.user.services.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.ddclient.configFile | Path to configuration file
|
| security.tpm2.fapi.profileName | Name of the default cryptographic profile chosen from the profile_dir directory.
|
| services.seafile.adminEmail | Seafile Seahub Admin Account Email.
|
| services.uptime.configFile | The uptime configuration file
If mongodb: server != localhost, please set usesRemoteMongo = true
If you only want to run the monitor, please set enableWebService = false
and enableSeparateMonitoringService = true
If autoStartMonitor: false (recommended) and you want to run both
services, please set enableSeparateMonitoringService = true
|
| services.orangefs.server.fileSystems.<name>.extraStorageHints | Extra config for <StorageHints> section.
|
| services.sympa.settings | The sympa.conf configuration file as key value set
|
| services.lldap.settings | Free-form settings written directly to the lldap_config.toml file
|
| services.dovecot2.configFile | Config file used for the whole dovecot configuration.
|
| services.znc.confOptions.extraZncConf | Extra config to znc.conf file.
|
| services.printing.extraConf | Extra contents of the configuration file of the CUPS daemon
(cupsd.conf).
|
| services.strongswan-swanctl.swanctl.authorities.<name>.file | Absolute path to the certificate to load
|
| security.sudo.extraRules | Define specific rules to be in the sudoers file
|
| services.charybdis.config | Charybdis IRC daemon configuration file.
|
| services.thelounge.extraConfig | The Lounge's config.js contents as attribute set (will be
converted to JSON to generate the configuration file)
|
| services.promtail.configFile | Config file path for Promtail
|
| services.k3s.manifests.<name>.content | Content of the manifest file
|
| services.rke2.charts | Packaged Helm charts that are linked to /var/lib/rancher/rke2/server/static/charts before rke2 starts
|
| services.aria2.settings | Generates the aria2.conf file
|
| services.unpoller.loki.pass | Path of a file containing the password for Loki
|
| nix.extraOptions | Additional text appended to nix.conf.
|
| services.athens.githubToken | Creates .netrc file with the given token to be used for GitHub
|
| services.forgejo.useWizard | Whether to use the built-in installation wizard instead of
declaratively managing the app.ini config file in nix.
|
| services.neard.settings | Neard INI-style configuration file as a Nix attribute set
|
| services.synergy.server.configFile | The Synergy server configuration file.
|
| services.radicale.config | Radicale configuration, this will set the service
configuration file
|
| services.keepalived.secretFile | Environment variables from this file will be interpolated into the
final config file using envsubst with this syntax: $ENVIRONMENT
or ${VARIABLE}
|
| security.sudo-rs.extraRules | Define specific rules to be in the sudoers file
|
| services.traefik.dynamic.files.<name>.settings | Dynamic configuration for Traefik, written in Nix.
This will be serialized to JSON (which is considered valid YAML) at build, and passed as part of the static file.
|
| services.prometheus.scrapeConfigs.*.file_sd_configs | List of file service discovery configurations.
|
| services.lokinet.settings.network.keyfile | The private key to persist address with
|
| services.lighttpd.configText | Overridable config file contents to use for lighttpd
|
| environment.etc.<name>.gid | GID of created file
|
| environment.etc.<name>.uid | UID of created file
|
| services.filebeat.enable | Whether to enable filebeat.
|
| services.drupal.sites.<name>.filesDir | The location of the Drupal files directory.
|
| services.radicle.checkConfig | Whether to enable checking the config.json file resulting from services.radicle.settings.
|
| services.xtreemfs.mrc.syncMode | The sync mode influences how operations are committed to the disk
log before the operation is acknowledged to the caller.
-ASYNC mode the writes to the disk log are buffered in memory by the operating system
|
| services.xtreemfs.dir.syncMode | The sync mode influences how operations are committed to the disk
log before the operation is acknowledged to the caller.
-ASYNC mode the writes to the disk log are buffered in memory by the operating system
|
| boot.initrd.services.udev.rules | udev rules to include in the initrd
only
|
| services.hylafax.userAccessFile | The hosts.hfaxd
file entry in the spooling area
will be symlinked to the location given here
|
| boot.swraid.mdadmConf | Contents of /etc/mdadm.conf.
|
| services.rke2.manifests.<name>.content | Content of the manifest file
|
| services.webdav-server-rs.configFile | Path to config file
|
| systemd.user.services.<name>.path | Packages added to the service's PATH
environment variable
|
| services.samba.settings | Configuration file for the Samba suite in ini format
|
| services.hickory-dns.configFile | Path to an existing toml file to configure hickory-dns with
|
| services.graphite.carbon.config | Content of carbon configuration file.
|
| services.seafile.workers | The number of gunicorn worker processes for handling requests.
|
| services.prometheus.exporters.php-fpm.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.sickbeard.configFile | Path to config file.
|
| services.trickster.configFile | Path to configuration file.
|
| services.mighttpd2.config | Verbatim config file to use
(see https://kazu-yamamoto.github.io/mighttpd2/config.html)
|
| virtualisation.fileSystems.<name>.noCheck | Disable running fsck on this filesystem.
|
| programs.neovim.enable | Whether to enable Neovim
|
| services.supybot.configFile | Path to initial supybot config file
|
| services.grafana.settings.server.cert_file | Path to the certificate file (if protocol is set to https or h2).
|
| systemd.user.tmpfiles.rules | Global user rules for creation, deletion and cleaning of volatile and
temporary files automatically
|
| systemd.automounts.*.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.headscale.configFile | Path to the configuration file of headscale.
|
| services.httpd.logPerVirtualHost | If enabled, each virtual host gets its own
access.log and
error.log, namely suffixed by the
hostName of the virtual host.
|
| boot.initrd.systemd.root | Controls how systemd will interpret the root FS in initrd
|
| services.znc.confOptions.modules | A list of modules to include in the znc.conf file.
|
| programs.dconf.profiles | Attrset of dconf profiles
|
| services.prometheus.remoteRead.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| security.acme.certs.<name>.profile | The certificate profile to choose if the CA offers multiple profiles.
|
| services.disnix.profiles | Names of the Disnix profiles to expose in the system's PATH
|
| services.slurm.extraCgroupConfig | Extra configuration for cgroup.conf
|
| services.bitcoind.<name>.configFile | The configuration file path to supply bitcoind.
|
| fileSystems.<name>.overlay.useStage1BaseDirectories | If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot
|
| services.riemann.configFiles | Extra files containing Riemann configuration
|
| services.cachix-agent.profile | Profile name, defaults to 'system' (NixOS).
|
| services.udev.packages | List of packages containing udev rules
|
| systemd.user.tmpfiles.enable | Whether to enable systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer.
|
| services.diod.exports | List the file systems that clients will be allowed to mount
|
| services.reposilite.keyPasswordFile | Path the the file containing the password used to unlock the Java KeyStore file specified in services.reposilite.settings.keyPath
|
| services.openssh.moduliFile | Path to moduli file to install in
/etc/ssh/moduli
|
| systemd.nspawn.<name>.filesConfig | Each attribute in this set specifies an option in the
[Files] section of this unit
|
| virtualisation.fileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| services.litestream.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.glusterfs.tlsSettings | Make the server communicate via TLS
|
| services.mqtt2influxdb.mqtt.cafile | Certification Authority file for MQTT
|
| services.oauth2-proxy.profileURL | Profile access endpoint.
|
| services.restic.backups.<name>.rcloneConfigFile | Path to the file containing rclone configuration
|
| services.asusd.profileConfig | The content of /etc/asusd/profile.ron
|
| services.nominatim.ui.config | Nominatim UI configuration placed to theme/config.theme.js file
|
| services.homer.settings | Settings serialized into config.yml before build
|
| services.umami.settings.DATABASE_URL_FILE | A file containing a connection string for the database
|
| services.mympd.settings | Manages the configuration files declaratively
|
| services.coturn.no-auth | This option is opposite to lt-cred-mech.
(TURN Server with no-auth option allows anonymous access)
|
| services.prometheus.remoteWrite.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| environment.etc.<name>.mode | If set to something else than symlink,
the file is copied instead of symlinked, with the given
file mode.
|
| services.hedgedoc.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.pdfding.secretKeyFile | File containing the Django SECRET_KEY
|
| services.matrix-synapse.configFile | Path to the configuration file on the target system
|
| services.rtorrent.configText | The content of rtorrent.rc
|
| services.suricata.settings.pcap-file.checksum-checks | Possible values are:
- yes: checksum validation is forced
- no: checksum validation is disabled
- auto: Suricata uses a statistical approach to detect when
checksum off-loading is used. (default)
Warning: 'checksum-validation' must be set to yes to have checksum tested.
|
| services.home-assistant.configDir | The config directory, where your configuration.yaml is located.
|
| services.thanos.query.store.sd-files | Path to files that contain addresses of store API servers
|
| services.jitsi-meet.extraConfig | Text to append to config.js web application config file
|
| networking.wg-quick.interfaces.<name>.configFile | wg-quick .conf file, describing the interface
|
| services.prometheus.exporters.fastly.configFile | Path to a fastly-exporter configuration file
|
| services.minetest-server.config | Settings to add to the minetest config file
|
| services.thermald.configFile | The thermald manual configuration file
|
| services.hylafax.modems.<name>.type | Name of modem configuration file,
will be searched for in config
in the spooling area directory.
|
| services.umami.settings.APP_SECRET_FILE | A file containing a secure random string
|
| services.znc.config | Configuration for ZNC, see
https://wiki.znc.in/Configuration for details
|
| services.step-ca.settings | Settings that go into ca.json
|
| services.asterisk.extraConfig | Extra configuration options appended to the default
asterisk.conf file.
|
| services.namecoind.wallet | Wallet file
|
| services.teeworlds.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.filebeat.package | The filebeat package to use.
|
| virtualisation.fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.apcupsd.configText | Contents of the runtime configuration file, apcupsd.conf
|
| services.slurm.extraConfigPaths | Slurm expects config files for plugins in the same path
as slurm.conf
|
| fonts.fontconfig.localConf | System-wide customization file contents, has higher priority than
defaultFonts settings.
|
| services.mqtt2influxdb.mqtt.keyfile | Key file for MQTT
|
| services.strongswan.ca | A set of CAs (certification authorities) and their options for
the ‘ca xxx’ sections of the ipsec.conf
file.
|
| services.printing.extraFilesConf | Extra contents of the configuration file of the CUPS daemon
(cups-files.conf).
|
| services.filesender.database.passwordFile | A file containing the password corresponding to
services.filesender.database.user.
|
| services.dendrite.environmentFile | Environment file as defined in systemd.exec(5)
|
| programs.schroot.profiles | Custom configuration profiles for schroot.
|
| services.slurm.enableStools | Whether to provide a slurm.conf file
|
| security.pam.yubico.enable | Enables Yubico PAM (yubico-pam) module
|
| services.logrotate.configFile | Override the configuration file used by logrotate
|
| services.znc.confOptions.userModules | A list of user modules to include in the znc.conf file.
|
| services.mpd.settings.db_file | The path to MPD's database.
|
| services.pipewire.wireplumber.extraConfig | Additional configuration for the WirePlumber daemon when run in
single-instance mode (the default in nixpkgs and currently the only
supported way to run WirePlumber configured via extraConfig)
|
| services.prometheus.exporters.mysqld.configFile | Path to the services config file
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.prometheus.exporters.pve.configFile | Path to the service's config file
|
| services.mackerel-agent.apiKeyFile | Path to file containing the Mackerel API key
|
| services.outline.utilsSecretFile | File path that contains the utility secret key
|
| virtualisation.fileSystems.<name>.label | Label of the device
|
| services.datadog-agent.extraConfig | Extra configuration options that will be merged into the
main config file datadog.yaml.
|
| services.netbird.clients | Attribute set of NetBird client daemons, by default each one will:
- be manageable using dedicated tooling:
netbird-<name> script,
NetBird - netbird-<name> graphical interface when appropriate (see ui.enable),
- run as a
netbird-<name>.service,
- listen for incoming remote connections on the port
51820 (openFirewall by default),
- manage the
netbird-<name> wireguard interface,
- use the /var/lib/netbird-/config.json configuration file,
- override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json,
- (
hardened) be locally manageable by netbird-<name> system group,
With following caveats:
- multiple daemons will interfere with each other's DNS resolution of
netbird.cloud, but
should remain fully operational otherwise
|
| services.printing.browsedConf | The contents of the configuration. file of the CUPS Browsed daemon
(cups-browsed.conf)
|
| services.peering-manager.environmentFile | Environment file as defined in systemd.exec(5)
|
| security.doas.extraRules | Define specific rules to be set in the
/etc/doas.conf file
|
| services.prometheus.scrapeConfigs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.nsd.zonefilesCheck | Whether to check mtime of all zone files on start and sighup.
|
| services.outline.secretKeyFile | File path that contains the application secret key
|
| security.pam.services.<name>.p11Auth | If set, keys listed in
~/.ssh/authorized_keys and
~/.eid/authorized_certificates
can be used to log in with the associated PKCS#11 tokens.
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.couchdb.uriFile | This file contains the full URI that can be used to access this
instance of CouchDB
|
| services.filesender.user | User under which filesender runs.
|
| services.postfix.masterConfig | An attribute set of service options, which correspond to the service
definitions usually done within the Postfix
master.cf file.
|
| services.fail2ban.jails | The configuration of each Fail2ban “jail”
|
| services.headphones.configFile | Path to config file.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| boot.tmp.useZram | Whether to mount a zram device on /tmp during boot.
Large Nix builds can fail if the mounted zram device is not large enough
|
| services.cfssl.metadata | Metadata file for root certificate presence
|
| services.biboumi.credentialsFile | Path to a configuration file to be merged with the settings
|
| services.supybot.plugins | Attribute set of additional plugins that will be symlinked to the
plugin subdirectory
|
| services.pairdrop.rtcConfig | Configuration for STUN/TURN servers
|
| services.mqtt2influxdb.mqtt.certfile | Certificate file for MQTT
|
| services.phpfpm.pools.<name>.phpOptions | "Options appended to the PHP configuration file php.ini used for this PHP-FPM pool."
|
| services.discourse.backendSettings | Additional settings to put in the
discourse.conf file
|
| services.postfix.settings.main.smtp_tls_CAfile | File containing CA certificates of root CAs trusted to sign either remote SMTP server certificates or intermediate CA certificates
|
| hardware.fancontrol.config | Required fancontrol configuration file content
|
| services.vault-agent.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.powerdns-admin.config | Configuration python file
|
| services.sssd.environmentFile | Environment file as defined in systemd.exec(5)
|
| programs.zsh.histFile | Change history file.
|
| services.neo4j.https.sslPolicy | Neo4j SSL policy for HTTPS traffic
|
| boot.tmp.useTmpfs | Whether to mount a tmpfs on /tmp during boot.
Large Nix builds can fail if the mounted tmpfs is not large enough
|
| services.shibboleth-sp.configFile | Path to shibboleth config file
|
| services.gammu-smsd.backend.files.sentSMSPath | Where the transmitted SMSes are placed
|
| virtualisation.fileSystems.<name>.autoFormat | If the device does not currently contain a filesystem (as
determined by blkid), then automatically
format it with the filesystem type specified in
fsType
|
| services.gitlab-runner.configFile | Configuration file for gitlab-runner.
configFile takes precedence over services.
checkInterval and concurrent will be ignored too
|
| networking.networkmanager.ensureProfiles.environmentFiles | Files to load as environment file
|
| systemd.mounts.*.type | File system type.
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.angrr.settings.profile-policies.<name>.profile-paths | Paths to the Nix profile
|
| services.pangolin.settings | Additional attributes to be merged with the configuration options and written to Pangolin's config.yml file.
|
| services.seafile.seahubPackage | The seahub package to use.
|
| services.dockerRegistry.configFile | Path to CNCF distribution config file
|
| services.syncplay.saltFile | Path to the file that contains the server salt
|
| programs.less.lessclose | When less closes a file opened in such a way, it will call another program, called the input postprocessor,
which may perform any desired clean-up action (such as deleting the replacement file created by LESSOPEN).
|
| virtualisation.fileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| services.openafsServer.roles.fileserver.fileserverArgs | Arguments to the dafileserver process
|
| services.gammu-smsd.backend.files.inboxPath | Where the received SMSes are stored
|
| services.ifm.dataDir | Directory to serve throught the file managing service
|
| security.acme.defaults.profile | The certificate profile to choose if the CA offers multiple profiles.
|
| virtualisation.fileSystems.<name>.autoResize | If set, the filesystem is grown to its maximum size before
being mounted. (This is typically the size of the containing
partition.) This is currently only supported for ext2/3/4
filesystems that are mounted during early boot.
|
| services.etcd.keyFile | Key file to use for clients
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.file | Absolute path to the certificate to load
|
| services.nextcloud.config.dbpassFile | The full path to a file that contains the database password.
|
| fonts.fontDir.enable | Whether to create a directory with links to all fonts in
/run/current-system/sw/share/X11/fonts.
|
| hardware.deviceTree.overlays.*.dtsFile | Path to .dts overlay file, overlay is applied to
each .dtb file matching "compatible" of the overlay.
|
| services.calibre-server.auth.userDb | Choose users database file to use for authentication
|
| services.strongswan.setup | A set of options for the ‘config setup’ section of the
ipsec.conf file
|
| services.disnix.enableProfilePath | Whether to enable exposing the Disnix profiles in the system's PATH.
|
| services.prometheus.scrapeConfigs.*.azure_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| services.k3s.extraKubeletConfig | Extra configuration to add to the kubelet's configuration file
|
| environment.etc.<name>.user | User name of file owner
|
| services.prometheus.exporters.snmp.environmentFile | EnvironmentFile as defined in systemd.exec(5)
|
| services.gokapi.settingsFile | Path to config file to parse and append to settings
|
| boot.loader.grub.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the account
|
| services.teleport.settings | Contents of the teleport.yaml config file
|
| services.radicle.ci.broker.checkConfig | Whether to enable checking the ci-broker.yaml file resulting from services.radicle.ci.broker.settings.
|
| services.osrm.dataFile | Data file location
|
| services.nghttpx.rlimit-nofile | Set maximum number of open files (RLIMIT_NOFILE) to <N>
|
| services.gammu-smsd.backend.files.errorSMSPath | Where SMSes with error in transmission is placed
|
| services.tailscale.serve.configFile | Path to a Tailscale Serve configuration file in JSON format
|
| virtualisation.fileSystems.<name>.encrypted.blkDev | Location of the backing encrypted device.
|
| services.syslogd.defaultConfig | The default syslog.conf file configures a
fairly standard setup of log files, which can be extended by
means of extraConfig.
|
| services.dnsproxy.settings | Contents of the config.yaml config file
|
| services.openvpn.servers.<name>.config | Configuration of this OpenVPN instance
|
| services.mqtt2influxdb.environmentFiles | File to load as environment file
|
| services.maubot.extraConfigFile | A file for storing secrets
|
| services.pretalx.settings.files.upload_limit | Maximum file upload size in MiB.
|
| systemd.user.tmpfiles.users.<name>.rules | Per-user rules for creation, deletion and cleaning of volatile and
temporary files automatically
|
| services.mosquitto.listeners.*.users.<name>.hashedPasswordFile | Specifies the path to a file containing the
hashed password for the MQTT user
|
| services.weblate.smtp.passwordFile | Location of a file containing the SMTP password
|
| services.nominatim.database.passwordFile | Password file used for Nominatim database connection
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.azure_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| boot.plymouth.font | Font file made available for displaying text on the splash screen.
|
| services.nextcloud.config.objectstore.s3.sseCKeyFile | If provided this is the full path to a file that contains the key
to enable [server-side encryption with customer-provided keys][1]
(SSE-C)
|
| swapDevices.*.device | Path of the device or swap file.
|
| services.ttyd.caFile | SSL CA file path for client certificate verification.
|
| services.seafile.ccnetSettings | Configuration for ccnet, see
https://manual.seafile.com/config/ccnet-conf/
for supported values.
|
| services.filebeat.inputs.<name>.type | The input type
|
| services.traccar.environmentFile | File containing environment variables to substitute in the configuration before starting Traccar
|
| services.send.redis.passwordFile | The path to the file containing the Redis password
|
| services.gammu-smsd.backend.files.outboxPath | Where SMSes to be sent should be placed
|
| services.etcd.certFile | Cert file to use for clients
|
| services.ttyd.certFile | SSL certificate file path.
|
| security.pam.rssh.settings.auth_key_file | Path to file with trusted public keys in OpenSSH's authorized_keys format
|
| fonts.fontconfig.enable | If enabled, a Fontconfig configuration file will be built
pointing to a set of default fonts
|
| services.unpoller.influxdb.pass | Path of a file containing the password for influxdb
|
| environment.etc.<name>.group | Group name of file owner
|
| services.rke2.extraKubeletConfig | Extra configuration to add to the kubelet's configuration file
|
| services.vaultwarden.config | The configuration of vaultwarden is done through environment variables,
therefore it is recommended to use upper snake case (e.g. DISABLE_2FA_REMEMBER)
|
| services.librechat.credentialsFile | Path to a file that contains environment variables
|
| services.filesender.enable | Whether to enable FileSender.
|
| services.prosody-filer.settings | Configuration for Prosody Filer
|
| boot.plymouth.logo | Logo which is displayed on the splash screen
|
| services.cfssl.ca | CA used to sign the new certificate -- accepts '[file:]fname' or 'env:varname'.
|
| boot.iscsi-initiator.extraConfigFile | Append an additional file's contents to /etc/iscsid.conf
|
| security.dhparams.params.<name>.path | The resulting path of the generated Diffie-Hellman parameters
file for other services to reference
|
| services.hylafax.sendmailPath | Path to sendmail program
|
| services.cfssl.caKey | CA private key -- accepts '[file:]fname' or 'env:varname'.
|
| services.hydra.logo | Path to a file containing the logo of your Hydra instance.
|
| services.prometheus.exporters.postfix.logfilePath | Path where Postfix writes log entries
|
| services.honk.extraJS | An extra JavaScript file to be loaded by the client.
|
| programs.hyprland.enable | Whether to enable Hyprland, the dynamic tiling Wayland compositor that doesn't sacrifice on its looks
|
| services.arbtt.logFile | The log file for captured samples.
|
| services.prometheus.scrapeConfigs.*.triton_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.vdirsyncer.jobs.<name>.configFile | existing configuration file
|
| systemd.mounts.*.what | Absolute path of device node, file or other resource. (Mandatory)
|
| services.sillytavern.configFile | Path to the SillyTavern configuration file.
|
| services.ddclient.secretsFile | A file containing the secrets for the dynamic DNS provider
|
| virtualisation.fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.seafile.seahubAddress | Which address to bind the seahub server to, of the form:
|
| services.k3s.extraKubeProxyConfig | Extra configuration to add to the kube-proxy's configuration file
|
| services.immich.settings | Configuration for Immich
|
| security.pam.services.<name>.u2fAuth | If set, users listed in
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set) are able to log in with the associated U2F key
|
| environment.profiles | A list of profiles used to setup the global environment.
|
| services.postfix.settings.master | The master.cf configuration file as an attribute set of service
defitions
|
| services.etebase-server.settings.global.secret_file | The path to a file containing the secret
used as django's SECRET_KEY.
|
| virtualisation.fileSystems.<name>.device | The device as passed to mount
|
| hardware.sane.drivers.scanSnap.package | The epjitsu package to use
|
| systemd.tmpfiles.settings | Declare systemd-tmpfiles rules to create, delete, and clean up volatile
and temporary files and directories
|
| services.firezone.relay.tokenFile | A file containing the firezone relay token
|
| services.filebrowser.user | User account under which FileBrowser runs.
|
| services.honk.extraCSS | An extra CSS file to be loaded by the client.
|
| services.sympa.domains.<name>.settings | The robot.conf configuration file as key value set
|
| services.autorandr.profiles | Autorandr profiles specification.
|
| services.sshguard.blacklist_file | Blacklist an attacker when its score exceeds threshold
|
| services.canaille.secretKeyFile | File containing the Flask secret key
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.triton_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.postgrest.pgpassFile | The password to authenticate to PostgreSQL with
|
| virtualisation.fileSystems.<name>.encrypted.label | Label of the unlocked encrypted device
|
| services.xserver.windowManager.i3.configFile | Path to the i3 configuration file
|
| programs.neovim.configure | Generate your init file from your list of plugins and custom commands
|
| boot.readOnlyNixStore | If set, NixOS will enforce the immutability of the Nix store
by making /nix/store a read-only bind
mount
|
| services.rsyslogd.defaultConfig | The default syslog.conf file configures a
fairly standard setup of log files, which can be extended by
means of extraConfig.
|
| services.xrdp.sslKey | ssl private key path
A self-signed certificate will be generated if file not exists.
|
| services.neo4j.bolt.sslPolicy | Neo4j SSL policy for BOLT traffic
|
| programs.openvpn3.netcfg.settings | Options stored in /etc/openvpn3/netcfg.json configuration file
|
| services.vsftpd.userlistFile | Newline separated list of names to be allowed/denied if userlistEnable
is true
|
| virtualisation.fileSystems.<name>.encrypted.enable | The block device is backed by an encrypted one, adds this device as a initrd luks entry.
|
| services.nsd.zonefilesWrite | Write changed secondary zones to their zonefile every N seconds
|
| services.hylafax.modems.<name>.config | Attribute set of values for the given modem
|
| power.ups.upsmon.monitor.<name>.passwordFile | The full path to a file containing the password from
upsd.users for accessing this UPS
|
| image.repart.split | Enables generation of split artifacts from partitions
|
| virtualisation.fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.tox-node.keysFile | Path to the file where DHT keys are stored.
|
| services.coturn.cert | Certificate file in PEM format.
|
| services.rke2.extraKubeProxyConfig | Extra configuration to add to the kube-proxy's configuration file
|
| services.matrix-synapse.settings.log_config | The file that holds the logging configuration.
|
| services.consul-template.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.filesender.package | The filesender package to use.
|
| services.filebrowser.group | Group under which FileBrowser runs.
|
| services.authelia.instances.<name>.settings.log.file_path | File path where the logs will be written
|
| services.xrdp.sslCert | ssl certificate path
A self-signed certificate will be generated if file not exists.
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.tuned.ppdSettings.profiles | Map of PPD profiles to native TuneD profiles.
|
| services.bacula-sd.device.<name>.archiveDevice | The specified name-string gives the system file name of the storage
device managed by this storage daemon
|
| services.etcd.peerKeyFile | Key file to use for peer to peer communication
|
| services.xserver.windowManager.qtile.configFile | Path to the qtile configuration file
|
| services.prometheus.alertmanager.environmentFile | File to load as environment file
|
| services.coturn.pkey | Private key file in PEM format.
|
| programs.less.enable | Whether to enable less, a file pager.
|
| services.hercules-ci-agent.settings.clusterJoinTokenPath | Location of the cluster-join-token.key file
|
| services.xserver.windowManager.mlvwm.configFile | Path to the mlvwm configuration file
|
| services.xserver.windowManager.bspwm.configFile | Path to the bspwm configuration file
|
| services.zammad.database.settings | The database.yml configuration file as key value set
|
| services.docuseal.secretKeyBaseFile | Path to file containing the secret key base
|
| services.glance.environmentFile | Path to an environment file as defined in systemd.exec(5)
|
| services.awstats.configs.<name>.logFile | The log file to be scanned
|
| services.openafsClient.globalCellServDBFile | Global CellServDB file to be deployed
|
| services.hercules-ci-agent.settings | These settings are written to the agent.toml file
|
| services.beesd.filesystems | BTRFS filesystems to run block-level deduplication on.
|
| services.mastodon.otpSecretFile | Path to file containing the OTP secret
|
| services.filebeat.inputs | Inputs specify how Filebeat locates and processes input data
|
| services.oink.apiKeyFile | Path to a file containing the API key to use when modifying DNS records.
|
| services.k3s.tokenFile | File path containing the k3s token to use when connecting to a server.
|
| services.filesender.localDomain | The domain serving your FileSender instance.
|
| services.cachefilesd.cacheDir | Directory to contain filesystem cache.
|
| virtualisation.fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.cjdns.confFile | Ignore all other cjdns options and load configuration from this file.
|
| services.diod.enable | Whether to enable the diod 9P file server.
|
| programs.yazi.enable | Whether to enable yazi terminal file manager.
|
| services.unpoller.unifi.defaults.pass | Path of a file containing the password for the unifi service user
|
| services.printing.cups-pdf.instances.<name>.settings | Settings for a cups-pdf instance, see the descriptions in the template config file in the cups-pdf package
|
| services.ocis.environmentFile | An environment file as defined in systemd.exec(5)
|
| virtualisation.fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| boot.initrd.clevis.useTang | Whether the Clevis JWE file used to decrypt the devices uses a Tang server as a pin.
|
| services.athens.downloadMode | Defines how Athens behaves when a module@version
is not found in storage
|
| services.glance.settings | Configuration written to a yaml file that is read by glance
|
| services.warpgate.databaseUrlFile | Path to file containing database connection string with credentials
|
| services.duplicity.excludeFileList | File containing newline-separated list of paths to exclude into the
backups
|
| services.duplicity.includeFileList | File containing newline-separated list of paths to include into the
backups
|
| services.shairport-sync.settings | Configuration options for Shairport-Sync
|
| boot.tmp.zramSettings.fs-type | The file system to put on the device
|
| services.gitea.dump.type | Archive format used to store the dump file.
|
| services.filebrowser.enable | Whether to enable FileBrowser.
|
| services.zeronet.fileserverPort | Zeronet fileserver port.
|
| services.trickster.profiler-port | Port that the /debug/pprof endpoint will listen on.
|
| services.bacula-fd.tls | TLS Options for the File Daemon
|
| security.pki.caBundle | (Read-only) the path to the final bundle of certificate authorities as a single file.
|
| boot.loader.grub.users.<name>.hashedPasswordFile | Specifies the path to a file containing the password hash
for the account, generated with grub-mkpasswd-pbkdf2
|
| boot.initrd.services.udev.packages | This will only be used when systemd is used in stage 1.
List of packages containing udev rules that will be copied to stage 1
|
| users.users.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| services.power-profiles-daemon.package | The power-profiles-daemon package to use.
|
| services.etcd.peerCertFile | Cert file to use for peer to peer communication
|
| services.bosun.stateFile | Path to bosun's state file.
|
| services.mautrix-discord.environmentFile | File containing environment variables to substitute when copying the configuration
out of Nix store to the services.mautrix-discord.dataDir
|
| services.athens.hgrcPath | Path to the .hgrc file.
|
| boot.initrd.systemd.tmpfiles.settings | Similar to systemd.tmpfiles.settings but the rules are
only applied by systemd-tmpfiles before initrd-switch-root.target
|
| services.timesyncd.servers | The set of NTP servers from which to synchronise
|
| services.mosquitto.listeners.*.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the MQTT user
|
| services.matterbridge.configPath | The path to the matterbridge configuration file.
|
| services.suricata.settings.rule-files | Files to load suricata-update managed rules, relative to 'default-rule-path'.
|
| services.firezone.gateway.tokenFile | A file containing the firezone gateway token
|
| services.gitolite.extraGitoliteRc | Extra configuration to append to the default ~/.gitolite.rc
|
| programs.git.lfs.enable | Whether to enable git-lfs (Large File Storage).
|
| services.factorio.extraSettingsFile | File, which is dynamically applied to server-settings.json before
startup
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| security.audit.rules | The ordered audit rules, with each string appearing as one line of the audit.rules file.
|
| services.foundationdb.logSize | Roll over to a new log file after the current log file
reaches the specified size.
|
| programs.openvpn3.log-service.settings | Options stored in /etc/openvpn3/log-service.json configuration file
|
| services.scrutiny.settings | Scrutiny settings to be rendered into the configuration file
|
| services.lldap.settings.jwt_secret_file | Path to a file containing the JWT secret.
|
| services.send.enable | Whether to enable Send, a file sharing web sevice for ffsend..
|
| services.blockbook-frontend.<name>.cssDir | Location of the dir with main.css CSS file
|
| services.filebeat.modules.<name>.module | The name of the module
|
| services.cloudflare-ddns.credentialsFile | Path to a file containing the Cloudflare API authentication token
|
| services.firefly-iii.settings.APP_KEY_FILE | The path to your appkey
|
| users.mysql.passwordFile | The path to the file containing the password for the user
|
| services.athens.tlsKeyFile | Path to the TLS key file.
|
| services.vsftpd.rsaKeyFile | RSA private key file.
|
| services.journald.remote.settings.Remote.ServerKeyFile | A path to a SSL secret key file in PEM format
|
| xdg.portal.wlr.enable | Whether to enable desktop portal for wlroots-based desktops
|
| services.xserver.windowManager.bspwm.sxhkd.configFile | Path to the sxhkd configuration file
|
| services.cachefilesd.enable | Whether to enable cachefilesd network filesystems caching daemon.
|
| services.ttyd.keyFile | SSL key file path
|
| services.nginx.logError | Configures logging
|
| boot.loader.systemd-boot.extraEntries | Any additional entries you want added to the systemd-boot menu
|
| services.rke2.tokenFile | File path containing the rke2 token to use when connecting to a server.
|
| services.engelsystem.settings | Options to be added to config.php, as a nix attribute set
|
| services.neo4j.ssl.policies.<name>.privateKey | The name of private PKCS #8 key file for this policy to be found
in the baseDirectory, or the absolute path to
the key file
|
| boot.initrd.enable | Whether to enable the NixOS initial RAM disk (initrd)
|
| services.power-profiles-daemon.enable | Whether to enable power-profiles-daemon, a DBus daemon that allows
changing system behavior based upon user-selected power profiles.
|
| services.journald.remote.output | The location of the output journal
|
| services.netbird.server.management.settings | Configuration of the netbird management server
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.prosody.ssl.key | Path to the key file.
|
| services.blockbook-frontend.<name>.configFile | Location of the blockbook configuration file.
|
| services.filesender.database.port | Database port.
|
| services.filesender.database.name | Database name.
|
| services.filesender.database.user | Database user.
|
| services.resolved.domains | A list of domains
|
| programs.msmtp.accounts | Named accounts and their respective configurations
|
| services.prometheus.exporters.sabnzbd.servers.*.apiKeyFile | The path to a file containing the API key
|
| services.vsftpd.rsaCertFile | RSA certificate file.
|
| services.mastodon.secretKeyBaseFile | Path to file containing the secret key base
|
| services.fedimintd.<name>.nginx.config.basicAuthFile | Basic Auth password file for a vhost
|
| boot.loader.grub.extraConfig | Additional GRUB commands inserted in the configuration file
just before the menu entries.
|
| services.firezone.server.smtp.passwordFile | File containing the password for the given username
|
| services.haven.environmentFile | Path to a file containing sensitive environment variables
|
| services.nullmailer.remotesFile | Path to the remotes control file
|
| services.filebrowser.package | The filebrowser package to use.
|
| services.xserver.xkb.extraLayouts.<name>.typesFile | The path to the xkb types file
|
| services.headscale.settings.policy.path | If the mode is set to "file", the path to a
HuJSON file containing ACL policies.
|
| services.vault.tlsKeyFile | TLS private key file
|
| services.nghttpx.tls.key | Path to the TLS key file.
|
| services.nghttpx.tls.crt | Path to the TLS certificate file.
|
| services.easytier.instances.<name>.configFile | Path to easytier config file
|
| services.filesender.settings | Configuration options used by FileSender
|
| services.plikd.enable | Whether to enable plikd, a temporary file upload system.
|
| services.crowdsec.localConfig.profiles | A list of profiles to enable
|
| services.ntp.extraConfig | Additional text appended to ntp.conf.
|
| services.prometheus.exporters.restic.rcloneConfigFile | Path to the file containing rclone configuration
|
| services.lasuite-meet.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| services.athens.tlsCertFile | Path to the TLS certificate file.
|
| services.mediatomb.customCfg | Allow the service to create and use its own config file inside the dataDir as
configured by services.mediatomb.dataDir
|
| services.athens.netrcPath | Path to the .netrc file.
|
| services.locate.output | The database file to build.
|
| services.pdfding.database.passwordFile | File containing POSTGRES_PASSWORD
|
| services.autorandr.profiles.<name>.hooks | Profile hook scripts.
|
| users.groups.<name>.members | The user names of the group members, added to the
/etc/group file.
|
| services.ncps.netrcFile | The path to netrc file for upstream authentication
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.prometheus.scrapeConfigs.*.ec2_sd_configs.*.profile | Named AWS profile used to connect to the API.
|
| services.ndppd.routeTTL | This tells 'ndppd' how often to reload the route file /proc/net/ipv6_route,
in milliseconds.
|
| services.yarr.authFilePath | Path to a file containing username:password. null means no authentication required to use the service.
|
| services.murmur.logFile | Path to the log file for Murmur daemon
|
| services.vault.tlsCertFile | TLS certificate file
|
| services.prosody.ssl.cert | Path to the certificate file.
|
| services.cfssl.dbConfig | Certificate db configuration file
|
| services.nextcloud.config.adminpassFile | The full path to a file that contains the admin's password
|
| services.pleroma.configs | Pleroma public configuration
|
| services.dashy.settings | Settings serialized into user-data/conf.yml before build
|
| services.tsidp.environmentFile | Path to an environment file loaded for the tsidp service
|
| services.mongodb.pidFile | Location of MongoDB pid file
|
| services.home-assistant.configWritable | Whether to make configuration.yaml writable
|
| users.users.<name>.subGidRanges | Subordinate group ids that user is allowed to use
|
| users.users.<name>.subUidRanges | Subordinate user ids that user is allowed to use
|
| services.davis.mail.dsnFile | A file containing the mail DSN for sending emails
|
| services.dnsmasq.settings | Configuration of dnsmasq
|
| services.traccar.settings | config.xml configuration as a Nix attribute set
|
| services.blockbook-frontend.<name>.certFile | To enable SSL, specify path to the name of certificate files without extension
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.exporters.sql.configFile | Path to configuration file.
|
| services.qbittorrent.profileDir | the path passed to qbittorrent via --profile.
|
| security.pam.ussh.caFile | By default pam-ussh reads the trusted user CA keys
from /etc/ssh/trusted_user_ca
|
| services.apache-kafka.configFiles.log4jProperties | Kafka log4j property configuration file path
|
| services.oauth2-proxy.tls.key | Path to private key file.
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| programs.nix-index.enable | Whether to enable nix-index, a file database for nixpkgs.
|
| services.lirc.options | LIRC default options described in man:lircd(8) (lirc_options.conf)
|
| services.kanidm.provision.extraJsonFile | A JSON file for provisioning persons, groups & systems
|
| services.newt.environmentFile | Path to a file containing sensitive environment variables for Newt
|
| services.gitea.camoHmacKeyFile | Path to a file containing the camo HMAC key.
|
| services.angrr.settings.profile-policies | Profile GC root policies.
|
| services.jupyterhub.extraConfig | Extra contents appended to the jupyterhub configuration
Jupyterhub configuration is a normal python file using
Traitlets. https://jupyterhub.readthedocs.io/en/stable/getting-started/config-basics.html
|
| services.couchdb.logFile | Specifies the location of file for logging output.
|
| services.opengfw.logFile | File to write the output to instead of systemd.
|
| services.movim.secretFile | The secret file to be sourced for the .env settings.
|
| services.xserver.xkb.extraLayouts.<name>.compatFile | The path to the xkb compat file
|
| services.cloudflared.certificateFile | Account certificate file, necessary to create, delete and manage tunnels
|
| services.castopod.database.passwordFile | A file containing the password corresponding to
services.castopod.database.user
|
| services.cron.cronFiles | A list of extra crontab files that will be read and appended to the main
crontab file when the cron service starts.
|
| services.prometheus.exporters.json.configFile | Path to configuration file.
|
| services.prometheus.exporters.ipmi.configFile | Path to configuration file.
|
| networking.networkmanager.ensureProfiles.profiles | Declaratively define NetworkManager profiles
|
| services.seafile.initialAdminPassword | Seafile Seahub Admin Account initial password
|
| services.gns3-server.ssl.keyFile | Private key file for the certificate.
|
| services.mastodon.vapidPublicKeyFile | Path to file containing the public key used for Web Push
Voluntary Application Server Identification
|
| services.murmur.logToFile | Whether to enable logging to a file instead of journald, which is stored in /var/log/murmur.
|
| systemd.mounts.*.options | Options used to mount the file system.
|
| services.nar-serve.enable | Whether to enable serving NAR file contents via HTTP.
|
| programs.thunar.enable | Whether to enable Thunar, the Xfce file manager.
|
| security.sudo.extraConfig | Extra configuration text appended to sudoers.
|
| services.soju.extraConfig | Lines added verbatim to the generated configuration file.
|
| services.bacula-fd.enable | Whether to enable the Bacula File Daemon.
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.airsonic.war | Airsonic war file to use.
|
| services.prometheus.exporters.mail.configFile | Specify the mailexporter configuration file to use.
|
| services.xserver.xkb.extraLayouts.<name>.symbolsFile | The path to the xkb symbols file
|
| services.livebook.environmentFile | Additional environment file as defined in systemd.exec(5)
|
| services.crossfire-server.configFiles | Text to append to the corresponding configuration files
|
| services.home-assistant.lovelaceConfigFile | Your ui-lovelace.yaml managed as configuraton file
|
| services.filesender.poolSettings | Options for FileSender's PHP pool
|
| services.beesd.filesystems.<name>.workDir | Name (relative to the root of the filesystem) of the subvolume where
the hash table will be stored.
|
| services.kanidm.provision.adminPasswordFile | Path to a file containing the admin password for kanidm
|
| services.prosody.modules.http_files | Serve static files from a directory over HTTP
|
| services.github-runners.<name>.tokenFile | The full path to a file which contains either
- a fine-grained personal access token (PAT),
- a classic PAT
- or a runner registration token
Changing this option or the tokenFile’s content triggers a new runner registration
|
| services.galene.keyFile | Path to the server's private key
|
| services.bookstack.settings.APP_KEY_FILE | The path to your appkey
|
| services.prometheus.globalConfig.query_log_file | Path to the file prometheus should write its query log to.
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.mastodon.vapidPrivateKeyFile | Path to file containing the private key used for Web Push
Voluntary Application Server Identification
|
| services.bepasty.servers.<name>.secretKeyFile | A file that contains the server secret for safe session cookies, must be set.
secretKeyFile takes precedence over secretKey
|
| power.ups.schedulerRules | File which contains the rules to handle UPS events.
|
| security.sudo-rs.extraConfig | Extra configuration text appended to sudoers.
|
| services.filebrowser.settings.port | The port to listen on.
|
| services.nginx.sslDhparam | Path to DH parameters file.
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.traefik.environmentFiles | Files to load as an environment file just before Traefik starts
|
| users.ldap.bind.passwordFile | The path to a file containing the credentials to use when binding
to the LDAP server (if not binding anonymously).
|
| services.sssd.settings | Contents of sssd.conf.
|
| users.extraUsers.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| hardware.nvidia-container-toolkit.csv-files | The path to the list of CSV files to use when generating the CDI specification in CSV mode.
|
| services.apache-kafka.configFiles.serverProperties | Kafka server.properties configuration file path
|
| services.filebrowser.settings | Settings for FileBrowser
|
| users.ldap.extraConfig | Extra configuration options that will be added verbatim at
the end of the ldap configuration file (ldap.conf(5))
|
| services.cron.systemCronJobs | A list of Cron jobs to be appended to the system-wide
crontab
|
| services.qui.secretFile | Path to a file that contains the session secret
|
| services.filebeat.modules | Filebeat modules provide a quick way to get started
processing common log formats
|
| services.galene.certFile | Path to the server's certificate
|
| services.flannel.etcd.caFile | Etcd certificate authority file
|
| services.flannel.etcd.keyFile | Etcd key file
|
| services.self-deploy.nixFile | Path to nix file in repository
|
| services.filebrowser.settings.root | The directory where FileBrowser stores files.
|
| services.kubernetes.addons.dns.corefile | Custom coredns corefile configuration
|
| services.bind.extraConfig | Extra lines to be added verbatim to the generated named configuration file.
|
| security.pam.services.<name>.gnupg.enable | If enabled, pam_gnupg will attempt to automatically unlock the
user's GPG keys with the login password via
gpg-agent
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.etcd.trustedCaFile | Certificate authority file to use for clients
|
| services.vault.extraConfig | Extra text appended to vault.hcl.
|
| security.pam.makeHomeDir.umask | The user file mode creation mask to use on home directories
newly created by pam_mkhomedir.
|
| services.hostapd.radios.<name>.networks.<name>.dynamicConfigScripts | All of these scripts will be executed in lexicographical order before hostapd
is started, right after the bss segment was generated and may dynamically
append bss options to the generated configuration file
|
| services.lemmy.pictrsApiKeyFile | File which contains the value of pictrs.api_key.
|
| services.mautrix-meta.instances.<name>.environmentFile | File containing environment variables to substitute when copying the configuration
out of Nix store to the services.mautrix-meta.dataDir
|
| services.filesender.settings.admin | UIDs (as per the configured saml_uid_attribute) of FileSender administrators
|
| swapDevices | The swap devices and swap files
|
| services.tsmBackup.servername | Create a systemd system service
tsm-backup.service that starts
a backup based on the given servername's stanza
|
| services.kubernetes.apiserver.serviceAccountKeyFile | File containing PEM-encoded x509 RSA or ECDSA private or public keys,
used to verify ServiceAccount tokens
|
| services.seafile.gc.randomizedDelaySec | Add a randomized delay before each garbage collection
|
| services.pufferpanel.extraPackages | Packages to add to the PATH environment variable
|
| services.foundationdb.pidfile | Path to pidfile for fdbmonitor.
|
| services.forgejo.dump.type | Archive format used to store the dump file.
|
| services.tftpd.enable | Whether to enable tftpd, a Trivial File Transfer Protocol server
|
| services.guacamole-client.settings | Configuration written to guacamole.properties.
The Guacamole web application uses one main configuration file called
guacamole.properties
|
| services.seafile.gc.persistent | Takes a boolean argument
|
| services.grav.maxUploadSize | The upload limit for files
|
| services.home-assistant.lovelaceConfig | Your ui-lovelace.yaml as a Nix attribute set
|
| boot.plymouth.extraConfig | Literal string to append to configFile
and the config file generated by the plymouth module.
|
| services.klipper.logFile | Path of the file Klipper should log to
|
| services.rspamd.locals | Local configuration files, written into /etc/rspamd/local.d/{name}.
|
| services._3proxy.confFile | Ignore all other 3proxy options and load configuration from this file.
|
| services.zitadel.steps | Contents of the database initialization config file
|
| users.ldap.daemon.extraConfig | Extra configuration options that will be added verbatim at
the end of the nslcd configuration file (nslcd.conf(5)).
|
| services.castopod.environmentFile | Environment file to inject e.g. secrets into the configuration
|
| programs.bat.settings | Parameters to be written to the system-wide bat configuration file.
|
| environment.etc | Set of files that have to be linked in /etc.
|
| services.llama-swap.tls.keyFile | Path to the TLS private key file
|
| services.trilium-server.environmentFile | File to load as the environment file
|
| services.graylog.nodeIdFile | Path of the file containing the graylog node-id
|
| services.pdnsd.extraConfig | Extra configuration directives that should be added to
pdnsd.conf.
|
| programs.atop.settings | Parameters to be written to /etc/atoprc.
|
| services.vault.storagePath | Data directory for file backend
|
| services.llama-swap.tls.certFile | Path to the TLS certificate file
|
| services.firezone.headless-client.tokenFile | A file containing the firezone client token
|
| services.bacula-fd.port | This specifies the port number on which the Client listens for
Director connections
|
| services.kubernetes.kubelet.extraConfig | Kubernetes kubelet extra configuration file entries
|
| services.i2pd.proto.httpProxy.keys | File to persist HTTPPROXY keys.
|
| services.prometheus.scrapeConfigs.*.azure_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.homer.enable | Whether to enable A dead simple static HOMepage for your servER to keep your services on hand, from a simple yaml configuration file.
.
|
| services.pocket-id.credentials | Environment variables which are loaded from the contents of the specified file paths
|
| services.hylafax.commonModemConfig | Attribute set of default values for
modem config files etc/config.*
|
| services.syncoid.sshKey | SSH private key file to use to login to the remote system
|
| services.filebrowser.openFirewall | Whether to enable opening firewall ports for FileBrowser.
|
| services.flannel.etcd.certFile | Etcd cert file
|
| programs.rush.rules | The rule statement configures a GNU Rush rule
|
| services.logrotate.settings.<name>.files | Single or list of files for which rules are defined
|
| services.patroni.dataDir | Folder where Patroni data will be written, this is where the pgpass password file will be written.
|
| services.sympa.mainDomain | Main domain to be used in sympa.conf
|
| services.asusd.animeConfig.text | Text of the file.
|
| services.asusd.asusdConfig.text | Text of the file.
|
| services.xserver.xkb.extraLayouts.<name>.keycodesFile | The path to the xkb keycodes file
|
| services.couchdb.argsFile | vm.args configuration
|
| services.cntlm.extraConfig | Additional config appended to the end of the generated cntlm.conf.
|
| services.gitea.extraConfig | Configuration lines appended to the generated gitea configuration file.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.basic_auth.password_file | HTTP password file
|
| virtualisation.sharedDirectories.<name>.securityModel | The security model to use for this share:
passthrough: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root)
mapped-xattr: some of the file attributes like uid, gid, mode bits and link target are stored as file attributes
mapped-file: the attributes are stored in the hidden .virtfs_metadata directory
|
| services.monero.environmentFile | Path to an EnvironmentFile for the monero service as defined in systemd.exec(5)
|
| programs.neovim.runtime | Set of files that have to be linked in runtime.
|
| services.turn-rs.settings | Turn-rs server config file
|
| services.opengfw.rulesFile | Path to file containing OpenGFW rules.
|
| boot.initrd.luks.devices | The encrypted disk that should be opened before the root
filesystem is mounted
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.gollum.extraConfig | Content of the configuration file
|
| services.printing.cups-pdf.instances.<name>.confFileText | This will contain the contents of cups-pdf.conf for this instance, derived from settings
|
| virtualisation.fileSystems.<name>.overlay.useStage1BaseDirectories | If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot
|
| services.dawarich.secretKeyBaseFile | Path to file containing the secret key base
|
| console.font | The font used for the virtual consoles
|
| services.grafana.settings.smtp.password | Password used for authentication
|
| services.filebrowser.settings.cache-dir | The directory where FileBrowser stores its cache.
|
| services.oink.secretApiKeyFile | Path to a file containing the secret API key to use when modifying DNS records.
|
| services.watchdogd.settings.filenr.enabled | Whether to enable watchdogd plugin filenr.
|
| users.extraGroups.<name>.members | The user names of the group members, added to the
/etc/group file.
|
| services.squid.extraConfig | Squid configuration
|
| services.pretalx.settings.filesystem.data | Base path for all other storage paths.
|
| services.chromadb.logFile | Specifies the location of file for logging output.
|
| services.netbox.secretKeyFile | Path to a file containing the secret key.
|
| services.wgautomesh.gossipSecretFile | File containing the gossip secret, a shared secret key to use for gossip
encryption
|
| services.strongswan.connections | A set of connections and their options for the ‘conn xxx’
sections of the ipsec.conf file.
|
| services.seafile.ccnetSettings.General.SERVICE_URL | Seahub public URL.
|
| services.kmscon.extraConfig | Extra contents of the kmscon.conf file.
|
| services.xserver.desktopManager.wallpaper.mode | The file ~/.background-image is used as a background image
|
| services.watchdogd.settings.filenr.warning | The high watermark level
|
| programs.tsmClient.defaultServername | If multiple server stanzas are declared with
programs.tsmClient.servers,
this option may be used to name a default
server stanza that IBM TSM uses in the absence of
a user-defined dsm.opt file
|
| services.code-server.socketMode | File mode of the socket.
|
| services.journald.remote.settings.Remote.SplitMode | With "host", a separate output file is used, based on the
hostname of the other endpoint of a connection
|
| services.xserver.xkb.extraLayouts.<name>.geometryFile | The path to the xkb geometry file
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| users.users.<name>.openssh.authorizedKeys.keyFiles | A list of files each containing one OpenSSH public key that should be
added to the user's authorized keys
|
| users.extraUsers.<name>.subUidRanges | Subordinate user ids that user is allowed to use
|
| users.extraUsers.<name>.subGidRanges | Subordinate group ids that user is allowed to use
|
| services.watchdogd.settings.filenr.logmark | Whether to log current stats every poll interval.
|
| services.pretalx.settings.filesystem.logs | Path to the log directory, that pretalx logs message to.
|
| services.kanidm.provision.idmAdminPasswordFile | Path to a file containing the idm admin password for kanidm
|
| networking.getaddrinfo.reload | Determines whether a process should detect changes to the configuration file since it was last read
|
| services.stash.jwtSecretKeyFile | Path to file containing a secret used to sign JWT tokens.
|
| services.postgres-websockets.pgpassFile | The password to authenticate to PostgreSQL with
|
| services.unpoller.unifi.controllers.*.pass | Path of a file containing the password for the unifi service user
|
| services.duckdns.tokenFile | The path to a file containing the token
used to authenticate with DuckDNS.
|
| services.sogo.ealarmsCredFile | Optional path to a credentials file for email alarms
|
| services.kmonad.keyboards.<name>.extraGroups | Extra permission groups to attach to the KMonad instance for
this keyboard
|
| boot.loader.grub.extraPerEntryConfig | Additional GRUB commands inserted in the configuration file
at the start of each NixOS menu entry.
|
| services.filesender.database.hostname | Database hostname.
|
| services.rspamd.locals.<name>.text | Text of the file.
|
| users.users.<name>.openssh.authorizedKeys.keys | A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys
|
| services.duplicati.parameters | This option can be used to store some or all of the options given to the
commandline client
|
| services.timesyncd.fallbackServers | The set of fallback NTP servers from which to synchronise
|
| boot.initrd.network.ssh.extraConfig | Verbatim contents of sshd_config.
|
| services.i2pd.proto.socksProxy.keys | File to persist SOCKSPROXY keys.
|
| services.vault-agent.instances.<name>.settings | Free-form settings written directly to the config.json file
|
| hardware.deviceTree.name | The name of an explicit dtb to be loaded, relative to the dtb base
|
| services.snips-sh.environmentFile | Additional environment file as defined in systemd.exec(5)
|
| services.gnunet.enable | Whether to run the GNUnet daemon
|
| security.please.enable | Whether to enable please, a Sudo clone which allows a users to execute a command or edit a
file as another user
.
|
| services.prometheus.remoteRead.*.basic_auth.password_file | HTTP password file
|
| services.matrix-synapse.settings.app_service_config_files | A list of application service config file to use
|
| services.rustus.info_storage | Info storages are used to store information about file uploads
|
| systemd.services.<name>.confinement.binSh | The program to make available as /bin/sh inside
the chroot
|
| services.slurm.extraConfig | Extra configuration options that will be added verbatim at
the end of the slurm configuration file.
|
| services.athens.basicAuthPass | Password for basic auth
|
| services.goss.settings | The global options in config file in yaml format
|
| services.netbox.enableLdap | Enable LDAP-Authentication for Netbox
|
| programs.spacefm.enable | Whether to install SpaceFM and create /etc/spacefm/spacefm.conf.
|
| services.privoxy.settings.filterfile | List of paths to Privoxy filter files
|
| services.gitea.minioAccessKeyId | Path to a file containing the Minio access key id.
|
| security.pki.caCertificateBlacklist | A list of blacklisted CA certificate names that won't be imported from
the Mozilla Trust Store into
/etc/ssl/certs/ca-certificates.crt
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.triton_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| networking.supplicant.<name>.configFile.writable | Whether the configuration file at configFile.path should be written to by
wpa_supplicant.
|
| services.athens.extraConfig | Extra configuration options for the athens config file.
|
| services.howdy.settings | Howdy configuration file
|
| services.chrony.extraConfig | Extra configuration directives that should be added to
chrony.conf
|
| services.omnom.settings | Configuration options for the /etc/omnom/config.yml file.
|
| services.cloudflared.tunnels.<name>.certificateFile | Account certificate file, necessary to create, delete and manage tunnels
|
| services.pocket-id.environmentFile | Path to an environment file to be loaded
|
| networking.networkmanager.ensureProfiles.secrets.package | The nm-file-secret-agent package to use.
|
| services.reposilite.database.passwordFile | Path to the file containing the password for the database connection
|
| services.mailman.restApiPassFile | Path to the file containing the value for MAILMAN_REST_API_PASS.
|
| services.gns3-server.ssl.certFile | Path to the SSL certificate file
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.privoxy.inspectHttps | Whether to configure Privoxy to inspect HTTPS requests, meaning all
encrypted traffic will be filtered as well
|
| services.tarsnap.keyfile | The keyfile which associates this machine with your tarsnap
account
|
| services.pangolin.environmentFile | Path to a file containing sensitive environment variables for Pangolin
|
| services.headscale.settings.database.postgres.password_file | A file containing the password corresponding to
database.user.
|
| services.slurm.mpi.extraMpiConfig | Extra configuration for that will be added to mpi.conf.
|
| services.prometheus.remoteWrite.*.basic_auth.password_file | HTTP password file
|
| services.calibre-web.dataDir | Where Calibre-Web stores its data
|
| services.lasuite-meet.bind | The path, host/port or file descriptior to bind the gunicorn socket to
|
| services.lasuite-docs.bind | The path, host/port or file descriptior to bind the gunicorn socket to
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.tls_config.key_file | Key file for client cert authentication to the server.
|
| services.watchdogd.settings.filenr.interval | Amount of seconds between every poll.
|
| services.openafsServer.roles.fileserver.enable | Fileserver role, serves files and volumes from its local storage.
|
| services.ntpd-rs.settings | Settings to write to ntp.toml
See https://docs.ntpd-rs.pendulum-project.org/man/ntp.toml.5
for more information about available options.
|
| services.filebrowser.settings.address | The address to listen on.
|
| services.snipe-it.appKeyFile | A file containing the Laravel APP_KEY - a 32 character long,
base64 encoded key used for encryption where needed
|
| services.librechat.credentials | Environment variables which are loaded from the contents of files at a file paths, mainly used for secrets
|
| boot.binfmt.registrations.<name>.fixBinary | Whether to open the interpreter file as soon as the
registration is loaded, rather than waiting for a
relevant file to be invoked
|
| services.etcd.peerTrustedCaFile | Certificate authority file to use for peer to peer communication
|
| services.gitweb.extraConfig | Verbatim configuration text appended to the generated gitweb.conf file.
|
| services.actkbd.extraConfig | Literal contents to append to the end of actkbd configuration file.
|
| services.artalk.allowModify | allow Artalk store the settings to config file persistently
|
| services.pdnsd.globalConfig | Global configuration that should be added to the global directory
of pdnsd.conf.
|
| services.pdnsd.serverConfig | Server configuration that should be added to the server directory
of pdnsd.conf.
|
| services.rspamd.extraConfig | Extra configuration to add at the end of the rspamd configuration
file.
|
| services.munin-node.extraConfig | munin-node.conf extra configuration
|
| services.vsftpd.extraConfig | Extra configuration to add at the bottom of the generated configuration file.
|
| security.pam.services.<name>.allowNullPassword | Whether to allow logging into accounts that have no password
set (i.e., have an empty password field in
/etc/passwd or
/etc/group)
|
| services.prometheus.remoteWrite.*.sigv4.profile | The named AWS profile used to authenticate.
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.kubeconfig_file | Optional path to a kubeconfig file
|
| services.prometheus.exporters.blackbox.configFile | Path to configuration file.
|
| programs.ssh.extraConfig | Extra configuration text prepended to ssh_config
|
| services.k3s.agentTokenFile | File path containing the k3s token agents can use to connect to the server
|
| services.angrr.settings.profile-policies.<name>.enable | Whether to enable this angrr policy.
|
| services.bacula-sd.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.bacula-fd.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| security.doas.extraConfig | Extra configuration text appended to doas.conf
|
| services.dawarich.configureNginx | Configure nginx as a reverse proxy for dawarich
|
| services.kresd.extraConfig | Extra lines to be added verbatim to the generated configuration file
|
| services.angrr.settings.profile-policies.<name>.keep-since | Retention period for the GC roots in this profile.
|
| services.autofs.autoMaster | Contents of /etc/auto.master file
|
| services.aria2.rpcSecretFile | A file containing the RPC secret authorization token
|
| services.bind.extraOptions | Extra lines to be added verbatim to the options section of the
generated named configuration file.
|
| system.autoUpgrade.flags | Any additional flags passed to nixos-rebuild
|
| services.suricata.settings.unix-command.filename | Filename for unix-command socket.
|
| programs.niri.useNautilus | Whether to enable Nautilus as file-chooser for xdg-desktop-portal-gnome.
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.tls_config.cert_file | Certificate file for client cert authentication to the server.
|
| services.bacula-dir.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.kubernetes.kubeconfig.caFile | Default kubeconfig certificate authority file used to connect to kube-apiserver.
|
| services.polipo.extraConfig | Polio configuration
|
| services.consul.extraConfig | Extra configuration options which are serialized to json and added
to the config.json file.
|
| services.ulogd.settings | Configuration for ulogd
|
| services.nextcloud.config.objectstore.s3.secretFile | The full path to a file that contains the access secret.
|
| services.nagios.mainConfigFile | If non-null, overrides the main configuration file of Nagios.
|
| users.extraUsers.<name>.openssh.authorizedKeys.keyFiles | A list of files each containing one OpenSSH public key that should be
added to the user's authorized keys
|
| services.xserver.dpi | Force global DPI resolution to use for X server
|
| environment.profileRelativeEnvVars | Attribute set of environment variable
|
| services.slskd.settings.retention.files.complete | Lifespan of completely downloaded files in minutes.
|
| services.nitter.preferences.stickyProfile | Make profile sidebar stick to top.
|
| services.zabbixWeb.extraConfig | Additional configuration to be copied verbatim into zabbix.conf.php.
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| networking.networkmanager.ensureProfiles.profiles.<name>.connection.id | This is the name that will be displayed by NetworkManager and GUIs.
|
| services.pretalx.settings.filesystem.static | Path to the directory that contains static files.
|
| services.tuned.settings.profile_dirs | Directories to search for profiles, separated by , or ;.
|
| security.isolate.cgRoot | Control group which subgroups are placed under
|
| services.prometheus.exporters.idrac.configurationPath | Path to the service's config file
|
| services.kubernetes.kubeconfig.keyFile | Default kubeconfig client key file used to connect to kube-apiserver.
|
| services.libinput.mouse.accelProfile | Sets the pointer acceleration profile to the given profile
|
| services.gitea.database.path | Path to the sqlite3 database file.
|
| services.rustus.storage.s3_access_key_file | File path that contains the S3 access key.
|
| services.rustus.storage.s3_secret_key_file | File path that contains the S3 secret key.
|
| boot.extraModprobeConfig | Any additional configuration to be appended to the generated
modprobe.conf
|
| services.asusd.fanCurvesConfig.text | Text of the file.
|
| services.asusd.userLedModesConfig.text | Text of the file.
|
| services.vault.extraSettingsPaths | Configuration files to load besides the immutable one defined by the NixOS module
|
| services.gerrit.plugins | List of plugins to add to Gerrit
|
| users.extraUsers.<name>.openssh.authorizedKeys.keys | A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys
|
| services.mpdscribble.passwordFile | File containing the password for the mpd daemon
|
| programs.dconf.packages | A list of packages which provide dconf profiles and databases in /etc/dconf.
|
| networking.hostFiles | Files that should be concatenated together to form /etc/hosts.
|
| services.cjdns.enable | Whether to enable the cjdns network encryption
and routing engine
|
| services.watchdogd.settings.filenr.critical | The critical watermark level
|
| services.autobrr.secretFile | File containing the session secret for the Autobrr web interface.
|
| services.varnish.listen.*.user | User name who owns the socket file.
|
| security.pam.services.<name>.text | Contents of the PAM service file.
|
| boot.initrd.luks.devices.<name>.header | The name of the file or block device that
should be used as header for the encrypted device.
|
| services.scrutiny.collector.settings | Collector settings to be rendered into the collector configuration file
|
| services.cyrus-imap.cyrusConfigFile | Path to the configuration file used for Cyrus.
|
| services.omnom.passwordFile | File containing the password for the SMTP user.
|
| services.nfs.server.exports | Contents of the /etc/exports file
|
| services.bitcoind.<name>.pidFile | Location of bitcoind pid file.
|
| services.openssh.extraConfig | Verbatim contents of sshd_config.
|
| environment.etc.<name>.text | Text of the file.
|
| services.rdnssd.enable | Whether to enable the RDNSS daemon
(rdnssd), which configures DNS servers in
/etc/resolv.conf from RDNSS
advertisements sent by IPv6 routers.
|
| boot.loader.generic-extlinux-compatible.enable | Whether to generate an extlinux-compatible configuration file
under /boot/extlinux.conf
|
| services.hostapd.radios.<name>.dynamicConfigScripts | All of these scripts will be executed in lexicographical order before hostapd
is started, right after the global segment was generated and may dynamically
append global options the generated configuration file
|
| services.cjdns.addExtraHosts | Whether to add cjdns peers with an associated hostname to
/etc/hosts
|
| services.prometheus.exporters.mikrotik.configFile | Path to a mikrotik exporter configuration file
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.mautrix-signal.environmentFile | File containing environment variables to be passed to the mautrix-signal service
|
| services.namecoind.rpc.key | Key file for securing RPC connections.
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.secret_key_file | Sets the secret key with the credentials read from the configured file
|
| services.httpd.extraConfig | Configuration lines appended to the generated Apache
configuration file
|
| services.nvme-rs.settings.email.smtp_password_file | File containing SMTP password
|
| services.filesender.database.createLocally | Create the PostgreSQL database and database user locally.
|
| services.athens.unixSocket | Path to the unix socket file
|
| services.kubernetes.kubeconfig.certFile | Default kubeconfig client certificate file used to connect to kube-apiserver.
|
| services.prometheus.scrapeConfigs.*.basic_auth.password_file | HTTP password file
|
| services.monero.banlist | Path to a text file containing IPs to block
|
| security.duosec.secretKeyFile | A file containing your secret key
|
| services.firezone.server.settingsSecret | This is a convenience option which allows you to set secret values for
environment variables by specifying a file which will contain the value
at runtime
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.beesd.filesystems.<name>.extraOptions | Extra command-line options passed to the daemon
|
| programs.command-not-found.dbPath | Absolute path to programs.sqlite
|
| services.jitsi-meet.videobridge.passwordFile | File containing password to the Prosody account for videobridge
|
| services.filesender.settings.log_facilities | Defines where FileSender logging is sent
|
| services.nextcloud.configureRedis | Whether to configure Nextcloud to use the recommended Redis settings for small instances.
The Nextcloud system check recommends to configure either Redis or Memcache for file lock caching.
The notify_push app requires Redis to be configured
|
| networking.networkmanager.ensureProfiles.profiles.<name>.connection.type | The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.
|
| services.cyrus-imap.imapdConfigFile | Path to the configuration file used for cyrus-imap.
|
| services.kavita.settings | Kavita configuration options, as configured in appsettings.json.
|
| services.jirafeau.enable | Whether to enable Jirafeau file upload application.
|
| security.isolate.extraConfig | Extra configuration to append to the configuration file.
|
| services.kubernetes.apiserver.webhookConfig | Kubernetes apiserver Webhook config file
|
| services.asusd.auraConfigs.<name>.text | Text of the file.
|
| programs.neovim.runtime.<name>.text | Text of the file.
|
| services.lemmy.database.uri | The connection URI to use
|
| services.sftpgo.loadDataFile | Path to a json file containing users and folders to load (or update) on startup
|
| services.dae.openFirewall.port | Port to be opened
|
| services.kavita.tokenKeyFile | A file containing the TokenKey, a secret with at 512+ bits
|
| boot.initrd.systemd.storePaths.*.source | Path of the source file.
|
| services.lemmy.database.uriFile | File which contains the database uri.
|
| services.asusd.asusdConfig.source | Path of the source file.
|
| services.asusd.animeConfig.source | Path of the source file.
|
| services.rke2.agentTokenFile | File path containing the rke2 token agents can use to connect to the server
|
| boot.nixStoreMountOpts | Defines the mount options used on a bind mount for the /nix/store
|
| services.acme-dns.settings | Free-form settings written directly to the acme-dns.cfg file
|
| services.portunus.seedPath | Path to a portunus seed file in json format
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.datadog-agent.apiKeyFile | Path to a file containing the Datadog API key to associate the
agent with your account.
|
| services.syncthing.key | Path to the key.pem file, which will be copied into Syncthing's
configDir.
|
| services.varnish.listen.*.mode | Permission of the socket file (3-digit octal value).
|
| services.filesender.settings.site_url | Site URL
|
| services.kubernetes.proxy.kubeconfig.caFile | Kubernetes proxy certificate authority file used to connect to kube-apiserver.
|
| services.angrr.settings.profile-policies.<name>.keep-latest-n | Keep the latest N GC roots in this profile.
|
| services.prometheus.exporters.borgmatic.configFile | The path to the borgmatic config file
|
| services.soft-serve.settings | The contents of the configuration file for soft-serve
|
| services.sympa.settingsFile | Set of files to be linked in /var/lib/sympa.
|
| services.gerrit.settings | Gerrit configuration
|
| services.uptime.usesRemoteMongo | Whether the configuration file specifies a remote mongo instance
|
| programs.tsmClient.dsmSysText | This configuration key contains the effective text
of the client system-options file "dsm.sys"
|
| services.filebrowser.settings.database | The path to FileBrowser's Bolt database.
|
| services.gitea.metricsTokenFile | Path to a file containing the metrics authentication token.
|
| services.pptpd.extraPppdOptions | Adds extra lines to the pppd options file.
|
| services.prosody.checkConfig | Check the configuration file with prosodyctl check config
|
| services.oxidized.routerDB | Path to the file/database which contains the targets for oxidized.
|
| services.weblate.extraConfig | Text to append to settings.py Weblate configuration file.
|
| services.privoxy.settings.actionsfile | List of paths to Privoxy action files
|
| services.outline.sslKeyFile | File path that contains the Base64-encoded private key for HTTPS
termination
|
| boot.initrd.luks.devices.<name>.keyFile | The name of the file (can be a raw device or a partition) that
should be used as the decryption key for the encrypted device
|
| services.beesd.filesystems.<name>.verbosity | Log verbosity (syslog keyword/level).
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.distccd.logLevel | Set the minimum severity of error that will be included in the log
file
|
| services.davfs2.davGroup | The group of the running mount.davfs daemon
|
| services.kubernetes.proxy.kubeconfig.keyFile | Kubernetes proxy client key file used to connect to kube-apiserver.
|
| services.radicle.publicKey | An SSH public key (as an absolute file path or directly as a string),
usually generated by rad auth.
|
| services.moodle.extraConfig | Any additional text to be appended to the config.php
configuration file
|
| networking.getaddrinfo.enable | Enables custom address sorting configuration for getaddrinfo(3) according to RFC 3484
|
| services.printing.snmpConf | The contents of /etc/cups/snmp.conf
|
| services.xray.settingsFile | The absolute path to the configuration file
|
| services.monica.appKeyFile | A file containing the Laravel APP_KEY - a 32 character long,
base64 encoded key used for encryption where needed
|
| services.prometheus.exporters.unpoller.loki.pass | Path of a file containing the password for Loki
|
| services.pinchflat.secretsFile | Secrets like SECRET_KEY_BASE and BASIC_AUTH_PASSWORD
should be passed to the service without adding them to the world-readable Nix store
|
| security.auditd.settings | auditd configuration file contents
|
| services.mchprs.settings | Configuration for MCHPRS via Config.toml
|
| services.zenohd.settings | Config options for zenoh.json5 configuration file
|
| services.postfix.extraConfig | Extra lines to be added verbatim to the main.cf configuration file.
|
| services.connman.extraConfig | Configuration lines appended to the generated connman configuration file.
|
| services.bacula-fd.director | This option defines director resources in Bacula File Daemon.
|
| services.varnish.listen.*.group | Group name who owns the socket file.
|
| services.nghttpx.extraConfig | Extra configuration options to be appended to the generated
configuration file.
|
| services.guix.storeDir | The store directory where the Guix service will serve to/from
|
| boot.loader.grub.splashImage | Background image used for GRUB
|
| services.lemmy.smtpPasswordFile | File which contains the value of email.smtp_password.
|
| services.aria2.settings.conf-path | Configuration file path.
|
| programs.tsmClient.enable | Whether to enable IBM Storage Protect (Tivoli Storage Manager, TSM)
client command line applications with a
client system-options file "dsm.sys"
.
|
| services.oauth2-proxy.keyFile | oauth2-proxy allows passing sensitive configuration via environment variables
|
| boot.initrd.systemd.storePaths.*.enable | Whether to enable copying of this file and symlinking it.
|
| services.lk-jwt-service.keyFile | Path to a file containing the credential mapping (<keyname>: <secret>) to access LiveKit
|
| services.fedimintd.<name>.nginx.config.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.outline.sslCertFile | File path that contains the Base64-encoded certificate for HTTPS
termination
|
| boot.tmp.zramSettings.options | By default, file systems and swap areas are trimmed on-the-go
by setting "discard"
|
| services.nagios.cgiConfigFile | Derivation for the configuration file of Nagios CGI scripts
that can be used in web servers for running the Nagios web interface.
|
| services.pgmanage.sqlRoot | This tells pgmanage where to put the SQL file history
|
| services.beesd.filesystems.<name>.spec | Description of how to identify the filesystem to be duplicated by this
instance of bees
|
| services.kubernetes.proxy.kubeconfig.certFile | Kubernetes proxy client certificate file used to connect to kube-apiserver.
|
| programs.tsmClient.package | The tsm-client package to use
|
| services.autorandr.profiles.<name>.hooks.preswitch | Preswitch hook executed before mode switch.
|
| services.clight.settings | Additional configuration to extend clight.conf
|
| services.diod.allsquash | Remap all users to "nobody"
|
| services.gokapi.settings | Configuration settings for the generated config json file
|
| services.syncthing.cert | Path to the cert.pem file, which will be copied into Syncthing's
configDir.
|
| services.netatalk.extmap | File name extension mappings
|
| services.icecast.extraConfig | Extra configuration added to icecast.xml inside the <icecast> element.
|
| services.transfer-sh.enable | Whether to enable Easy and fast file sharing from the command-line.
|
| services.zerobin.extraConfig | Extra configuration to be appended to the 0bin config file
(see https://0bin.readthedocs.org/en/latest/en/options.html)
|
| services.xserver.extraConfig | Additional contents (sections) included in the X server configuration file
|
| services.forgejo.dump.age | Age of backup used to decide what files to delete when cleaning
|
| services.stash.sessionStoreKeyFile | Path to file containing a secret for session store.
|
| services.sympa.database.name | Database name
|
| services.rspamd.locals.<name>.source | Path of the source file.
|
| services.printing.clientConf | The contents of the client configuration.
(client.conf)
|
| services.uhub.<name>.plugins.*.plugin | Path to plugin file.
|
| services.nginx.sso.configuration | nginx-sso configuration
(documentation)
as a Nix attribute set
|
| services.prometheus.exporters.fritz.settings.devices.*.password_file | Path to a file which contains the password to authenticate with the target device
|
| services.amule.settings | Free form attribute set for aMule settings
|
| services.autorandr.profiles.<name>.hooks.predetect | Predetect hook executed before autorandr attempts to run xrandr.
|
| services.grafana.settings.database.password | The database user's password (not applicable for sqlite3)
|
| services.netbox.ldapConfigPath | Path to the Configuration-File for LDAP-Authentication, will be loaded as ldap_config.py
|
| users.users.<name>.isNormalUser | Indicates whether this is an account for a “real” user
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.paperless.environmentFile | Path to a file containing extra paperless config options in the systemd EnvironmentFile
format
|
| services.pingvin-share.enable | Whether to enable Pingvin Share, a self-hosted file sharing platform.
|
| services.netdata.claimTokenFile | If set, automatically registers the agent using the given claim token
file.
|
| services.syslogd.extraConfig | Additional text appended to syslog.conf,
i.e. the contents of defaultConfig.
|
| services.cfdyndns.apiTokenFile | The path to a file containing the API Token
used to authenticate with CloudFlare.
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.kubo.enable | Whether to enable the Interplanetary File System (WARNING: may cause severe network degradation)
|
| services.grav.systemSettings | Settings written to user/config/system.yaml.
|
| services.pptpd.extraPptpdOptions | Adds extra lines to the pptpd configuration file.
|
| services.xl2tpd.extraXl2tpOptions | Adds extra lines to the xl2tpd configuration file.
|
| services.riemann-dash.dataDir | Location of the riemann-base dir
|
| services.cadvisor.storageDriverPasswordFile | File that contains the cadvisor storage driver password.
storageDriverPasswordFile takes precedence over storageDriverPassword
Warning: when storageDriverPassword is non-empty this defaults to a file in the
world-readable Nix store that contains the value of storageDriverPassword
|
| networking.useHostResolvConf | In containers, whether to use the
resolv.conf supplied by the host.
|
| services.nbd.server.exports.<name>.path | File or block device to export.
|
| programs.i3lock.package | The i3lock package to use. ::: {.note}
The i3lock package must include a i3lock file or link in its out directory in order for the u2fSupport option to work correctly.
:::
|
| services.db-rest.redis.passwordFile | Path to a file containing the redis password.
|
| services.strongswan-swanctl.strongswan.extraConfig | Contents of the strongswan.conf file.
|
| boot.initrd.systemd.contents.<name>.text | Text of the file.
|
| services.ncps.cache.databaseURLFile | File containing the URL of the database.
|
| boot.zfs.requestEncryptionCredentials | If true on import encryption keys or passwords for all encrypted datasets
are requested
|
| services.hostapd.radios.<name>.networks.<name>.macDenyFile | Specifies a file containing the MAC addresses to deny if macAcl is set to "deny" or "radius"
|
| services.filesender.settings.storage_filesystem_path | When using storage type filesystem this is the absolute path to the file system where uploaded files are stored until they expire
|
| services.opengfw.pcapReplay | Path to PCAP replay file
|
| services.znapzend.logLevel | The log level when logging to file
|
| services.logrotate.checkConfig | Whether the config should be checked at build time
|
| services.openafsServer.roles.fileserver.salvagerArgs | Arguments to the dasalvager process
|
| services.devpi-server.secretFile | Path to a shared secret file used for synchronization,
Required for all nodes in a replica/primary setup.
|
| services.sanoid.settings | Free-form settings written directly to the config file
|
| services.zitadel.masterKeyFile | Path to a file containing a master encryption key for ZITADEL
|
| services.stash.passwordFile | Path to file containing password for login.
|
| boot.specialFileSystems.<name>.fsType | Type of the file system
|
| services.opentelemetry-collector.configFile | Specify a path to a configuration file that Opentelemetry Collector should use.
|
| services.hylafax.modems.<name>.name | Name of modem device,
will be searched for in /dev.
|
| networking.extraHosts | Additional verbatim entries to be appended to /etc/hosts
|
| services.tarsnap.archives.<name>.keyfile | Set a specific keyfile for this archive
|
| programs.regreet.settings | ReGreet configuration file
|
| services.postfix.extraMasterConf | Extra lines to append to the generated master.cf file.
|
| services.xl2tpd.extraPppdOptions | Adds extra lines to the pppd options file.
|
| services.consul-template.instances.<name>.settings | Free-form settings written directly to the config.json file
|
| services.mautrix-whatsapp.environmentFile | File containing environment variables to be passed to the mautrix-whatsapp service
|
| services.sshwifty.sharedKeyFile | Path to a file containing the shared key.
|
| services.gitlab.backup.skip | Directories to exclude from the backup
|
| services.lemmy.adminPasswordFile | File which contains the value of setup.admin_password.
|
| services.mastodon.configureNginx | Configure nginx as a reverse proxy for mastodon
|
| environment.pathsToLink | List of directories to be symlinked in /run/current-system/sw.
|
| services.xserver.windowManager.herbstluftwm.configFile | Path to the herbstluftwm configuration file
|
| services.gitea.captcha.secretFile | Path to a file containing the CAPTCHA secret key.
|
| services.snipe-it.mail.passwordFile | A file containing the password corresponding to
mail.user.
|
| services.ntopng.extraConfig | Configuration lines that will be appended to the generated ntopng
configuration file
|
| services.taler.settings | Global configuration options for the taler config file
|
| services.phpfpm.extraConfig | Extra configuration that should be put in the global section of
the PHP-FPM configuration file
|
| boot.initrd.postDeviceCommands | Shell commands to be executed immediately after stage 1 of the
boot has loaded kernel modules and created device nodes in
/dev.
|
| virtualisation.containerd.configFile | Path to containerd config file
|
| services.hans.server.passwordFile | File that contains password
|
| services.kubernetes.kubelet.kubeconfig.caFile | Kubelet certificate authority file used to connect to kube-apiserver.
|
| services.ncdns.dnssec.keys.private | Path to the file containing the KSK private key.
|
| services.prometheus.remoteRead.*.bearer_token_file | Sets the Authorization header on every remote read request with the bearer token
read from the configured file
|
| services.syncplay.statsDBFile | Path to SQLite database file to store stats
|
| services.snapserver.streams.<name>.location | For type pipe or file, the path to the pipe or file
|
| services.cfdyndns.apikeyFile | The path to a file containing the API Key
used to authenticate with CloudFlare.
|
| services.gitea.minioSecretAccessKey | Path to a file containing the Minio secret access key.
|
| services.redmine.settings | Redmine configuration (configuration.yml)
|
| services.mjolnir.accessTokenFile | File containing the matrix access token for the mjolnir user.
|
| services.zitadel.settings | Contents of the runtime configuration file
|
| networking.wireless.secretsFile | File consisting of lines of the form varname=value
to define variables for the wireless configuration
|
| services.hostapd.radios.<name>.networks.<name>.macAllowFile | Specifies a file containing the MAC addresses to allow if macAcl is set to "allow" or "radius"
|
| services.slskd.settings.retention.files.incomplete | Lifespan of incomplete downloading files in minutes.
|
| services.kubernetes.kubelet.kubeconfig.keyFile | Kubelet client key file used to connect to kube-apiserver.
|
| boot.loader.grub.users | User accounts for GRUB
|
| services.openntpd.extraConfig | Additional text appended to openntpd.conf.
|
| services.nezha-agent.clientSecretFile | Path to the file contained the client_secret of the dashboard.
|
| services.sympa.settingsFile.<name>.text | Text of the file.
|
| services.coturn.realm | The default realm to be used for the users when no explicit
origin/realm relationship was found in the database, or if the TURN
server is not using any database (just the commands-line settings
and the userdb file)
|
| services.taler.includes | Files to include into the config file using Taler's @inline@ directive
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.asusd.fanCurvesConfig.source | Path of the source file.
|
| services.asusd.userLedModesConfig.source | Path of the source file.
|
| boot.initrd.network.openvpn.configuration | The configuration file for OpenVPN.
Unless your bootloader supports initrd secrets, this configuration
is stored insecurely in the global Nix store.
|
| services.prometheus.exporters.snmp.enableConfigCheck | Whether to run a correctness check for the configuration file
|
| services.redsocks.chroot | Chroot under which to run redsocks
|
| services.gnunet.extraOptions | Additional options that will be copied verbatim in gnunet.conf
|
| services.syncplay.roomsDBFile | Path to SQLite database file to store room states
|
| services.prometheus.exporters.nextcloud.tokenFile | File containing the token for connecting to Nextcloud
|
| fonts.fontDir.decompressFonts | Whether to decompress fonts in
/run/current-system/sw/share/X11/fonts.
|
| services.prometheus.remoteWrite.*.bearer_token_file | Sets the Authorization header on every remote write request with the bearer token
read from the configured file
|
| services.fedimintd.<name>.nginx.config.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| security.pam.services.<name>.otpwAuth | If set, the OTPW system will be used (if
~/.otpw exists).
|
| services.athens.storage.s3.token | Token for the S3 storage backend
|
| services.printing.cups-pdf.instances.<name>.installPrinter | Whether to enable a CUPS printer queue for this instance
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.orthanc.settings | Configuration written to a json file that is read by orthanc
|
| services.zeronet.settings | zeronet.conf configuration
|
| virtualisation.containers.policy | Signature verification policy file
|
| services.archisteamfarm.ipcPasswordFile | Path to a file containing the password
|
| services.public-inbox.settings | Settings for the public-inbox config file.
|
| system.nssDatabases.group | List of group entries to configure in /etc/nsswitch.conf
|
| system.nssDatabases.hosts | List of hosts entries to configure in /etc/nsswitch.conf
|
| services._3proxy.extraConfig | Extra configuration, appended to the 3proxy configuration file
|
| services.cassandra.jmxRolesFile | Specify your own jmx roles file.
|
| services.kubernetes.kubelet.kubeconfig.certFile | Kubelet client certificate file used to connect to kube-apiserver.
|
| security.loginDefs.settings.UMASK | The file mode creation mask is initialized to this value.
|
| services.gitea.database.socket | Path to the unix socket file to use for authentication.
|
| services.autorandr.profiles.<name>.hooks.postswitch | Postswitch hook executed after mode switch.
|
| services.longview.apiKeyFile | A file containing the Longview API key
|
| services.ttyd.passwordFile | File containing the password to use for basic http authentication
|
| security.wrappers | This option effectively allows adding setuid/setgid bits, capabilities,
changing file ownership and permissions of a program without directly
modifying it
|
| services.forgejo.database.path | Path to the sqlite3 database file.
|
| services.vikunja.database.path | Path to the sqlite3 database file.
|
| system.nssDatabases.shadow | List of shadow entries to configure in /etc/nsswitch.conf
|
| services.qbittorrent.serverConfig | Free-form settings mapped to the qBittorrent.conf file in the profile
|
| environment.etc.<name>.source | Path of the source file.
|
| services.libinput.touchpad.accelProfile | Sets the pointer acceleration profile to the given profile
|
| services.terraria.worldPath | The path to the world file (.wld) which should be loaded
|
| services.phpfpm.pools.<name>.socket | Path to the unix socket file on which to accept FastCGI requests.
This option is read-only and managed by NixOS.
|
| services.mysql.initialScript | A file containing SQL statements to be executed on the first startup
|
| services.angrr.settings.profile-policies.<name>.keep-booted-system | Whether to keep the last booted system generation
|
| security.pam.services.<name>.unixAuth | Whether users can log in with passwords defined in
/etc/shadow.
|
| services.nezha-agent.settings | Generate to config.json as a Nix attribute set
|
| services.privoxy.userActions | Actions to be included in a user.action file
|
| meta.maintainers | List of maintainers of each module
|
| image.repart.mkfsOptions | Specify extra options for created file systems
|
| services.gns3-server.settings | The global options in config file in ini format
|
| services.diod.statfsPassthru | This option configures statfs to return the host file system's type
rather than V9FS_MAGIC.
|
| services.listmonk.secretFile | A file containing secrets as environment variables
|
| services.gnome.gnome-user-share.enable | Whether to enable GNOME User Share, a user-level file sharing service for GNOME.
|
| services.goeland.settings | Configuration of goeland
|
| services.cassandra.extraEnvSh | Extra shell lines to be appended onto cassandra-env.sh.
|
| services.pdns-recursor.luaConfig | The content Lua configuration file for PowerDNS Recursor
|
| services.athens.storage.gcp.jsonKey | Base64 encoded GCP service account key
|
| services.davis.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.movim.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.slskd.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.siproxd.passwordFile | Path to per-user password file.
|
| services.asusd.auraConfigs.<name>.source | Path of the source file.
|
| programs.neovim.runtime.<name>.source | Path of the source file.
|
| services.opengfw.settingsFile | Path to file containing OpenGFW settings.
|
| services.forgejo.customDir | Base directory for custom templates and other options
|
| services.ncdns.settings | ncdns settings
|
| services.prometheus.alertmanager.configText | Alertmanager configuration as YAML text
|
| services.sks.extraDbConfig | Set contents of the files "KDB/DB_CONFIG" and "PTree/DB_CONFIG" within
the ${dataDir} directory
|
| services.activemq.configurationDir | The base directory for ActiveMQ's configuration
|
| services.openafsServer.roles.fileserver.volserverArgs | Arguments to the davolserver process
|
| services.linkwarden.environmentFile | Path of a file with extra environment variables to be loaded from disk
|
| services.prosody.extraConfig | Additional prosody configuration
The generated file is processed by envsubst to allow secrets to be passed securely via environment variables.
|
| users.ldap.bind.policy | Specifies the policy to use for reconnecting to an unavailable
LDAP server
|
| services.athens.storage.mongo.certPath | Path to the certificate file for the mongo database.
|
| services.privoxy.userFilters | Filters to be included in a user.filter file
|
| services.pixelfed.secretFile | A secret file to be sourced for the .env settings
|
| services.bacula-dir.port | Specify the port (a positive integer) on which the Director daemon
will listen for Bacula Console connections
|
| services.postfix.virtualMapType | What type of virtual alias map file to use
|
| services.xonotic.settings | Generates the server.cfg file
|
| services.drupal.sites.<name>.phpOptions | Options for PHP's php.ini file for this Drupal site.
|
| services.munin-node.extraPluginConfig | plugin-conf.d extra plugin configuration
|
| services.lubelogger.environmentFile | Path to a file containing extra LubeLogger config options in the systemd EnvironmentFile format
|
| services.mycelium.keyFile | Optional path to a file containing the mycelium key material
|
| services.wakapi.passwordSaltFile | The path to a file containing the password salt to use for Wakapi.
|
| services.jigasi.userPasswordFile | Path to file containing password for XMPP user connection.
|
| services.jicofo.userPasswordFile | Path to file containing password for XMPP user connection.
|
| services.mediatomb.mediaDirectories.*.hidden-files | Whether to index the hidden files or not.
|
| services.snipe-it.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.monica.mail.passwordFile | A file containing the password corresponding to
|
| services.pihole-ftl.macvendorURL | URL from which to download the macvendor.db file.
|
| services.rmfakecloud.environmentFile | Path to an environment file loaded for the rmfakecloud service
|
| services.atd.allowEveryone | Whether to make /var/spool/at{jobs,spool}
writeable by everyone (and sticky)
|
| services.dovecot2.extraConfig | Additional entries to put verbatim into Dovecot's config file.
|
| services.actkbd.bindings | Key bindings for actkbd
|
| nix.buildMachines.*.sshKey | The path to the SSH private key with which to authenticate on
the build machine
|
| services.ncdns.dnssec.keys.zonePrivate | Path to the file containing the ZSK private key.
|
| services.duckdns.domainsFile | The path to a file containing a
newline-separated list of DuckDNS
domain(s) to be updated
(without the .duckdns.org suffix)
|
| services.mopidy.extraConfigFiles | Extra config file read by Mopidy when the service starts
|
| services.outline.redisUrl | Connection to a redis server
|
| services.rspamd.locals.<name>.enable | Whether this file locals should be generated
|
| services.sourcehut.hg.group | Group for hg.sr.ht
|
| services.akkoma.config.":joken".":default_signer" | JWT signing secret
|
| programs.nncp.settings | NNCP configuration, see
http://www.nncpgo.org/Configuration.html
|
| services.osquery.settings | Configuration to be written to the osqueryd JSON configuration file
|
| services.ente.api.settings | Museum yaml configuration
|
| services.beesd.filesystems.<name>.hashTableSizeMB | Hash table size in MB; must be a multiple of 16
|
| services.displayManager.logToFile | Whether the display manager redirects the output of the
session script to ~/.xsession-errors.
|
| services.prometheus.scrapeConfigs.*.bearer_token_file | Sets the Authorization header on every scrape request with
the bearer token read from the configured file
|
| services.journald.rateLimitBurst | Configures the rate limiting burst limit (number of messages per
interval) that is applied to all messages generated on the system
|
| services.davis.adminPasswordFile | The full path to a file that contains the admin's password
|
| services.rspamd.overrides | Overridden configuration files, written into /etc/rspamd/override.d/{name}.
|
| services.rsyslogd.extraConfig | Additional text appended to syslog.conf,
i.e. the contents of defaultConfig.
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.wakapi.smtpPasswordFile | The path to a file containing the password for the smtp mailer used by Wakapi.
|
| services.bluemap.coreSettings | Settings for the core.conf file, see upstream docs.
|
| services.paisa.settings | Paisa configuration
|
| hardware.tuxedo-drivers.settings.charging-profile | The maximum charge level to help reduce battery wear:
high_capacity charges to 100% (driver default)
balanced charges to 90%
stationary charges to 80% (maximum lifespan)
Note: Regardless of the configured charging profile, the operating system will always report the battery as being charged to 100%.
|
| services.angrr.settings.profile-policies.<name>.keep-current-system | Whether to keep the current system generation
|
| services.froide-govplan.secretKeyFile | Path to a file containing the secret key.
|
| services.gitea.mailerPasswordFile | Path to a file containing the SMTP password.
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.apache-kafka.settings."log.dirs" | Log file directories.
|
| security.auditd.plugins.<name>.args | This allows you to pass arguments to the child program
|
| services.mediawiki.skins | Attribute set of paths whose content is copied to the skins
subdirectory of the MediaWiki installation in addition to the default skins.
|
| services.grafana.settings.security.secret_key | Secret key used for signing
|
| services.cloudflared.tunnels.<name>.credentialsFile | Credential file
|
| services.system76-scheduler.settings.cfsProfiles.enable | Tweak CFS latency parameters when going on/off battery
|
| services.sourcehut.man.group | Group for man.sr.ht
|
| services.sourcehut.git.group | Group for git.sr.ht
|
| services.sourcehut.hub.group | Group for hub.sr.ht
|
| services.forgejo.settings | Free-form settings written directly to the app.ini configfile file
|
| programs.schroot.profiles.<name>.nssdatabases | System databases (as described in /etc/nsswitch.conf on GNU/Linux systems) to copy into the chroot from the host.
|
| services.lldap.settings.ldap_user_pass_file | Path to a file containing the default admin password
|
| services.slurm.server.enable | Whether to enable the slurm control daemon
|
| programs.rust-motd.enableMotdInSSHD | Whether to let openssh print the
result when entering a new ssh-session
|
| services.sing-box.settings | The sing-box configuration, see https://sing-box.sagernet.org/configuration/ for documentation
|
| services.activemq.configurationURI | The URI that is passed along to the BrokerFactory to
set up the configuration of the ActiveMQ broker service
|
| boot.kernelModules | The set of kernel modules to be loaded in the second stage of
the boot process
|
| services.diod.squashuser | Change the squash user
|
| services.transmission.credentialsFile | Path to a JSON file to be merged with the settings
|
| services.traccar.settingsFile | File used as configuration for traccar
|
| users.extraUsers.<name>.isNormalUser | Indicates whether this is an account for a “real” user
|
| services.nfs.server.createMountPoints | Whether to create the mount points in the exports file at startup time.
|
| services.mongodb.initialScript | A file containing MongoDB statements to execute on first startup.
|
| services.xserver.moduleSection | Contents of the Module section of the X server configuration file.
|
| services.gerrit.builtinPlugins | List of builtins plugins to install
|
| services.ergochat.settings | Ergo IRC daemon configuration file.
https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml
|
| services.oauth2-proxy.clientSecretFile | The path to a file containing the OAuth Client Secret.
|
| services.saunafs.master.exports | Paths to exports file (see sfsexports.cfg(5)).
|
| services.wiki-js.settings.offline | Disable latest file updates and enable
sideloading.
|
| system.nssDatabases.passwd | List of passwd entries to configure in /etc/nsswitch.conf
|
| services.rethinkdb.pidpath | Location where each instance's pid file is located.
|
| services.wiki-js.stateDirectoryName | Name of the directory in /var/lib.
|
| services.moodle.database.socket | Path to the unix socket file to use for authentication.
|
| services.toxBootstrapd.keysFile | Node key file.
|
| services.nextcloud.settings."profile.enabled" | Makes user-profiles globally available under nextcloud.tld/u/user.name
|
| services.neo4j.ssl.policies.<name>.publicCertificate | The name of public X.509 certificate (chain) file in PEM format
for this policy to be found in the baseDirectory,
or the absolute path to the certificate file
|
| services.livekit.settings | LiveKit configuration file expressed in nix
|
| services.athens.storage.s3.secret | Secret key for the S3 storage backend
|
| services.hebbot.botPasswordFile | A path to the password file for your bot
|
| services.postfix.extraAliases | Additional entries to put verbatim into aliases file, cf. man-page aliases(8).
|
| services.podgrab.passwordFile | The path to a file containing the PASSWORD environment variable
definition for Podgrab's authentication.
|
| security.pam.services.<name>.updateWtmp | Whether to update /var/log/wtmp.
|
| services.xserver.deviceSection | Contents of the first Device section of the X server configuration file.
|
| services.xserver.screenSection | Contents of the first Screen section of the X server configuration file.
|
| networking.dhcpcd.extraConfig | Literal string to append to the config file generated for dhcpcd.
|
| programs.starship.settings | Configuration included in starship.toml
|
| services.llama-cpp.modelsPreset | Models preset configuration as a Nix attribute set
|
| services.fluidd.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.akkoma.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.gancio.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.matomo.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.monica.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.oauth2-proxy.cookie.secretFile | The path to a file containing the seed string for secure cookies.
|
| services.bitlbee.extraSettings | Will be inserted in the Settings section of the config file.
|
| services.bitlbee.extraDefaults | Will be inserted in the Default section of the config file.
|
| services.postfix.extraHeaderChecks | Extra lines to /etc/postfix/header_checks file.
|
| services.oncall.settings | Extra configuration options to append or override
|
| boot.initrd.systemd.contents.<name>.source | Path of the source file.
|
| services.outline.smtp.passwordFile | File path containing the password to authenticate with.
|
| services.iodine.server.passwordFile | File that contains password
|
| services.ncps.cache.redis.passwordFile | File containing the redis password for authentication (for Redis ACL).
|
| environment.etc.<name>.target | Name of symlink (relative to
/etc)
|
| system.nssDatabases.sudoers | List of sudoers entries to configure in /etc/nsswitch.conf
|
| nix.buildMachines.*.publicHostKey | The (base64-encoded) public host key of this builder
|
| services.autorandr.profiles.<name>.fingerprint | Output name to EDID mapping
|
| services.bitcoind.<name>.extraConfig | Additional configurations to be appended to bitcoin.conf.
|
| services.lokinet.settings | Configuration for Lokinet
|
| services.tor.relay.onionServices.<name>.authorizeClient.clientNames | Only clients that are listed here are authorized to access the hidden service
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.sourcehut.todo.group | Group for todo.sr.ht
|
| services.sourcehut.meta.group | Group for meta.sr.ht
|
| services.cloudlog.extraConfig | Any additional text to be appended to the config.php
configuration file
|
| services.oauth2-proxy.upstream | The http url(s) of the upstream endpoint or file://
paths for static files
|
| services.munin-cron.extraGlobalConfig | munin.conf extra global configuration
|
| services.k3s.images | List of derivations that provide container images
|
| services.agorakit.appKeyFile | A file containing the Laravel APP_KEY - a 32 character long,
base64 encoded key used for encryption where needed
|
| services.matrix-synapse.workers.<name>.worker_log_config | The file for log configuration
|
| services.nipap.nipap-www.xmlrpcURIFile | Path to file containing XMLRPC URI for use by web UI - this is a secret, since it contains auth credentials
|
| services.libeufin.settings | Global configuration options for the libeufin bank system config file.
|
| services.nagios.validateConfig | if true, the syntax of the nagios configuration file is checked at build time
|
| hardware.deviceTree.overlays.*.dtboFile | Path to .dtbo compiled overlay file.
|
| services.k3s.manifests.<name>.source | Path of the source .yaml file.
|
| services.k3s.manifests.<name>.enable | Whether this manifest file should be generated.
|
| boot.specialFileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| services.metabase.ssl.keystore | Java KeyStore file containing the certificates.
|
| services.zabbixWeb.database.socket | Path to the unix socket file to use for authentication.
|
| security.loginDefs.settings | Config options for the /etc/login.defs file, that defines
the site-specific configuration for the shadow password suite
|
| services.davis.database.urlFile | A file containing the database connection url
|
| services.pipewire.wireplumber.extraScripts | Additional scripts for WirePlumber to be used by configuration files
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.prosody.virtualHosts.<name>.ssl.key | Path to the key file.
|
| services.kubernetes.scheduler.kubeconfig.caFile | Kubernetes scheduler certificate authority file used to connect to kube-apiserver.
|
| services.rspamd.overrides.<name>.text | Text of the file.
|
| services.komodo-periphery.ssl.keyFile | Path to SSL key file.
|
| services.openssh.settings.AuthorizedPrincipalsFile | Specifies a file that lists principal names that are accepted for certificate authentication
|
| containers.<name>.networkNamespace | Takes the path to a file representing a kernel network namespace that the container
shall run in
|
| services.filesender.settings.admin_email | Email address of FileSender administrator(s)
|
| security.agnos.settings.accounts.*.certificates.*.key_output_file | Output path for the certificate private key
|
| users.ldap.daemon.enable | Whether to let the nslcd daemon (nss-pam-ldapd) handle the
LDAP lookups for NSS and PAM
|
| services.cross-seed.settingsFile | Path to a JSON file containing settings that will be merged with the
settings option
|
| services.bacula-sd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.bacula-fd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.prometheus.scrapeConfigs.*.lightsail_sd_configs.*.profile | Named AWS profile used to connect to the API.
|
| nix.settings | Configuration for Nix, see
https://nixos.org/manual/nix/stable/command-ref/conf-file.html or
nix.conf(5) for available options
|
| services.mighttpd2.routing | Verbatim routing file to use
(see https://kazu-yamamoto.github.io/mighttpd2/config.html)
|
| services.kubernetes.scheduler.kubeconfig.keyFile | Kubernetes scheduler client key file used to connect to kube-apiserver.
|
| services.auto-cpufreq.settings | Configuration for auto-cpufreq
|
| services.mattermost.environmentFile | Environment file (see systemd.exec(5)
"EnvironmentFile=" section for the syntax) which sets config options
for mattermost (see the Mattermost documentation)
|
| security.acme.certs.<name>.webroot | Where the webroot of the HTTP vhost is located.
.well-known/acme-challenge/ directory
will be created below the webroot if it doesn't exist.
http://example.org/.well-known/acme-challenge/ must also
be available (notice unencrypted HTTP).
|
| boot.initrd.systemd.contents.<name>.enable | Whether to enable copying of this file and symlinking it.
|
| services.actual.settings | Server settings, refer to the documentation for available options
|
| services.radicale.rights | Configuration for Radicale's rights file
|
| services.sympa.settingsFile.<name>.source | Path of the source file.
|
| systemd.shutdownRamfs.storePaths.*.source | Path of the source file.
|
| services.borgmatic.configurations.<name>.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| services.prometheus.exporters.nextcloud.passwordFile | File containing the password for connecting to Nextcloud
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.basic_auth.password_file | HTTP password file
|
| services.outline.storage.uploadMaxSize | Maxmium file size for uploads.
|
| services.ncps.cache.storage.s3.accessKeyIdPath | The path to a file containing only the access-key-id.
|
| services.akkoma.initDb.password | Password of the database user to initialise the database with
|
| environment.etc.<name>.enable | Whether this /etc file should be generated
|
| programs.spacefm.settings | The system-wide spacefm configuration
|
| services.transfer-sh.secretFile | Path to file containing environment variables
|
| users.users.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.nginx.appendConfig | Configuration lines appended to the generated Nginx
configuration file
|
| services.prometheus.exporters.mqtt.environmentFile | File to load as environment file
|
| services.cntlm.proxy | A list of NTLM/NTLMv2 authenticating HTTP proxies
|
| services.pinnwand.settings | Your pinnwand.toml as a Nix attribute set
|
| services.postsrsd.settings | Configuration options for the postsrsd.conf file
|
| services.kubernetes.scheduler.kubeconfig.certFile | Kubernetes scheduler client certificate file used to connect to kube-apiserver.
|
| boot.loader.systemd-boot.edk2-uefi-shell.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.stubby.settings | Content of the Stubby configuration file
|
| services.cachix-watch-store.cachixTokenFile | Required file that needs to contain the cachix auth token.
|
| services.octoprint.extraConfig | Extra options which are added to OctoPrint's YAML configuration file.
|
| services.moodle.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.nagios.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| networking.ucarp.passwordFile | File containing shared password between CARP hosts.
|
| services.peering-manager.secretKeyFile | Path to a file containing the secret key.
|
| services.prosody.virtualHosts.<name>.ssl.cert | Path to the certificate file.
|
| services.paisa.settings.journalFile | Filename of the main journal / ledger file.
|
| services.komodo-periphery.ssl.certFile | Path to SSL certificate file.
|
| services.tahoe.nodes.<name>.client.shares.total | The number of shares required to store a file.
|
| services.wiki-js.settings | Settings to configure wiki-js
|
| services.frigate.settings | Frigate configuration as a nix attribute set
|
| services.prometheus.exporters.blackbox.enableConfigCheck | Whether to run a correctness check for the configuration file
|
| services.archisteamfarm.bots.<name>.passwordFile | Path to a file containing the password
|
| services.sourcehut.paste.group | Group for paste.sr.ht
|
| services.sourcehut.lists.group | Group for lists.sr.ht
|
| services.sourcehut.pages.group | Group for pages.sr.ht
|
| hardware.deviceTree.overlays.*.dtsText | Literal DTS contents, overlay is applied to
each .dtb file matching "compatible" of the overlay.
|
| services.munin-cron.enable | Enable munin-cron
|
| virtualisation.credentials.<name>.text | Text content of the credential
|
| services.webdav-server-rs.settings | Attrset that is converted and passed as config file
|
| services.amule.WebServerPasswordFile | File containing the password for connecting to the web server,
set this only if you didn't set `settings
|
| services.cassandra.extraConfig | Extra options to be merged into cassandra.yaml as nix attribute set.
|
| services.vault.storageConfig | HCL configuration to insert in the storageBackend section
|
| services.radicle.ci.broker.settings.db | Database file path.
|
| systemd.shutdownRamfs.storePaths.*.enable | Whether to enable copying of this file and symlinking it.
|
| services.forgejo.database.socket | Path to the unix socket file to use for authentication.
|
| services.saunafs.master.settings | Contents of config file (sfsmaster.cfg(5)).
|
| services.outline.storage.secretKeyFile | File path that contains the S3 secret key.
|
| services.redmine.database.socket | Path to the unix socket file to use for authentication.
|
| boot.initrd.network.ifstate.settings | Content of IfState's initrd configuration file
|
| services.hans.clients.<name>.passwordFile | File that contains password
|
| boot.initrd.clevis.devices.<name>.secretFile | Clevis JWE file used to decrypt the device at boot, in concert with the chosen pin (one of TPM2, Tang server, or SSS).
|
| services.lighttpd.extraConfig | These configuration lines will be appended to the generated lighttpd
config file
|
| services.openafsClient.mountPoint | Mountpoint of the AFS file tree, conventionally
/afs
|
| services.redis.servers.<name>.appendOnly | By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.
|
| services.pomerium.secretsFile | Path to file containing secrets for Pomerium, in systemd
EnvironmentFile format
|
| services.rke2.manifests.<name>.source | Path of the source .yaml file.
|
| services.rke2.manifests.<name>.enable | Whether this manifest file should be generated.
|
| security.pam.services.<name>.yubicoAuth | If set, users listed in
~/.yubico/authorized_yubikeys
are able to log in with the associated Yubikey tokens.
|
| services.sunshine.settings | Settings to be rendered into the configuration file
|
| services.searx.limiterSettings | Limiter settings for SearXNG.
|
| services.athens.storage.minio.secret | Secret key for the minio storage backend
|
| services.davis.appSecretFile | A file containing the Symfony APP_SECRET - Its value should be a series
of characters, numbers and symbols chosen randomly and the recommended
length is around 32 characters
|
| services.magnetico.web.credentialsFile | The path to the file holding the credentials to access the web
interface
|
| services.prometheus.scrapeConfigs.*.file_sd_configs.*.refresh_interval | Refresh interval to re-read the files
|
| services.misskey.redis.passwordFile | The path to a file containing the Redis password
|
| services.xserver.monitorSection | Contents of the first Monitor section of the X server configuration file.
|
| services.athens.index.mysql.password | Password for the MySQL database
|
| services.tahoe.nodes.<name>.client.shares.happy | The number of distinct storage nodes required to store
a file.
|
| services.bluemap.webappSettings | Settings for the webapp.conf file, see upstream docs.
|
| services.aria2.settings.save-session | Save error/unfinished downloads to FILE on exit.
|
| services.prometheus.pushgateway.persistMetrics | Whether to persist metrics to a file
|
| services.hebbot.templates.report | A path to the Markdown file for the report template.
|
| services.moodle.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.nagios.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.redis.servers.<name>.requirePassFile | File with password for the database.
|
| services.fider.database.url | URI to use for the main PostgreSQL database
|
| services.freshrss.database.passFile | Database password file for FreshRSS.
|
| users.extraUsers.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| hardware.amdgpu.amdvlk.settings | Runtime settings for AMDVLK to be configured /etc/amd/amdVulkanSettings.cfg
|
| i18n.inputMethod.fcitx5.settings.addons | The addon configures in conf folder in ini format with global sections
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.klipper.mutableConfig | Whether to manage the config outside of NixOS
|
| containers.<name>.tmpfs | Mounts a set of tmpfs file systems into the container
|
| services.buildbot-master.masterCfg | Optionally pass master.cfg path
|
| services.nginx.prependConfig | Configuration lines prepended to the generated Nginx
configuration file
|
| services.peering-manager.enableOidc | Enable OIDC-Authentication for Peering Manager
|
| services.peering-manager.enableLdap | Enable LDAP-Authentication for Peering Manager
|
| services.syncplay.passwordFile | Path to the file that contains the server password
|
| services.zabbixProxy.database.socket | Path to the unix socket file to use for authentication.
|
| services.xserver.serverFlagsSection | Contents of the ServerFlags section of the X server configuration file.
|
| services.bookstack.appKeyFile | A file containing the Laravel APP_KEY - a 32 character long,
base64 encoded key used for encryption where needed
|
| services.dawarich.smtp.passwordFile | Path to file containing the SMTP password.
|
| services.mastodon.smtp.passwordFile | Path to file containing the SMTP password.
|
| services.swapspace.settings | Config file for swapspace
|
| services.nextcloud.settings | Extra options which should be appended to Nextcloud's config.php file.
|
| services.gitlab.smtp.passwordFile | File containing the password of the SMTP server for GitLab
|
| xdg.terminal-exec.settings | Configuration options for the Default Terminal Execution Specification
|
| systemd.shutdownRamfs.contents.<name>.text | Text of the file.
|
| services.ncdns.dnssec.keys.public | Path to the file containing the KSK public key
|
| services.ddclient.extraConfig | Extra configuration
|
| services.rss2email.feeds.<name>.to | Email address to which to send feed items
|
| services.pleroma.secretConfigFile | Path to the file containing your secret pleroma configuration.
DO NOT POINT THIS OPTION TO THE NIX
STORE, the store being world-readable, it'll
compromise all your secrets.
|
| system.nssDatabases.services | List of services entries to configure in /etc/nsswitch.conf
|
| services.draupnir.settings | Free-form settings written to Draupnir's configuration file
|
| services.duplicity.include | List of paths to include into the backups
|
| services.duplicity.exclude | List of paths to exclude from backups
|
| services.nextcloud.secrets | Secret files to read into entries in config.php
|
| services.prosody.modules.proxy65 | Enables a file transfer proxy service which clients behind NAT can use
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".signing_salt | Signing salt
|
| services.cachix-watch-store.signingKeyFile | Optional file containing a self-managed signing key to sign uploaded store paths.
|
| services.mediawiki.extraConfig | Any additional text to be appended to MediaWiki's
LocalSettings.php configuration file
|
| services.ddclient.passwordFile | A file containing the password or a TSIG key in named format when using the nsupdate protocol.
|
| services.sympa.settingsFile.<name>.enable | Whether this file should be generated
|
| services.matrix-tuwunel.settings | Generates the tuwunel.toml configuration file
|
| services.outline.storage.storageType | File storage type, it can be local or s3.
|
| services.firewalld.settings | FirewallD config file
|
| services.privoxy.settings | This option is mapped to the main Privoxy configuration file
|
| services.buildbot-worker.workerPassFile | File used to store the Buildbot Worker password
|
| services.tahoe.nodes.<name>.client.shares.needed | The number of shares required to reconstitute a file.
|
| services.postfix.settings.main | The main.cf configuration file as key value set
|
| services.system76-scheduler.settings.cfsProfiles.default.latency | sched_latency_ns.
|
| services.tailscale.authKeyFile | A file containing the auth key
|
| services.lavalink.extraConfig | Configuration to write to application.yml
|
| services.nsd.remoteControl.serverKeyFile | Path to the server private key, which is used by the server
but not by nsd-control
|
| services.thanos.rule.query.sd-interval | Refresh interval to re-read file SD files. (used as a fallback)
Defaults to 5m in Thanos
when set to null.
|
| services.system76-scheduler.settings.cfsProfiles.default.preempt | Preemption mode.
|
| services.sourcehut.builds.group | Group for builds.sr.ht
|
| programs.rust-motd.refreshInterval | Interval in which the motd(5) file is refreshed
|
| services.system76-scheduler.settings.cfsProfiles.default.nr-latency | sched_nr_latency.
|
| services.sks.webroot | Source directory (will be symlinked, if not null) for the files the
built-in webserver should serve
|
| services.kimai.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| i18n.inputMethod.fcitx5.settings.inputMethod | The input method configure in profile file in ini format.
|
| services.agorakit.mail.passwordFile | A file containing the password corresponding to
|
| services.dokuwiki.sites.<name>.phpOptions | Options for PHP's php.ini file for this dokuwiki site.
|
| services.httpd.virtualHosts.<name>.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.radicle.privateKeyFile | Absolute file path to an SSH private key,
usually generated by rad auth
|
| services.hadoop.log4jProperties | log4j.properties file added to HADOOP_CONF_DIR
|
| services.prometheus.exporters.pve.environmentFile | Path to the service's environment file
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| users.users.<name>.description | A short description of the user account, typically the
user's full name
|
| services.ncdns.dnssec.keys.zonePublic | Path to the file containing the ZSK public key
|
| services.syncoid.commands.<name>.sshKey | SSH private key file to use to login to the remote system
|
| services.mailman.ldap.bindPasswordFile | Path to the file containing the bind password of the service account
defined by services.mailman.ldap.bindDn.
|
| security.ipa.certificate | IPA server CA certificate
|
| services.rspamd.workers.<name>.extraConfig | Additional entries to put verbatim into worker section of rspamd config file.
|
| services.gotify.stateDirectoryName | The name of the directory below /var/lib where
gotify stores its runtime data.
|
| services.watchdogd.settings | Configuration to put in watchdogd.conf
|
| services.canaille.smtpPasswordFile | File containing the SMTP password
|
| security.apparmor.policies.<name>.path | A path of a profile file to include
|
| services.xserver.inputClassSections | Content of additional InputClass sections of the X server configuration file.
|
| services.invidious.hmacKeyFile | A path to a file containing the hmac_key
|
| boot.loader.limine.validateChecksums | Whether to validate file checksums before booting.
|
| services.sympa.database.passwordFile | A file containing the password for services.sympa.database.name.
|
| services.mastodon.redis.passwordFile | A file containing the password for Redis database.
|
| networking.ifstate.settings | Content of IfState's configuration file
|
| services.infinoted.passwordFile | File to read server-wide password from
|
| services.rspamd.overrides.<name>.source | Path of the source file.
|
| services.netbox.keycloakClientSecret | File that contains the keycloak client secret.
|
| services.aerospike.networkConfig | network section of configuration file
|
| services.nextcloud.secretFile | Secret options which will be appended to Nextcloud's config.php file (written as JSON, in the same
form as the services.nextcloud.settings option), for example
{"redis":{"password":"secret"}}.
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.k3s.manifests.<name>.target | Name of the symlink (relative to /var/lib/rancher/k3s/server/manifests)
|
| boot.loader.systemd-boot.windows.<name>.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.gitDaemon.exportAll | Publish all directories that look like Git repositories (have the objects
and refs subdirectories), even if they do not have the git-daemon-export-ok file
|
| services.mchprs.whitelist.enable | Whether or not the whitelist (in whitelist.json) shoud be enabled
|
| users.users.<name>.linger | Whether to enable or disable lingering for this user
|
| services.gotenberg.enableBasicAuth | HTTP Basic Authentication
|
| services.dnscrypt-proxy.settings | Attrset that is converted and passed as TOML config file
|
| services.crowdsec.settings.console.configuration | Attributes inside the console.yaml file.
|
| services.teeworlds.extraOptions | Extra configuration lines for the teeworlds.cfg
|
| services.gitea.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.zabbixServer.database.socket | Path to the unix socket file to use for authentication.
|
| systemd.mounts.*.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.hebbot.templates.project | A path to the Markdown file for the project template.
|
| services.hebbot.templates.section | A path to the Markdown file for the section template.
|
| services.misskey.settings.chmodSocket | The file access mode of the UNIX socket.
|
| services.xserver.logFile | Controls the file Xorg logs to
|
| services.httpd.virtualHosts.<name>.sslServerChain | Path to server SSL chain file.
|
| services.slurm.extraPlugstackConfig | Extra configuration that will be added to the end of plugstack.conf.
|
| services.xserver.serverLayoutSection | Contents of the ServerLayout section of the X server configuration file.
|
| services.kmonad.keyboards.<name>.device | Path to the keyboard's device file.
|
| services.keepalived.extraConfig | Extra lines to be added verbatim to the configuration file.
|
| services.lanraragi.passwordFile | A file containing the password for LANraragi's admin interface.
|
| services.postgresql.checkConfig | Check the syntax of the configuration file at compile time
|
| services.longview.mysqlPasswordFile | A file containing the password corresponding to mysqlUser.
|
| services.wiki-js.environmentFile | Environment file to inject e.g. secrets into the configuration.
|
| services.zoneminder.extraConfig | Additional configuration added verbatim to the configuration file.
|
| services.canaille.ldapBindPasswordFile | File containing the LDAP bind password.
|
| services.cloudlog.update-dok.enable | Whether to periodically update the DOK resource file
|
| services.coturn.listening-ips | Listener IP addresses of relay server
|
| security.tpm2.fapi.ekCertLess | A switch to disable Endorsement Key (EK) certificate verification
|
| services.journald.remote.settings.Remote.ServerCertificateFile | A path to a SSL certificate file in PEM format
|
| services.duplicity.secretFile | Path of a file containing secrets (gpg passphrase, access key...) in
the format of EnvironmentFile as described by
systemd.exec(5)
|
| services.reaction.settings | Configuration for reaction
|
| services.nsd.remoteControl.serverCertFile | Path to the server self signed certificate, which is used by the server
but and by nsd-control
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.tls_config.ca_file | CA certificate to validate API server certificate with.
|
| services.oncall.secretFile | A YAML file containing secrets such as database or user passwords
|
| services.cross-seed.settings.dataDirs | Paths to be searched for matching data
|
| services.postfix-tlspol.settings | The postfix-tlspol configuration file as a Nix attribute set
|
| security.acme.defaults.webroot | Where the webroot of the HTTP vhost is located.
.well-known/acme-challenge/ directory
will be created below the webroot if it doesn't exist.
http://example.org/.well-known/acme-challenge/ must also
be available (notice unencrypted HTTP).
|
| services.mx-puppet-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.searx.faviconsSettings | Favicons settings for SearXNG.
|
| services.deepin.deepin-anything.enable | Whether to enable deepin anything file search tool.
|
| security.pam.services.<name>.logFailures | Whether to log authentication failures in /var/log/faillog.
|
| services.kanboard.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.librenms.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.dolibarr.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.agorakit.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.fediwall.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.mainsail.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.pixelfed.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.snipe-it.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.rke2.images | List of derivations that provide container images
|
| services.portunus.ldap.tls | Whether to enable LDAPS protocol
|
| services.gns3-server.auth.passwordFile | A file containing the password to access the GNS3 Server.
This should be a string, not a nix path, since nix paths
are copied into the world-readable nix store.
|
| security.pam.services.<name>.sshAgentAuth | If set, the calling user's SSH agent is used to authenticate
against the keys in the calling user's
~/.ssh/authorized_keys
|
| services.suwayomi-server.settings | Configuration to write to server.conf
|
| services.mediawiki.passwordFile | A file containing the initial password for the administrator account "admin".
|
| services.guacamole-server.logbackXml | Configuration file that correspond to logback.xml.
|
| services.guacamole-client.logbackXml | Configuration file that correspond to logback.xml.
|
| services.thanos.query.store.sd-interval | Refresh interval to re-read file SD files
|
| users.ldap.daemon.rootpwmodpwFile | The path to a file containing the credentials with which to bind to
the LDAP server if the root user tries to change a user's password.
|
| services.tandoor-recipes.extraConfig | Extra tandoor recipes config options
|
| services.slurm.dbdserver.extraConfig | Extra configuration for slurmdbd.conf See also:
slurmdbd.conf(8).
|
| services.borgbackup.jobs.<name>.preHook | Shell commands to run before the backup
|
| services.headscale.settings | Overrides to config.yaml as a Nix attribute set
|
| services.caddy.enableReload | Reload Caddy instead of restarting it when configuration file changes
|
| services.drupal.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| services.radicle.httpd.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.jenkins.jobBuilder.accessTokenFile | File containing the API token for the accessUser
user.
|
| services.openssh.settings.StrictModes | Whether sshd should check file modes and ownership of directories
|
| services.journald.gateway.trust | Specify the path to a file or AF_UNIX stream socket to read a CA
certificate from
|
| services.prosody.uploadHttp.uploadFileSizeLimit | Maximum file size, in bytes
|
| services.ncps.cache.storage.s3.secretAccessKeyPath | The path to a file containing only the secret-access-key.
|
| services.fail2ban.daemonSettings | The contents of Fail2ban's main configuration file
|
| services.zabbixWeb.httpd.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.iodine.clients.<name>.passwordFile | Path to a file containing the password.
|
| services.restic.backups.<name>.passwordFile | Read the repository password from a file.
|
| services.quickwit.settings.version | Configuration file version.
|
| services.fusionInventory.extraConfig | Configuration that is injected verbatim into the configuration file.
|
| services.thinkfan.fans.*.query | The query string used to match one or more fans: can be
a fullpath to the temperature file (single fan) or a fullpath
to a driver directory (multiple fans).
When multiple fans match, the query can be restricted using the
name or indices options.
|
| services.weblate.djangoSecretKeyFile | Location of the Django secret key
|
| services.transmission.settings.script-torrent-done-filename | Executable to be run at torrent completion.
|
| services.reposilite.settings | Configuration written to the reposilite.cdn file
|
| services.windmill.database.urlPath | Path to the file containing the database url windmill should connect to
|
| services.icingaweb2.roles | roles.ini contents
|
| services.tuned.settings.sections | attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.nsd.remoteControl.controlKeyFile | Path to the client private key, which is used by nsd-control
but not by the server
|
| services.hqplayerd.licenseFile | Path to the HQPlayer license key file
|
| services.prometheus.exporters.unpoller.controllers.*.pass | Path of a file containing the password for the unifi service user
|
| services.pgbouncer.settings.pgbouncer.max_client_conn | Maximum number of client connections allowed
|
| services.peering-manager.oidcConfigPath | Path to the Configuration-File for OIDC-Authentication, will be loaded as oidc_config.py
|
| services.openiscsi.extraConfigFile | Append an additional file's contents to /etc/iscsid.conf
|
| services.peering-manager.ldapConfigPath | Path to the Configuration-File for LDAP-Authentication, will be loaded as ldap_config.py
|
| security.agnos.generateKeys.enable | Enable automatic generation of account keys
|
| security.pam.services.<name>.setLoginUid | Set the login uid of the process
(/proc/self/loginuid) for auditing
purposes
|
| security.auditd.plugins.<name>.settings | Plugin-specific config file to link to /etc/audit/.conf
|
| services.transmission.settings.trash-original-torrent-files | Whether to delete torrents added from the
services.transmission.settings.watch-dir.
|
| services.caddy.adapter | Name of the config adapter to use
|
| services.prometheus.webConfigFile | Specifies which file should be used as web.config.file and be passed on startup
|
| services.pulseaudio.extraConfig | Literal string to append to configFile
and the config file generated by the pulseaudio module.
|
| services.zammad.database.passwordFile | A file containing the password for services.zammad.database.user.
|
| systemd.user.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.foundationdb.tls.key | Private key file for the certificate.
|
| services.syncthing.guiPasswordFile | Path to file containing the plaintext password for Syncthing's GUI.
|
| services.webdav.settings | Attrset that is converted and passed as config file
|
| services.sshwifty.socks5PasswordFile | Path to a file containing the SOCKS5 password.
|
| services.nextcloud.datadir | Nextcloud's data storage path
|
| services.vaultwarden.environmentFile | Additional environment file or files as defined in systemd.exec(5)
|
| services.journald.gateway.cert | The path to a file or AF_UNIX stream socket to read the server
certificate from
|
| services.microbin.passwordFile | Path to file containing environment variables
|
| services.rke2.manifests.<name>.target | Name of the symlink (relative to /var/lib/rancher/rke2/server/manifests)
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.oauth2.client_secret_file | Read the client secret from a file
|
| services.apache-kafka.settings | Kafka broker configuration
server.properties
|
| services.yarr.environmentFile | Environment file for specifying additional settings such as secrets
|
| services.displayManager.dms-greeter.logs.save | Whether to enable saving logs from the DMS greeter to a file.
|
| services.bookstack.mail.passwordFile | A file containing the password corresponding to
mail.user.
|
| services.moodle.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.clickhouse.usersConfig | Your users.yaml as a Nix attribute set
|
| services.borgmatic.settings.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| services.libeufin.bank.settings | Configuration options for the libeufin bank system config file
|
| services.lldap.environmentFile | Environment file as defined in systemd.exec(5) passed to the service.
|
| services.zabbixWeb.httpd.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.pulseaudio.extraClientConf | Extra configuration appended to pulse/client.conf file.
|
| systemd.timers.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.slices.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.shutdownRamfs.contents.<name>.source | Path of the source file.
|
| services.cross-seed.settings.torrentDir | Directory containing torrent files, or if you're using a torrent
client integration and injection - your torrent client's .torrent
file store/cache.
|
| services.sympa.database.host | Database host address
|
| services.redis.servers.<name>.requirePass | Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
|
| services.tinc.networks.<name>.extraConfig | Extra lines to add to the tinc service configuration file
|
| services.cassandra.jmxRoles | Roles that are allowed to access the JMX (e.g. nodetool)
BEWARE: The passwords will be stored world readable in the nix store
|
| services.monado.forceDefaultRuntime | Whether to ensure that Monado is the active runtime set for the current
user
|
| services.jitsi-meet.interfaceConfig | Client-side web-app interface settings that override the defaults in interface_config.js
|
| services.nginx.proxyCachePath.<name>.useTempPath | Nginx first writes files that are destined for the cache to a temporary
storage area, and the use_temp_path=off directive instructs Nginx to
write them to the same directories where they will be cached
|
| services.netbird.clients.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.netbird.tunnels.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.k3s.environmentFile | File path containing environment variables for configuring the k3s service in the format of an EnvironmentFile
|
| services.outline.databaseUrl | URI to use for the main PostgreSQL database
|
| services.monica.database.passwordFile | A file containing the password corresponding to
|
| networking.wireless.extraConfig | Extra lines appended to the configuration file
|
| services.matrix-hookshot.settings | config.yml configuration as a Nix attribute set
|
| services.tuliprox.systemSettings | Main config file
Refer to the Tuliprox documentation for available attributes
|
| services.prosody.uploadHttp.uploadExpireAfter | Max age of a file before it gets deleted, in seconds.
|
| services.r53-ddns.environmentFile | File containing the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
in the format of an EnvironmentFile as described by systemd.exec(5)
|
| services.journald.gateway.key | Specify the path to a file or AF_UNIX stream socket to read the
secret server key corresponding to the certificate specified with
services.journald.gateway.cert from
|
| services.dokuwiki.sites.<name>.usersFile | Location of the dokuwiki users file
|
| services.smartdns.settings | A set that will be generated into configuration file, see the SmartDNS README for details of configuration parameters
|
| services.kubernetes.controllerManager.kubeconfig.caFile | Kubernetes controller manager certificate authority file used to connect to kube-apiserver.
|
| programs.tsmClient.wrappedPackage | The tsm-client package to use
|
| services.xrdp.defaultWindowManager | The script to run when user log in, usually a window manager, e.g. "icewm", "xfce4-session"
This is per-user overridable, if file ~/startwm.sh exists it will be used instead.
|
| services.nsd.remoteControl.controlCertFile | Path to the client certificate signed with the server certificate
|
| services.hylafax.faxcron.enable.spoolInit | Whether to enable purging old files from the spooling area with
faxcron
each time the spooling area is initialized
.
|
| services.photoprism.passwordFile | Admin password file.
|
| services.pipewire.extraConfig.jack | Additional configuration for the PipeWire JACK server and client library
|
| services.journald.remote.settings | Configuration in the journal-remote configuration file
|
| services.draupnir.secrets.accessToken | File containing the access token for Draupnir's Matrix account
to be used in place of services.draupnir.settings.accessToken.
|
| users.extraUsers.<name>.description | A short description of the user account, typically the
user's full name
|
| services.kubernetes.controllerManager.kubeconfig.keyFile | Kubernetes controller manager client key file used to connect to kube-apiserver.
|
| services.lldap.environment | Environment variables passed to the service
|
| services.mautrix-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.drupal.sites.<name>.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| containers.<name>.bindMounts.<name>.mountPoint | Mount point on the container file system.
|
| services.neo4j.constrainLoadCsv | Sets the root directory for file URLs used with the Cypher
LOAD CSV clause to be that defined by
directories.imports
|
| services.rspamd.overrides.<name>.enable | Whether this file overrides should be generated
|
| services.xinetd.services.*.unlisted | Whether this server is listed in
/etc/services
|
| i18n.inputMethod.fcitx5.settings.globalOptions | The global options in config file in ini format.
|
| services.dnscrypt-proxy2.settings | Attrset that is converted and passed as TOML config file
|
| services.anuko-time-tracker.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.flexget.systemScheduler | When true, execute the runs via the flexget-runner.timer
|
| services.webhook.enableTemplates | Enable the generated hooks file to be parsed as a Go template
|
| services.k3s.autoDeployCharts.<name>.values | Override default chart values via Nix expressions
|
| services.asterisk.confFiles | Sets the content of config files (typically ending with
.conf) in the Asterisk configuration directory
|
| services.zabbixWeb.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.prometheus.exporters.mail.configuration | Specify the mailexporter configuration file to use.
|
| services.thinkfan.settings | Thinkfan settings
|
| services.journald.remote.settings.Remote.TrustedCertificateFile | A path to a SSL CA certificate file in PEM format, or all
|
| services.libeufin.nexus.settings | Configuration options for the libeufin nexus config file
|
| services.taler.exchange.settings | Configuration options for the taler exchange config file
|
| services.taler.merchant.settings | Configuration options for the taler merchant config file
|
| services.keepalived.extraGlobalDefs | Extra lines to be added verbatim to the 'global_defs' block of the
configuration file
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.authorization.credentials_file | Sets the credentials to the credentials read from the configured file
|
| services.multipath.pathGroups.*.options | Options used to mount the file system
|
| systemd.shutdownRamfs.contents.<name>.enable | Whether to enable copying of this file and symlinking it.
|
| services.cloudflare-dyndns.apiTokenFile | The path to a file containing the CloudFlare API token.
|
| services.webdav.environmentFile | Environment file as defined in systemd.exec(5).
|
| services.guacamole-server.userMappingXml | Configuration file that correspond to user-mapping.xml.
|
| services.guacamole-client.userMappingXml | Configuration file that correspond to user-mapping.xml.
|
| services.system76-scheduler.settings.cfsProfiles.default.bandwidth-size | sched_cfs_bandwidth_slice_us.
|
| services.rsyncd.settings.sections | attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.tuned.settings.globalSection | global section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.quicktun.<name>.privateKeyFile | Path to file containing local secret key in binary or hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| services.anki-sync-server.users.*.passwordFile | File containing the password accepted by anki-sync-server for
the associated username
|
| services.maddy.tls.loader | TLS certificates are obtained by modules called "certificate
loaders"
|
| services.evcc.environmentFile | File with environment variables to pass into the runtime environment
|
| services.outline.storage | To support uploading of images for avatars and document attachments an
s3-compatible storage can be provided
|
| services.matrix-conduit.secretFile | Path to a file containing sensitive environment as described in {manpage}`systemd.exec(5)
|
| services.crowdsec.settings.general | Settings for the main CrowdSec configuration file
|
| services.oauth2-proxy.htpasswd.displayForm | Display username / password login form if an htpasswd file is provided.
|
| services.kubernetes.controllerManager.kubeconfig.certFile | Kubernetes controller manager client certificate file used to connect to kube-apiserver.
|
| services.gitlab.secrets.dbFile | A file containing the secret used to encrypt variables in
the DB
|
| services.gitlab.backup.uploadOptions | GitLab automatic upload specification
|
| services.kubernetes.kubelet.tlsKeyFile | File containing x509 private key matching tlsCertFile.
|
| services.lanraragi.redis.passwordFile | A file containing the password for LANraragi's Redis server.
|
| services.mediawiki.database.socket | Path to the unix socket file to use for authentication.
|
| services.gitlab.secrets.jwsFile | A file containing the secret used to encrypt session
keys
|
| services.kubernetes.kubelet.tlsCertFile | File containing x509 Certificate for HTTPS.
|
| systemd.user.slices.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.timers.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.garage.environmentFile | File containing environment variables to be passed to the Garage server.
|
| services.c2fmzq-server.passphraseFile | Path to file containing the database passphrase
|
| services.openvscode-server.socketPath | The path to a socket file for the server to listen to.
|
| services.code-server.disableFileDownloads | Disable file downloads from Code.
|
| users.extraUsers.<name>.linger | Whether to enable or disable lingering for this user
|
| services.openafsServer.roles.fileserver.salvageserverArgs | Arguments to the salvageserver process
|
| services.thelounge.public | Make your The Lounge instance public
|
| services.strongswan.secrets | A list of paths to IPSec secret files
|
| boot.loader.systemd-boot.memtest86.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.drupal.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.bookstack.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.ipfs-cluster.secretFile | File containing the cluster secret in the format of EnvironmentFile as described by
systemd.exec(5)
|
| services.clickhouse.serverConfig | Your config.yaml as a Nix attribute set
|
| services.autotierfs.settings | The contents of the configuration file for autotier
|
| services.canaille.jwtPrivateKeyFile | File containing the JWT private key
|
| services.mosquitto.listeners.*.acl | Additional ACL items to prepend to the generated ACL file.
|
| services.oauth2-proxy.tls.certificate | Path to certificate file.
|
| boot.loader.systemd-boot.windows | Make Windows bootable from systemd-boot
|
| services.nginx.virtualHosts.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.system76-scheduler.settings.cfsProfiles.responsive.latency | sched_latency_ns.
|
| services.wyoming.satellite.sounds.done | Path to audio file in WAV format to play when voice command recording has ended.
|
| services.xserver.windowManager.exwm.loadScript | Emacs lisp code to be run after loading the user's init
file.
|
| services.physlock.lockOn.extraTargets | Other targets to lock the screen just before
|
| services.filebeat.settings.output.elasticsearch.hosts | The list of Elasticsearch nodes to connect to
|
| services.plausible.mail.smtp.passwordFile | The path to the file with the password in case SMTP auth is enabled.
|
| networking.nftables.rulesetFile | The ruleset file to be used with nftables
|
| services.memos.environmentFile | The environment file to use when starting Memos.
By default, generated from .
|
| services.rke2.environmentFile | File path containing environment variables for configuring the rke2 service in the format of an EnvironmentFile
|
| services.forgejo.database.passwordFile | A file containing the password corresponding to
services.forgejo.database.user.
|
| services.redmine.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.preempt | Preemption mode.
|
| services.shiori.environmentFile | Path to file containing environment variables
|
| services.system76-scheduler.settings.cfsProfiles.responsive.nr-latency | sched_nr_latency.
|
| services.mongodb.initialRootPasswordFile | Path to the file containing the password for the root user if auth is enabled.
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.auth_token_file | Optional authentication information for token-based authentication:
https://docs.mesosphere.com/1.11/security/ent/iam-api/#passing-an-authentication-token
It is mutually exclusive with auth_token and other authentication mechanisms.
|
| services.printing.drivers | CUPS drivers to use
|
| services.matrix-conduit.settings | Generates the conduit.toml configuration file
|
| services.snips-sh.settings | The configuration of snips-sh is done through environment variables,
therefore you must use upper snake case (e.g. SNIPS_HTTP_INTERNAL)
|
| services.zwave-js.settings | Configuration settings for the generated config file
|
| services.castopod.maxUploadSize | Maximum supported size for a file upload in
|
| services.grafana.settings.security.admin_password | Default admin password
|
| systemd.sockets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.targets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| environment.unixODBCDrivers | Specifies Unix ODBC drivers to be registered in
/etc/odbcinst.ini
|
| services.slurm.dbdserver.storagePassFile | Path to file with database password
|
| services.gitlab.secrets.otpFile | A file containing the secret used to encrypt secrets for OTP
tokens
|
| services.onlyoffice.jwtSecretFile | Path to a file that contains the secret to sign web requests using JSON Web Tokens
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".live_view.signing_salt | LiveView signing salt
|
| services.athens.index.postgres.password | Password for the Postgres database
|
| services.athens.singleFlight.redis.password | Password for the redis server
|
| services.prometheus.exporters.snmp.configurationPath | Path to a snmp exporter configuration file
|
| services.inadyn.settings.custom.<name>.include | File to include additional settings for this provider from.
|
| services.misskey.database.passwordFile | The path to a file containing the database password
|
| services.healthchecks.settings | Environment variables which are read by healthchecks (local)_settings.py
|
| services.uwsgi.instance | uWSGI configuration
|
| services.iperf3.authorizedUsersFile | Path to the configuration file containing authorized users credentials to run iperf tests.
|
| services.buildkite-agents.<name>.extraConfig | Extra lines to be added verbatim to the configuration file.
|
| services.postgresql.initialScript | A file containing SQL statements to execute on first startup.
|
| services.rke2.autoDeployCharts.<name>.values | Override default chart values via Nix expressions
|
| services.jigasi.componentPasswordFile | Path to file containing component secret.
|
| services.jicofo.componentPasswordFile | Path to file containing component secret.
|
| services.rsyncd.settings.globalSection | global section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.wyoming.satellite.sounds.awake | Path to audio file in WAV format to play when wake word is detected.
|
| services.collectd.validateConfig | Validate the syntax of collectd configuration file at build time
|
| services.grafana.settings.database.path | Only applicable to sqlite3 database
|
| services.reposilite.database.path | Path to the embedded database file
|
| services.whitebophir.enable | Whether to enable whitebophir, an online collaborative whiteboard server (persistent state will be maintained under /var/lib/whitebophir).
|
| services.buildkite-agents.<name>.tokenPath | The token from your Buildkite "Agents" page
|
| services.zabbixProxy.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.caddy.settings | Structured configuration for Caddy to generate a Caddy JSON configuration file
|
| services.prosody.httpFileShare.size_limit | Maximum file size, in bytes.
|
| services.silverbullet.envFile | File containing extra environment variables
|
| services.dex.environmentFile | Environment file (see systemd.exec(5)
"EnvironmentFile=" section for the syntax) to define variables for dex
|
| services.microsocks.authPasswordFile | Path to a file containing the password for authentication.
|
| programs.tsmClient.servers.<name>.inclexcl | Text lines with include.* and exclude.* directives
to be used when sending files to the IBM TSM server,
or an absolute path pointing to a file with such lines.
|
| services.zabbixWeb.nginx.virtualHost.basicAuthFile | Basic Auth password file for a vhost
|
| services.jirafeau.nginxConfig.basicAuthFile | Basic Auth password file for a vhost
|
| environment.profileRelativeSessionVariables | Attribute set of environment variable used in the global
environment
|
| services.pretix.environmentFile | Environment file to pass secret configuration values
|
| services.documize.stateDirectoryName | The name of the directory below /var/lib/private
where documize runs in and stores, for example, backups.
|
| services.schleuder.extraSettingsFile | YAML file to merge into the schleuder config at runtime
|
| virtualisation.xen.qemu.pidFile | Path to the QEMU PID file.
|
| services.dolibarr.database.passwordFile | Database password file.
|
| services.healthchecks.settingsFile | Environment variables which are read by healthchecks (local)_settings.py
|
| systemd.user.targets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.cachix-agent.credentialsFile | Required file that needs to contain CACHIX_AGENT_TOKEN=...
|
| services.pipewire.extraConfig.client | Additional configuration for the PipeWire client library, used by most applications
|
| services.vlagent.remoteWrite.maxDiskUsagePerUrl | The maximum file-based buffer size in bytes
|
| services.netbird.server.coturn.passwordFile | The path to a file containing the password of the user used by netbird to connect to the coturn server.
|
| services.matrix-hookshot.settings.passFile | A passkey used to encrypt tokens stored inside the bridge
|
| services.prometheus.exporters.dnssec.configuration | dnssec exporter configuration as nix attribute set
|
| services.kimai.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.displayManager.dms-greeter.logs.path | File path where DMS greeter logs will be saved
|
| services.cloudlog.database.passwordFile | MySQL user password file.
|
| services.opencloud.settings | Additional YAML configuration for OpenCloud services
|
| services.headscale.settings.derp.paths | List of file paths containing DERP maps
|
| services.wg-access-server.secretsFile | yaml file containing all secrets. this needs to be in the same structure as the configuration
|
| services.headscale.settings.policy.mode | The mode can be "file" or "database" that defines
where the ACL policies are stored and read from.
|
| powerManagement.cpuFreqGovernor | Configure the governor used to regulate the frequency of the
available CPUs
|
| services.open-webui.environmentFile | Environment file to be passed to the systemd service
|
| services.kubernetes.kubelet.clientCaFile | Kubernetes apiserver CA file for client authentication.
|
| services.crowdsec.settings.console.tokenFile | The Console Token file to use.
|
| services.pghero.environmentFiles | File to load environment variables from
|
| services.zammad.secretKeyBaseFile | The path to a file containing the
secret_key_base secret
|
| services.mautrix-signal.registerToSynapse | Whether to add the bridge's app service registration file to
services.matrix-synapse.settings.app_service_config_files.
|
| services.tarsnap.archives.<name>.lowmem | Reduce memory consumption by not caching small files
|
| boot.loader.grub.fsIdentifier | Determines how GRUB will identify devices when generating the
configuration file
|
| services.writefreely.settings | Writefreely configuration (config.ini)
|
| services.sabnzbd.secretFiles | Path to a list of ini file containing confidential settings such as credentials
|
| services.peering-manager.peeringdbApiKeyFile | Path to a file containing the PeeringDB API key.
|
| networking.resolvconf.extraConfig | Extra configuration to append to resolvconf.conf.
|
| boot.loader.systemd-boot.netbootxyz.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.thinkfan.sensors.*.query | The query string used to match one or more sensors: can be
a fullpath to the temperature file (single sensor) or a fullpath
to a driver directory (multiple sensors).
When multiple sensors match, the query can be restricted using the
name or indices options.
|
| services.gitlab.initialRootPasswordFile | File containing the initial password of the root account if
this is a new install
|
| networking.wireless.networks | The network definitions to automatically connect to when
wpa_supplicant is running
|
| services.gitlab.databasePasswordFile | File containing the GitLab database user password
|
| services.misskey.meilisearch.keyFile | The path to a file containing the Meilisearch API key
|
| hardware.printers.ensurePrinters.*.model | Location of the ppd driver file for the printer.
lpinfo -m shows a list of supported models.
|
| services.syncplay.permanentRoomsFile | File with list of rooms that will be listed even if the room is empty,
newline delimited
|
| services.dawarich.database.passwordFile | A file containing the password corresponding to services.dawarich.database.user.
|
| services.limesurvey.database.socket | Path to the unix socket file to use for authentication.
|
| services.mastodon.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.zabbixServer.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.librenms.phpOptions | Options for PHP's php.ini file for librenms
|
| services.actual.settings.serverFiles | The server will put an account.sqlite file in this directory, which will contain the (hashed) server password, a list of all the budget files the server knows about, and the active session token (along with anything else the server may want to store in the future).
|
| services.bluemap.webserverSettings | Settings for the webserver.conf file, usually not required.
See upstream docs.
|
| services.cyrus-imap.cyrusSettings.SERVICES | This section is the heart of the cyrus.conf file
|
| services.discourse.redis.passwordFile | File containing the Redis password
|
| boot.binfmt.registrations.<name>.mask | A mask to be ANDed with the byte sequence of the file before matching
|
| services.meshtasticd.settings | The Meshtastic configuration file
|
| programs.tsmClient.servers | Server definitions ("stanzas")
for the client system-options file
|
| services.wastebin.secretFile | Path to file containing sensitive environment variables
|
| services.privoxy.settings.enable-edit-actions | Whether the web-based actions file editor may be used.
|
| systemd.services.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.minio.rootCredentialsFile | File containing the MINIO_ROOT_USER, default is "minioadmin", and
MINIO_ROOT_PASSWORD (length >= 8), default is "minioadmin"; in the format of
an EnvironmentFile=, as described by systemd.exec(5).
|
| services.openvpn.servers.<name>.authUserPass.username | The username to store inside the credentials file.
|
| services.openvpn.servers.<name>.authUserPass.password | The password to store inside the credentials file.
|
| services.agorakit.database.passwordFile | A file containing the password corresponding to
|
| services.szurubooru.server.settings | Configuration to write to config.yaml
|
| services.prefect.databasePasswordFile | path to a file containing e.g.:
DBPASSWORD=supersecret
stored outside the nix store, read by systemd as EnvironmentFile.
|
| services.fail2ban.banaction | Default banning action (e.g. iptables, iptables-new, iptables-multiport,
iptables-ipset-proto6-allports, shorewall, etc)
|
| virtualisation.bios | An alternate BIOS (such as qboot) with which to start the VM
|
| system.userActivationScripts | A set of shell script fragments that are executed by a systemd user
service when a NixOS system configuration is activated
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.nice | Niceness.
|
| services.searx.environmentFile | Environment file (see systemd.exec(5) "EnvironmentFile=" section for the syntax) to define variables for Searx
|
| services.shadowsocks.passwordFile | Password file with a password for connecting clients.
|
| services.pgadmin.initialPasswordFile | Initial password file for the pgAdmin account
|
| services.cross-seed.useGenConfigDefaults | Whether to use the option defaults from the configuration generated by
cross-seed gen-config
|
| services.gerbil.environmentFile | Path to a file containing sensitive environment variables for Gerbil
|
| services.mealie.credentialsFile | File containing credentials used in mealie such as POSTGRES_PASSWORD
or sensitive LDAP options
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".secret_key_base | Secret key used as a base to generate further secrets for encrypting and
signing data
|
| services.drupal.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.gitlab.secrets.secretFile | A file containing the secret used to encrypt variables in
the DB
|
| services.kubernetes.apiserver.etcd.caFile | Etcd ca file.
|
| services.discourse.admin.passwordFile | A path to a file containing the admin user's password
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.prio | CPU scheduler priority.
|
| services.botamusique.settings | Your configuration.ini as a Nix attribute set
|
| services.zigbee2mqtt.settings | Your configuration.yaml as a Nix attribute set
|
| services.keyd.keyboards.<name>.extraConfig | Extra configuration that is appended to the end of the file.
Do not write ids section here, use a separate option for it
|
| services.tor.relay.onionServices.<name>.secretKey | Secret key of the onion service
|
| networking.stevenblack.enable | Whether to enable the stevenblack hosts file blocklist.
|
| services.grafana.settings.server.cert_key | Path to the certificate key file (if protocol is set to https or h2).
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.ioPrio | IO scheduler priority.
|
| services.mediawiki.httpd.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.system76-scheduler.settings.cfsProfiles.responsive.bandwidth-size | sched_cfs_bandwidth_slice_us.
|
| services.lasuite-docs.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.lasuite-meet.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.kubernetes.apiserver.etcd.keyFile | Etcd key file.
|
| services.kubernetes.apiserver.tlsKeyFile | Kubernetes apiserver private key file.
|
| services.anuko-time-tracker.database.passwordFile | Database user password file.
|
| services.hylafax.faxqclean.enable.spoolInit | Whether to enable purging old files from the spooling area with
faxqclean
each time the spooling area is initialized
.
|
| security.pki.certificateFiles | A list of files containing trusted root certificates in PEM
format
|
| virtualisation.oci-containers.containers.<name>.imageFile | Path to an image file to load before running the image
|
| swapDevices.*.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| systemd.user.services.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.pyload.credentialsFile | File containing PYLOAD_DEFAULT_USERNAME and
PYLOAD_DEFAULT_PASSWORD in the format of an EnvironmentFile=,
as described by systemd.exec(5)
|
| services.vmagent.remoteWrite.basicAuthPasswordFile | File that contains the Basic Auth password used to connect to remote_write endpoint
|
| services.vlagent.remoteWrite.basicAuthPasswordFile | File that contains the Basic Auth password used to connect to remote_write endpoint
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.class | CPU scheduler class.
|
| services.limesurvey.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.key | key in the setting section for which this entry provides a value
|
| services.tinyproxy.settings.Filter | Tinyproxy supports filtering of web sites based on URLs or domains
|
| services.litellm.environmentFile | Environment file to be passed to the systemd service
|
| services.orthanc.environmentFile | Environment file to be passed to the systemd service
|
| services.beszel.hub.environmentFile | Environment file to be passed to the systemd service
|
| services.kubernetes.apiserver.tlsCertFile | Kubernetes apiserver certificate file.
|
| services.traefik.dynamic.settings | Dynamic configuration for Traefik, written in Nix
|
| services.dokuwiki.sites.<name>.settings | Structural DokuWiki configuration
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.ioClass | IO scheduler class.
|
| services.amule.ExternalConnectPasswordFile | File containing the password for connecting with amule-gui,
set this only if you didn't set `settings
|
| services.mautrix-discord.registerToSynapse | Whether to add the bridge's app service registration file to
services.matrix-synapse.settings.app_service_config_files.
|
| services.restic.backups.<name>.repositoryFile | Path to the file containing the repository location to backup to.
|
| services.opengfw.settings.replay.realtime | Whether the packets in the PCAP file should be replayed in "real time" (instead of as fast as possible).
|
| services.mpd.credentials.*.passwordFile | Path to file containing the password.
|
| services.system76-scheduler.settings.cfsProfiles.default.wakeup-granularity | sched_wakeup_granularity_ns.
|
| networking.resolvconf.extraOptions | Set the options in /etc/resolv.conf.
|
| services.vsftpd.userDbPath | Only applies if enableVirtualUsers is true
|
| services.ethercalc.enable | ethercalc, an online collaborative spreadsheet server
|
| services.invidious.extraSettingsFile | A file including Invidious settings
|
| boot.specialFileSystems.<name>.options | Options used to mount the file system
|
| services.mediawiki.httpd.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.tinc.networks.<name>.chroot | Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security
|
| services.gotenberg.downloadFrom.maxRetries | The maximum amount of times to retry downloading a file specified with downloadFrom.
|
| services.moosefs.chunkserver.enable | Whether to enable MooseFS chunkserver daemon that stores file data.
|
| services.wordpress.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| services.lidarr.environmentFiles | Environment file to pass secret configuration values
|
| services.sonarr.environmentFiles | Environment file to pass secret configuration values
|
| services.radarr.environmentFiles | Environment file to pass secret configuration values
|
| services.kubernetes.apiserver.etcd.certFile | Etcd cert file.
|
| services.rathole.credentialsFile | Path to a TOML file to be merged with the settings
|
| services.readeck.environmentFile | File containing environment variables to be passed to Readeck
|
| services.prometheus.exporters.imap-mailstat.configurationFile | File containing the configuration
|
| services.suricata.settings.default-log-dir | The default logging directory
|
| services.ghostunnel.servers.<name>.cacert | Path to CA bundle file (PEM/X509)
|
| services.lighttpd.mod_userdir | If true, requests in the form /~user/page.html are rewritten to take
the file public_html/page.html from the home directory of the user.
|
| services.ntfy-sh.environmentFile | Path to a file containing extra ntfy environment variables in the systemd EnvironmentFile
format
|
| services.lavalink.environmentFile | Add custom environment variables from a file
|
| image.repart.partitions.<name>.contents.<name>.source | Path of the source file.
|
| services.munin-node.disabledPlugins | Munin plugins to disable, even if
munin-node-configure --suggest tries to enable
them
|
| services.mautrix-signal.settings | config.yaml configuration as a Nix attribute set
|
| services.bookstack.settings | Options for Bookstack configuration
|
| services.davis.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.movim.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.slskd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.foundationdb.maxLogSize | Delete the oldest log file when the total size of all log
files exceeds the specified size
|
| services.inadyn.settings.provider.<name>.include | File to include additional settings for this provider from.
|
| services.prometheus.exporters.mikrotik.configuration | Mikrotik exporter configuration as nix attribute set
|
| services.limesurvey.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.invidious.database.passwordFile | Path to file containing the database password.
|
| services.namecoind.rpc.certificate | Certificate file for securing RPC connections.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.trim | whether leading and trailing whitespace should be stripped from the files content before being passed to NetworkManager
|
| services.beszel.agent.environmentFile | File path containing environment variables for configuring the beszel-agent service in the format of an EnvironmentFile
|
| services.wordpress.sites.<name>.extraConfig | Any additional text to be appended to the wp-config.php
configuration file
|
| services.jitsi-meet.prosody.lockdown | Whether to disable Prosody features not needed by Jitsi Meet
|
| services.freeswitch.enableReload | Issue the reloadxml command to FreeSWITCH when configuration directory changes (instead of restart)
|
| services.prometheus.enableReload | Reload prometheus when configuration file changes (instead of restart)
|
| services.triggerhappy.extraConfig | Literal contents to append to the end of triggerhappy configuration file.
|
| services.snipe-it.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.saunafs.metalogger.settings | Contents of metalogger config file (see sfsmetalogger.cfg(5)).
|
| services.bookstack.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.mediawiki.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.lasuite-docs.environmentFile | Path to environment file
|
| services.lasuite-meet.environmentFile | Path to environment file
|
| services.n8n.environment.N8N_USER_FOLDER | Provide the path where n8n will create the .n8n folder
|
| networking.networkmanager.ensureProfiles.secrets.entries | A list of secrets to provide to NetworkManager by reading their values from configured files
|
| virtualisation.msize | The msize (maximum packet size) option passed to 9p file systems, in
bytes
|
| services.mautrix-telegram.settings | config.yaml configuration as a Nix attribute set
|
| services.dnsdist.dnscrypt.providerKey | The filepath to the provider secret key
|
| services.meilisearch.masterKeyFile | Path to file which contains the master key
|
| services.screego.environmentFile | Environment file (see systemd.exec(5) "EnvironmentFile="
section for the syntax) passed to the service
|
| services.prometheus.exporters.junos-czerwonk.configurationFile | Specify the JunOS exporter configuration file to use.
|
| services.dependency-track.ldap.bindPasswordFile | The path to a file containing the LDAP bind password.
|
| services.spacecookie.settings | Settings for spacecookie
|
| boot.supportedFilesystems | Names of supported filesystem types, or an attribute set of file system types
and their state
|
| boot.initrd.compressor | The compressor to use on the initrd image
|
| services.firefox-syncserver.secrets | A file containing the various secrets
|
| services.hylafax.faxcron.enable.frequency | purging old files from the spooling area with
faxcron with the given frequency
(see systemd.time(7))
|
| programs.tsmClient.servers.<name>.genPasswd | Whether to enable automatic client password generation
|
| services.postgresql.settings | PostgreSQL configuration
|
| services.buildkite-agents.<name>.privateSshKeyPath | OpenSSH private key
A run-time path to the key file, which is supposed to be provisioned
outside of Nix store.
|
| services.wordpress.sites.<name>.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.gitlab.secrets.activeRecordSaltFile | A file containing the salt for active record encryption in the DB
|
| services.crowdsec.settings.simulation | Attributes inside the simulation.yaml file.
|
| services.athens.storage.azureblob.accountKey | Account key for the Azure Blob storage backend
|
| services.karakeep.environmentFile | An optional path to an environment file that will be used in the web and workers
services
|
| services.librenms.environmentFile | File containing env-vars to be substituted into the final config
|
| services.librenms.database.passwordFile | A file containing the password for the user of the MySQL/MariaDB server
|
| services.openvpn.servers.<name>.authUserPass | This option can be used to store the username / password credentials
with the "auth-user-pass" authentication method
|
| services.opensnitch.settings.Server.LogFile | File to write logs to (use /dev/stdout to write logs to standard
output).
|
| services.sourcehut.settings."pages.sr.ht".gemini-certs | An absolute file path (which should be outside the Nix-store)
to Gemini certificates.
|
| services.easytier.instances.<name>.settings | Settings to generate easytier-‹name›.toml
|
| services.matrix-alertmanager.tokenFile | File that contains a valid Matrix token for the Matrix user.
|
| services.commafeed.environmentFile | Environment file as defined in systemd.exec(5).
|
| services.gotenberg.environmentFile | Environment file to load extra environment variables from.
|
| programs.uwsm.waylandCompositors | Configuration for UWSM-managed Wayland Compositors
|
| services.akkoma.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fluidd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.gancio.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.monica.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.matomo.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchIface | interface name of the NetworkManager connection
|
| services.bookstack.settings.DB_PASSWORD_FILE | The file containing your mysql/mariadb database password.
|
| services.readarr.environmentFiles | Environment file to pass secret configuration values
|
| services.jigasi.environmentFile | File containing environment variables to be passed to the jigasi service,
in which secret tokens can be specified securely by defining values for
JIGASI_SIPUSER,
JIGASI_SIPPWD,
JIGASI_SIPSERVER and
JIGASI_SIPPORT.
|
| services.prometheus.alertmanager.configuration | Alertmanager configuration as nix attribute set
|
| services.mautrix-telegram.registerToSynapse | Whether to add the bridge's app service registration file to
services.matrix-synapse.settings.app_service_config_files.
|
| services.mautrix-whatsapp.registerToSynapse | Whether to add the bridge's app service registration file to
services.matrix-synapse.settings.app_service_config_files.
|
| services.icingaweb2.groupBackends | groups.ini contents
|
| services.gerrit.replicationSettings | Replication configuration
|
| services.limesurvey.httpd.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| security.agnos.settings.accounts.*.certificates.*.fullchain_output_file | Output path for the full chain including the acquired certificate
|
| services.clamsmtp.instances.*.keepAlives | Number of seconds to wait between each NOOP sent to the sending
server. 0 to disable
|
| services.mediawiki.extensions | Attribute set of paths whose content is copied to the extensions
subdirectory of the MediaWiki installation and enabled in configuration
|
| security.wrappers.<name>.permissions | The permissions of the wrapper program
|
| services.waagent.settings.ResourceDisk.SwapSizeMB | Specifies the size of the swap file in MiB (1024×1024 bytes)
|
| services.wordpress.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.gokapi.environment.GOKAPI_CONFIG_DIR | Sets the directory for the config file.
|
| services.keyd.keyboards.<name>.settings | Configuration, except ids section, that is written to /etc/keyd/.conf
|
| services.docling-serve.environmentFile | Environment file to be passed to the systemd service
|
| services.spacecookie.settings.root | The directory spacecookie should serve via gopher
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.matchers | Process matchers.
|
| services.navidrome.environmentFile | Environment file, used to set any secret ND_* environment variables.
|
| services.amazon-cloudwatch-agent.configurationFile | Amazon CloudWatch Agent configuration file
|
| services.matrix-alertmanager.secretFile | File that contains a secret for the Alertmanager webhook.
|
| services.kubernetes.apiserver.tokenAuthFile | Kubernetes apiserver token authentication file
|
| services.kubernetes.apiserver.basicAuthFile | Kubernetes apiserver basic authentication file
|
| services.kubernetes.apiserver.clientCaFile | Kubernetes apiserver CA file for client auth.
|
| services.keycloak.database.passwordFile | The path to a file containing the database password
|
| environment.systemPackages | The set of packages that appear in
/run/current-system/sw
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchUuid | UUID of the connection profile
UUIDs are assigned once on connection creation and should never change as long as the connection still applies to the same network.
|
| systemd.automounts.*.reloadTriggers | An arbitrary list of items such as derivations
|
| services.limesurvey.httpd.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.photoprism.databasePasswordFile | Database password file.
|
| services.slskd.environmentFile | Path to the environment file sourced on startup
|
| services.matrix-synapse.settings.listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.borgbackup.jobs.<name>.failOnWarnings | Fail the whole backup job if any borg command returns a warning
(exit code 1), for example because a file changed during backup.
|
| services.gokapi.environment.GOKAPI_CONFIG_FILE | Sets the filename for the config file.
|
| services.davis.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.movim.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.slskd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.szurubooru.server.settings.smtp.passFile | File containing the password associated to the given user for the SMTP server.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchId | connection id used by NetworkManager
|
| services.languagetool.settings | Configuration file options for LanguageTool, see
'languagetool-http-server --help'
for supported settings.
|
| services.discourse.mail.incoming.apiKeyFile | A file containing the Discourse API key used to add
posts and messages from mail
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchType | NetworkManager connection type
The NetworkManager configuration settings reference roughly corresponds to connection types
|
| virtualisation.lxc.bridgeConfig | This is the config file for override lxc-net bridge default settings.
|
| services.szurubooru.database.passwordFile | A file containing the password for the PostgreSQL user.
|
| services.snipe-it.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.dsnet.settings | The settings to use for dsnet
|
| services.xserver.displayManager.lightdm.greeter.name | The name of a .desktop file in the directory specified
in the 'package' option.
|
| services.prometheus.exporters.pve.server.keyFile | Path to a SSL private key file for the server
|
| boot.binfmt.registrations.<name>.openBinary | Whether to pass the binary to the interpreter as an open
file descriptor, instead of a path.
|
| services.home-assistant.blueprints.script | List of script
blueprints to
install into ${config.services.home-assistant.configDir}/blueprints/script.
|
| services.mpdscribble.journalInterval | How often should mpdscribble save the journal file? [seconds]
|
| services.zeronsd.servedNetworks.<name>.settings.token | Path to a file containing the API Token for ZeroTier Central.
|
| services.nextcloud.phpOptions | Options for PHP's php.ini file for nextcloud
|
| services.limesurvey.database.passwordFile | A file containing the password corresponding to
database.user.
|
| networking.nftables.checkRuleset | Run nft check on the ruleset to spot syntax errors during build
|
| services.grafana.provision.datasources.settings.datasources.*.secureJsonData | Datasource specific secure configuration
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchSetting | name of the setting section for which secrets are requested
|
| services.miniflux.adminCredentialsFile | File containing the ADMIN_USERNAME and
ADMIN_PASSWORD (length >= 6) in the format of
an EnvironmentFile=, as described by systemd.exec(5).
|
| services.prometheus.exporters.pve.server.certFile | Path to a SSL certificate file for the server
|
| services.anuko-time-tracker.settings.email.smtpPasswordFile | Path to file containing the MTA authentication password.
|
| services.mjolnir.pantalaimon.options.dataPath | The directory where pantalaimon should store its state such as the database file.
|
| services.headscale.settings.database.sqlite.path | Path to the sqlite3 database file.
|
| services.sourcehut.settings."sr.ht".network-key | An absolute file path (which should be outside the Nix-store)
to a secret key to encrypt internal messages with
|
| services.saunafs.chunkserver.settings | Contents of chunkserver config file (see sfschunkserver.cfg(5)).
|
| services.epgstation.database.passwordFile | A file containing the password for the database named
database.name.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.wakeup-granularity | sched_wakeup_granularity_ns.
|
| services.prowlarr.environmentFiles | Environment file to pass secret configuration values
|
| services.whisparr.environmentFiles | Environment file to pass secret configuration values
|
| services.varnish.listen.*.address | If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").
(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
followed by the name of an abstract socket ("@myvarnishd") accept connections
on a Unix domain socket
|
| services.fedimintd.<name>.bitcoin.rpc.secretFile | If set the URL specified in bitcoin.rpc.url will get the content of this file added
as an URL password, so http://user@example.com will turn into http://user:SOMESECRET@example.com
|
| services.grafana.settings.server.cdn_url | Specify a full HTTP URL address to the root of your Grafana CDN assets
|
| services.aria2.downloadDirPermission | The permission for settings.dir
|
| programs.uwsm.waylandCompositors.<name>.prettyName | The full name of the desktop entry file.
|
| services.mautrix-whatsapp.settings | config.yaml configuration as a Nix attribute set
|
| services.sourcehut.settings.objects.s3-secret-key | An absolute file path (which should be outside the Nix-store)
to the secret key of the S3-compatible object storage service.
|
| services.journalwatch.extraConfig | Extra lines to be added verbatim to the journalwatch/config configuration file
|
| services.openssh.authorizedKeysInHomedir | Enables the use of the ~/.ssh/authorized_keys file
|
| virtualisation.xen.efi.path | Path to xen.efi. pkgs.xen is patched to install the xen.efi file
on $boot/boot/xen.efi, but an unpatched Xen build may install it
somewhere else, such as $out/boot/efi/efi/nixos/xen.efi
|
| services.discourse.database.passwordFile | File containing the Discourse database user password
|
| services.gancio.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fluidd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.akkoma.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.matomo.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.monica.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.grafana.provision.alerting.rules.path | Path to YAML rules configuration
|
| services.prometheus.exporters.ipmi.webConfigFile | Path to configuration file that can enable TLS or authentication.
|
| services.uvcvideo.dynctrl.packages | List of packages containing uvcvideo dynamic controls
rules
|
| services.icingaweb2.resources | resources.ini contents
|
| services.livekit.ingress.environmentFile | Environment file as defined in systemd.exec(5) passed to the service
|
| boot.initrd.supportedFilesystems | Names of supported filesystem types, or an attribute set of file system types
and their state
|
| services.easytier.instances.<name>.extraSettings | Extra settings to add to easytier-‹name›.toml.
|
| programs.uwsm.waylandCompositors.<name>.comment | The comment field of the desktop entry file.
|
| services.homebridge.environmentFile | Path to an environment-file which may contain secrets.
|
| services.discourse.secretKeyBaseFile | The path to a file containing the
secret_key_base secret
|
| boot.initrd.network.ifstate.cleanupSettings | Content of IfState's initrd cleanup configuration file
|
| services.mjolnir.pantalaimon.passwordFile | File containing the matrix password for the mjolnir user.
|
| services.tigerbeetle.clusterId | The 128-bit cluster ID used to create the replica data file (if needed)
|
| services.gitea-actions-runner.instances.<name>.tokenFile | Path to an environment file, containing the TOKEN environment
variable, that holds a token to register at the configured
Gitea/Forgejo instance.
|
| services.restic.backups.<name>.environmentFile | file containing the credentials to access the repository, in the
format of an EnvironmentFile as described by systemd.exec(5)
|
| networking.supplicant.<name>.extraConf | Configuration options for wpa_supplicant.conf
|
| services.hercules-ci-agent.settings.secretsJsonPath | Path to a JSON file containing secrets for effects
|
| services.anubis.defaultOptions.settings.POLICY_FNAME | The policy file to use
|
| environment.enableDebugInfo | Some NixOS packages provide debug symbols
|
| services.anubis.defaultOptions.policy.settings | Additional policy settings merged into the policy file
|
| services.neo4j.directories.imports | The root directory for file URLs used with the Cypher
LOAD CSV clause
|
| services.public-inbox.settings.publicinbox.css | The local path name of a CSS file for the PSGI web interface.
|
| services.icingaweb2.generalConfig | config.ini contents
|
| services.blockbook-frontend.<name>.rpc.passwordFile | File containing password of the RPC user
|
| networking.wg-quick.interfaces.<name>.privateKeyFile | Private key file as generated by wg genkey.
|
| services.ocsinventory-agent.settings.ca | Path to CA certificates file in PEM format, for server
SSL certificate validation.
|
| services.wordpress.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.nextcloud.notify_push.dbpassFile | The full path to a file that contains the database password.
|
| services.szurubooru.server.settings.secretFile | File containing a secret used to salt the users' password hashes and generate filenames for static content.
|
| services.wstunnel.clients.<name>.httpProxy | Proxy to use to connect to the wstunnel server (USER:PASS@HOST:PORT).
Passwords specified here will be world-readable in the Nix store!
To pass a password to the service, point the environmentFile option
to a file containing PROXY_PASSWORD=<your-password-here> and set
this option to <user>:$PROXY_PASSWORD@<host>:<port>
|
| programs.openvpn3.log-service.settings.timestamp | Add timestamp log file
|
| virtualisation.xen.boot.efi.path | Path to xen.efi. pkgs.xen is patched to install the xen.efi file
on $boot/boot/xen.efi, but an unpatched Xen build may install it
somewhere else, such as $out/boot/efi/efi/nixos/xen.efi
|
| services.limesurvey.nginx.virtualHost.basicAuthFile | Basic Auth password file for a vhost
|
| services.waagent.settings.ResourceDisk.EnableSwap | If enabled, the agent creates a swap file (/swapfile) on the resource disk
and adds it to the system swap space
|
| services.blendfarm.basicSecurityPasswordFile | Path to the password file the client needs to connect to the server
|
| services.discourse.mail.outgoing.passwordFile | A file containing the password of the SMTP server account
|
| services.hockeypuck.settings | Configuration file for hockeypuck, here you can override
certain settings (loglevel and
openpgp.db.dsn) by just setting those values
|
| programs.chromium.extensions | List of chromium extensions to install
|
| services.dolibarr.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.kanboard.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.librenms.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.agorakit.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fediwall.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.mainsail.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.pixelfed.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.hylafax.faxqclean.enable.frequency | Purge old files from the spooling area with
faxcron with the given frequency
(see systemd.time(7)).
|
| services.mautrix-meta.instances.<name>.settings | config.yaml configuration as a Nix attribute set
|
| services.dependency-track.database.passwordFile | The path to a file containing the database password.
|
| services.radicle.httpd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.cgit.<name>.gitHttpBackend.checkExportOkFiles | Whether git-http-backend should only export repositories that contain a git-daemon-export-ok file
|
| services.caddy.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.yggdrasil.settings.PrivateKeyPath | Path to the private key file on the host system
|
| services.onlyoffice.postgresPasswordFile | Path to a file that contains the password OnlyOffice should use to connect to Postgresql
|
| services.govee2mqtt.environmentFile | Environment file as defined in systemd.exec(5)
|
| services.fail2ban.banaction-allports | Default banning action (e.g. iptables, iptables-new, iptables-multiport,
shorewall, etc) for "allports" jails
|
| services.mosquitto.listeners.*.authPlugins.*.plugin | Plugin path to load, should be a .so file.
|
| services.komodo-periphery.environmentFile | Environment file for additional configuration via environment variables.
|
| services.blockbook-frontend.<name>.extraConfig | Additional configurations to be appended to coin.conf
|
| services.writefreely.database.passwordFile | The file to load the database password from.
|
| services.anubis.instances.<name>.settings.POLICY_FNAME | The policy file to use
|
| services.mailpit.instances.<name>.database | Specify the local database filename to store persistent data
|
| services.your_spotify.spotifySecretFile | A file containing the secret key of your Spotify application
|
| services.anubis.instances.<name>.policy.settings | Additional policy settings merged into the policy file
|
| services.matrix-continuwuity.settings | Generates the continuwuity.toml configuration file
|
| services.hercules-ci-agent.settings.binaryCachesPath | Path to a JSON file containing binary cache secret keys
|
| boot.loader.generationsDir.enable | Whether to create symlinks to the system generations under
/boot
|
| services.opencloud.environmentFile | An environment file as defined in systemd.exec(5)
|
| virtualisation.xen.store.settings.pidFile | Path to the Xen Store Daemon PID file.
|
| services.prometheus.exporters.opnsense.apiKeyFile | File containing the api key.
|
| services.prometheus.exporters.dnsmasq.leasesPath | Path to the dnsmasq.leases file.
|
| services.postfixadmin.setupPasswordFile | Password file for the admin
|
| services.interception-tools.udevmonConfig | String of udevmon YAML configuration, or path to a udevmon YAML
configuration file.
|
| services.pds.environmentFiles | File to load environment variables from
|
| services.wasabibackend.rpc.passwordFile | File that contains the password of the RPC user.
|
| services.suricata.settings.unix-command | Unix command socket that can be used to pass commands to Suricata
|
| services.workout-tracker.environmentFile | An environment file as defined in systemd.exec(5)
|
| virtualisation.lxc.usernetConfig | This is the config file for managing unprivileged user network
administration access in LXC
|
| services.waagent.settings.ResourceDisk.FileSystem | The file system type for the resource disk
|
| services.gitlab.secrets.activeRecordPrimaryKeyFile | A file containing the secret used to encrypt some rails data
in the DB
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.passwordFile | The password for this entry, read from the given file when starting hostapd
|
| services.persistent-evdev.devices | A set of virtual proxy device labels with backing physical device ids
|
| services.rosenpass.settings.public_key | Path to a file containing the public key of the local Rosenpass peer
|
| services.rosenpass.settings.secret_key | Path to a file containing the secret key of the local Rosenpass peer
|
| services.roundcube.database.passwordFile | Password file for the postgresql connection
|
| services.grafana.provision.dashboards.path | Path to YAML dashboard configuration
|
| services.crowdsec.settings.lapi.credentialsFile | The LAPI credential file to use.
|
| services.crowdsec.settings.capi.credentialsFile | The CAPI credential file to use.
|
| services.stash.settings.video_file_naming_algorithm | Hash algorithm to use for generated file naming
|
| services.influxdb2.provision.initialSetup.tokenFile | API Token to set for the admin user
|
| services.home-assistant.blueprints.template | List of template
blueprints to
install into ${config.services.home-assistant.configDir}/blueprints/template.
|
| services.wastebin.settings.WASTEBIN_DATABASE_PATH | Path to the sqlite3 database file
|
| services.anuko-time-tracker.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.borgbackup.jobs.<name>.patterns | Include/exclude paths matching the given patterns
|
| services.postfix.tlsTrustedAuthorities | File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery
|
| services.healthchecks.settings.SECRET_KEY_FILE | Path to a file containing the secret key.
|
| services.openvscode-server.connectionTokenFile | Path to a file that contains the connection token.
|
| services.geoipupdate.settings.LicenseKey | A file containing the MaxMind license key
|
| services.openssh.authorizedKeysFiles | Specify the rules for which files to read on the host
|
| services.sourcehut.settings.mail.pgp-privkey | An absolute file path (which should be outside the Nix-store)
to an OpenPGP private key
|
| services.prometheus.exporters.nut.passwordPath | A run-time path to the nutUser password file, which should be
provisioned outside of Nix store.
|
| services.prosody.httpFileShare.expires_after | Max age of a file before it gets deleted.
|
| services.kubernetes.apiserver.kubeletClientCaFile | Path to a cert file for connecting to kubelet.
|
| services.k3s.manifests | Auto-deploying manifests that are linked to /var/lib/rancher/k3s/server/manifests before k3s starts
|
| services.minecraft-server.serverProperties | Minecraft server properties for the server.properties file
|
| services.peertube.serviceEnvironmentFile | Set environment variables for the service
|
| services.victorialogs.basicAuthPasswordFile | File that contains the Basic Auth password used to protect VictoriaLogs instance by authorization
|
| services.xserver.exportConfiguration | Whether to symlink the X server configuration under
/etc/X11/xorg.conf.
|
| services.bookstack.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.kubernetes.controllerManager.tlsKeyFile | Kubernetes controller-manager private key file.
|
| services.agorakit.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.librenms.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.kanboard.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.dolibarr.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fediwall.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.mainsail.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.pixelfed.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.radicle.httpd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.tinc.networks.<name>.hostSettings.<name>.rsaPublicKey | Legacy RSA public key of the host in PEM format, including start and
end markers
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.adapter_config.clientSecretFile | A file containing a the client secret for an openid_connect adapter
|
| services.rosenpass.settings.peers.*.public_key | Path to a file containing the public key of the remote Rosenpass peer.
|
| services.wasabibackend.customConfigFile | Defines the path to a custom configuration file that is copied to the user's directory
|
| services.maddy.ensureCredentials.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the user.
|
| virtualisation.libvirtd.extraConfig | Extra contents appended to the libvirtd configuration file,
libvirtd.conf.
|
| services.nginx.virtualHosts.<name>.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.kubernetes.controllerManager.tlsCertFile | Kubernetes controller-manager certificate file.
|
| services.mautrix-meta.instances.<name>.registerToSynapse | Whether to add registration file to services.matrix-synapse.settings.app_service_config_files and
make Synapse wait for registration service.
|
| services.pipewire.extraConfig.pipewire-pulse | Additional configuration for the PipeWire PulseAudio server
|
| environment.defaultPackages | Set of default packages that aren't strictly necessary
for a running system, entries can be removed for a more
minimal NixOS installation
|
| services.ocsinventory-agent.settings.local | If specified, the OCS Inventory Agent will run in offline mode
and the resulting inventory file will be stored in the specified path.
|
| services.prometheus.exporters.restic.passwordFile | File containing the password to the repository.
|
| services.paperless.passwordFile | A file containing the superuser password
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.password | The password for this entry
|
| services.misskey.reverseProxy.webserver.nginx.basicAuthFile | Basic Auth password file for a vhost
|
| services.matrix-hookshot.registrationFile | Appservice registration file
|
| services.grafana.settings.server.socket_mode | Mode where the socket should be set when protocol=socket
|
| services.grafana.provision.alerting.muteTimings.path | Path to YAML mute timings configuration
|
| services.wstunnel.servers.<name>.settings.restrict-to | Restrictions on the connections that the server will accept
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.xserver.displayManager.lightdm.greeter.package | The LightDM greeter to login via
|
| virtualisation.xen.domains.extraConfig | Options defined here will override the defaults for xendomains
|
| documentation.man.mandoc.settings.output.style | Path to the file used for an external style-sheet
|
| services.writefreely.admin.initialPasswordFile | Path to a file containing the initial password for the admin user
|
| services.transmission.settings.umask | Sets transmission's file mode creation mask
|
| services.adguardhome.settings | AdGuard Home configuration
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-secret-key | An absolute file path (which should be outside the Nix-store)
to a secret key for Stripe
|
| services.prometheus.exporters.dmarc.imap.passwordFile | File containing the login password for the IMAP connection.
|
| services.pufferpanel.environmentFile | File to load environment variables from
|
| services.jirafeau.nginxConfig.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.authelia.instances.<name>.settingsFiles | Here you can provide authelia with configuration files or directories
|
| services.suwayomi-server.settings.server.basicAuthPasswordFile | The password file containing the value that you have to provide when authenticating.
|
| services.frp.instances.<name>.environmentFiles | List of paths files that follows systemd environmentfile structure
|
| services.xserver.displayManager.sx.enable | Whether to enable the "sx" pseudo-display manager, which allows users
to start manually via the "sx" command from a vt shell
|
| services.prometheus.exporters.opnsense.apiSecretFile | File containing the api secret.
|
| services.waagent.settings.ResourceDisk.Format | If set to true, waagent formats and mounts the resource disk that the platform provides,
unless the file system type in `ResourceDisk
|
| services.ocsinventory-agent.settings.server | The URI of the OCS Inventory server where to send the inventory file
|
| services.grafana.provision.alerting.policies.path | Path to YAML notification policies configuration
|
| services.restic.backups.<name>.rcloneConfig | Configuration for the rclone remote being used for backup
|
| services.sourcehut.settings."sr.ht".service-key | An absolute file path (which should be outside the Nix-store)
to a key used for encrypting session cookies
|
| services.firezone.server.settingsSecret.TOKENS_SALT | A file containing a unique base64 encoded secret for the
TOKENS_SALT
|
| services.anuko-time-tracker.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| environment.extraOutputsToInstall | Entries listed here will be appended to the meta.outputsToInstall attribute for each package in environment.systemPackages, and the files from the corresponding derivation outputs symlinked into /run/current-system/sw
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets | The subnets which this tinc daemon will serve
|
| services.mail.sendmailSetuidWrapper.permissions | The permissions of the wrapper program
|
| services.kubernetes.controllerManager.rootCaFile | Kubernetes controller manager certificate authority file included in
service account's token secret.
|
| services.jitsi-videobridge.xmppConfigs.<name>.passwordFile | File containing the password for the user.
|
| services.rke2.manifests | Auto-deploying manifests that are linked to /var/lib/rancher/rke2/server/manifests before rke2 starts
|
| security.pam.ussh.authorizedPrincipalsFile | Path to a list of principals; if the user presents a certificate with
one of these principals, then they will be authorized
|
| services.grafana.provision.datasources.path | Path to YAML datasource configuration
|
| documentation.man.mandoc.settings.output.toc | Whether to enable printing a table of contents near the beginning of the HTML output
of mandoc(1) if an input file contains at least two
non-standard sections
.
|
| services.osquery.flags.database_path | Path used for the database file.
If left as the default value, this directory will be automatically created before the
service starts, otherwise you are responsible for ensuring the directory exists with
the appropriate ownership and permissions.
|
| services.elasticsearch-curator.actionYAML | curator action.yaml file contents, alternatively use curator-cli which takes a simple action command
|
| services.step-ca.intermediatePasswordFile | Path to the file containing the password for the intermediate
certificate private key.
Make sure to use a quoted absolute path instead of a path literal
to prevent it from being copied to the globally readable Nix
store.
|
| services.bookstack.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.grafana.settings.server.socket_gid | GID where the socket should be set when protocol=socket
|
| services.grafana-image-renderer.settings.service.logging.level | The log-level of the grafana-image-renderer.service-unit.
|
| services.postfixadmin.database.passwordFile | Password file for the postgresql connection
|
| services.firezone.server.settingsSecret.TOKENS_KEY_BASE | A file containing a unique base64 encoded secret for the
TOKENS_KEY_BASE
|
| services.firezone.server.settingsSecret.SECRET_KEY_BASE | A file containing a unique base64 encoded secret for the
SECRET_KEY_BASE
|
| services.xserver.displayManager.lightdm.greeters.gtk.extraConfig | Extra configuration that should be put in the lightdm-gtk-greeter.conf
configuration file.
|
| services.immichframe.settings.Accounts.*.ApiKeyFile | File containing an API key to talk to the Immich server
|
| services.xserver.displayManager.lightdm.greeters.enso.extraConfig | Extra configuration that should be put in the greeter.conf
configuration file
|
| services.postfix.masterConfig.<name>.wakeupUnusedComponent | If set to false the component will only be woken
up if it is used
|
| services.nginx.virtualHosts.<name>.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.influxdb2.provision.users.<name>.passwordFile | Password for the user
|
| services.firezone.server.provision.accounts | All accounts to provision
|
| services.home-assistant.lovelaceConfigWritable | Whether to make ui-lovelace.yaml writable
|
| services.jibri.xmppEnvironments.<name>.call.login.passwordFile | File containing the password for the user.
|
| services.prometheus.exporters.bitcoin.rpcPasswordFile | File containing RPC password.
|
| services.sslh.settings.verbose-connections | Where to log connections information
|
| services.grafana.provision.alerting.contactPoints.path | Path to YAML contact points configuration
|
| networking.networkmanager.dns | Set the DNS (resolv.conf) processing mode
|
| services.foundationdb.tls.certificate | Path to the TLS certificate file
|
| services.athens.singleFlight.redisSentinel.sentinelPassword | Password for the sentinel server
|
| services.radicle.ci.adapters.native.instances.<name>.settings.log | File where radicle-native-ci should write the run log.
|
| services.xserver.displayManager.lightdm.greeters.mini.extraConfig | Extra configuration that should be put in the lightdm-mini-greeter.conf
configuration file.
|
| services.suricata.settings.outputs | Configure the type of alert (and other) logging you would like
|
| services.mpdscribble.endpoints.<name>.passwordFile | File containing the password, either as MD5SUM or cleartext.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| security.pam.sshAgentAuth.authorizedKeysFiles | A list of paths to files in OpenSSH's authorized_keys format, containing
the keys that will be trusted by the pam_ssh_agent_auth module
|
| services.mollysocket.environmentFile | Environment file (see systemd.exec(5) "EnvironmentFile="
section for the syntax) passed to the service
|
| services.grafana.provision.alerting.templates.path | Path to YAML templates configuration
|
| services.woodpecker-server.environmentFile | File to load environment variables
from
|
| services.influxdb2.provision.initialSetup.passwordFile | Password for primary user
|
| systemd.services.<name>.confinement.fullUnit | Whether to include the full closure of the systemd unit file into the
chroot, instead of just the dependencies for the executables.
While it may be tempting to just enable this option to
make things work quickly, please be aware that this might add paths
to the closure of the chroot that you didn't anticipate
|
| services.gotosocial.environmentFile | File path containing environment variables for configuring the GoToSocial service
in the format of an EnvironmentFile as described by systemd.exec(5)
|
| services.szurubooru.server.settings.delete_source_files | Whether to delete thumbnails and source files on post delete.
|
| services.prometheus.exporters.tibber.apiTokenPath | Add here the path to your personal Tibber API Token ('Bearer Token') File
|
| services.jirafeau.nginxConfig.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.grafana.provision.alerting.rules.settings.apiVersion | Config file version.
|
| environment.corePackages | Set of core packages for a normal interactive system
|
| services.bluesky-pds.environmentFiles | File to load environment variables from
|
| services.pid-fan-controller.settings.fans.*.wildcardPath | Wildcard path of the hwmon pwm file
|
| services.home-assistant.blueprints.automation | List of automation
blueprints to
install into ${config.services.home-assistant.configDir}/blueprints/automation.
|
| services.bitwarden-directory-connector-cli.secrets.ldap | Path to file that contains LDAP password for user in {option}`ldap.username
|
| services.xserver.displayManager.lightdm.greeters.slick.extraConfig | Extra configuration that should be put in the lightdm-slick-greeter.conf
configuration file.
|
| networking.wireguard.interfaces.<name>.privateKeyFile | Private key file as generated by wg genkey.
|
| services.opensmtpd.serverConfiguration | The contents of the smtpd.conf configuration file
|
| services.prometheus.exporters.exportarr-sonarr.apiKeyFile | File containing the api-key.
|
| services.prometheus.exporters.exportarr-lidarr.apiKeyFile | File containing the api-key.
|
| services.prometheus.exporters.exportarr-bazarr.apiKeyFile | File containing the api-key.
|
| services.prometheus.exporters.exportarr-radarr.apiKeyFile | File containing the api-key.
|
| services.authelia.instances.<name>.secrets.oidcIssuerPrivateKeyFile | Path to your private key file used to encrypt OIDC JWTs.
|
| services.prometheus.exporters.pgbouncer.webConfigFile | Path to configuration file that can enable TLS or authentication.
|
| services.sourcehut.settings.webhooks.private-key | An absolute file path (which should be outside the Nix-store)
to a base64-encoded Ed25519 key for signing webhook payloads
|
| services.dendrite.settings.global.private_key | The path to the signing private key file, used to sign
requests and events.
nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
|
| services.pantalaimon-headless.instances.<name>.dataPath | The directory where pantalaimon should store its state such as the database file.
|
| boot.loader.systemd-boot.sortKey | The sort key used for the NixOS bootloader entries
|
| services.prometheus.exporters.deluge.delugePasswordFile | File containing the password to connect to deluge server.
|
| services.prometheus.exporters.storagebox.tokenFile | File that contains the Hetzner API token to use.
|
| services.homepage-dashboard.environmentFile | The path to an environment file that contains environment variables to pass
to the homepage-dashboard service, for the purpose of passing secrets to
the service
|
| services.nextcloud.settings.loglevel | Log level value between 0 (DEBUG) and 4 (FATAL).
-
0 (debug): Log all activity.
-
1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
-
2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
-
3 (error): Log failed operations and fatal errors.
-
4 (fatal): Log only fatal errors that cause the server to stop.
|
| services.firezone.server.settingsSecret.RELEASE_COOKIE | A file containing a unique secret identifier for the Erlang
cluster
|
| services.wstunnel.clients.<name>.environmentFile | Environment file to be passed to the systemd service
|
| services.wstunnel.servers.<name>.environmentFile | Environment file to be passed to the systemd service
|
| services.mautrix-meta.instances.<name>.registrationFile | Path to the yaml registration file of the appservice.
|
| services.mastodon.elasticsearch.passwordFile | Path to file containing password for optionally authenticating with Elasticsearch.
|
| services.outline.slackAuthentication.secretFile | File path containing the authentication secret.
|
| services.postfix.settings.master.<name>.wakeupUnusedComponent | If set to false the component will only be woken
up if it is used
|
| services.prometheus.exporters.exportarr-readarr.apiKeyFile | File containing the api-key.
|
| services.nextcloud-spreed-signaling.settings.turn.apikeyFile | The path to the file containing the value for turn.apikey
|
| services.nextcloud-spreed-signaling.settings.turn.secretFile | The path to the file containing the value for turn.secret
|
| services.matrix-appservice-discord.settings | config.yaml configuration as a Nix attribute set
|
| virtualisation.libvirtd.qemu.runAsRoot | If true, libvirtd runs qemu as root
|
| services.bacula-sd.director.<name>.password | Specifies the password that must be supplied for the default Bacula
Console to be authorized
|
| services.bacula-fd.director.<name>.password | Specifies the password that must be supplied for the default Bacula
Console to be authorized
|
| services.invoiceplane.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.prometheus.exporters.restic.repositoryFile | Path to the file containing the URI for the repository to monitor.
|
| services.grafana.provision.dashboards.settings.apiVersion | Config file version.
|
| services.firezone.server.settingsSecret.LIVE_VIEW_SIGNING_SALT | A file containing a unique base64 encoded secret for the
LIVE_VIEW_SIGNING_SALT
|
| services.prometheus.exporters.ecoflow.ecoflowEmailFile | Path to the file with your personal ecoflow app login email address
|
| services.pipewire.extraConfig.pipewire | Additional configuration for the PipeWire server
|
| services.postfix.settings.main.smtpd_tls_chain_files | List of paths to the server private keys and certificates.
The order of items matters and a private key must always be followed by the corresponding certificate.
https://www.postfix.org/postconf.5.html#smtpd_tls_chain_files
|
| services.mosquitto.listeners.*.users.<name>.hashedPassword | Specifies the hashed password for the MQTT User
|
| services.jibri.xmppEnvironments.<name>.control.login.passwordFile | File containing the password for the user.
|
| services.prometheus.exporters.pgbouncer.pidFile | Path to PgBouncer pid file
|
| services.pid-fan-controller.settings.heatSources.*.wildcardPath | Path of the heat source's hwmon temp_input file
|
| services.automysqlbackup.settings | automysqlbackup configuration
|
| services.prometheus.exporters.buildkite-agent.tokenPath | The token from your Buildkite "Agents" page
|
| services.prometheus.exporters.mail.environmentFile | File containing env-vars to be substituted into the exporter's config.
|
| services.firezone.server.settingsSecret.COOKIE_SIGNING_SALT | A file containing a unique base64 encoded secret for the
COOKIE_SIGNING_SALT
|
| services.draupnir.secrets.pantalaimon.password | File containing the password for Draupnir's Matrix account when used in
conjunction with Pantalaimon to be used in place of
services.draupnir.settings.pantalaimon.password.
|
| services.netbird.clients.<name>.login.systemdDependencies | Additional systemd dependencies required to succeed before the Setup Key file becomes available.
|
| services.netbird.tunnels.<name>.login.systemdDependencies | Additional systemd dependencies required to succeed before the Setup Key file becomes available.
|
| services.slskd.settings.remote_file_management | Whether to enable modification of share contents through the web ui.
|
| services.victoriatraces.basicAuthPasswordFile | File that contains the Basic Auth password used to protect VictoriaTraces instance by authorization
|
| services.grafana.provision.datasources.settings.prune | When true, provisioned datasources from this file will be deleted
automatically when removed from
services.grafana.provision.datasources.settings.datasources.
|
| services.grafana.provision.alerting.muteTimings.settings.apiVersion | Config file version.
|
| services.prometheus.exporters.exportarr-prowlarr.apiKeyFile | File containing the api-key.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.cacert | Path to CA bundle file (PEM/X509)
|
| documentation.man.mandoc.settings.output.man | A template for linked manuals (usually via the Xr macro) in HTML
output
|
| services.grafana.provision.alerting.policies.settings.apiVersion | Config file version.
|
| services.woodpecker-agents.agents.<name>.environmentFile | File to load environment variables
from
|
| services.outline.oidcAuthentication.clientSecretFile | File path containing the authentication secret.
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.signingKeyPath | Path to the signing key file for authenticated media.
|
| virtualisation.credentials.<name>.source | Source file on the host containing the credential data.
|
| virtualisation.libvirtd.qemu.verbatimConfig | Contents written to the qemu configuration file, qemu.conf
|
| services.limesurvey.nginx.virtualHost.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.prometheus.exporters.kafka.environmentFile | File containing the credentials to access the repository, in the
format of an EnvironmentFile as described by systemd.exec(5)
|
| services.github-runners.<name>.ephemeral | If enabled, causes the following behavior:
- Passes the
--ephemeral flag to the runner configuration script
- De-registers and stops the runner with GitHub after it has processed one job
- On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
- Restarts the service after its successful exit
- On start, wipes the state directory and configures a new runner
You should only enable this option if tokenFile points to a file which contains a
personal access token (PAT)
|
| services.nextcloud-spreed-signaling.backends.<name>.secretFile | The path to the file containing the value for backends.<name>.secret
|
| services.prometheus.exporters.ecoflow.ecoflowAccessKeyFile | Path to the file with your personal api access string from the Ecoflow development website https://developer-eu.ecoflow.com
|
| services.prometheus.exporters.ecoflow.ecoflowSecretKeyFile | Path to the file with your personal api secret string from the Ecoflow development website https://developer-eu.ecoflow.com
|
| services.displayManager.dms-greeter.compositor.customConfig | Custom compositor configuration to use for the greeter session
|
| services.grafana.provision.datasources.settings.apiVersion | Config file version.
|
| services.prometheus.exporters.fastly.environmentFile | An environment file containg at least the FASTLY_API_TOKEN= environment
variable.
|
| services.matrix-appservice-discord.environmentFile | File containing environment variables to be passed to the matrix-appservice-discord service,
in which secret tokens can be specified securely by defining values for
APPSERVICE_DISCORD_AUTH_CLIENT_I_D and
APPSERVICE_DISCORD_AUTH_BOT_TOKEN.
|
| services.outline.azureAuthentication.clientSecretFile | File path containing the authentication secret.
|
| security.pam.services.<name>.googleAuthenticator.enable | If set, users with enabled Google Authenticator (created
~/.google_authenticator) will be required
to provide Google Authenticator token to log in.
|
| security.pam.services.<name>.googleAuthenticator.allowNullOTP | Whether to allow login for accounts that have no OTP set
(i.e., accounts with no OTP configured or no existing
~/.google_authenticator).
|
| services.grafana.provision.alerting.contactPoints.settings.apiVersion | Config file version.
|
| services.meilisearch.masterKeyEnvironmentFile | Path to file which contains the master key
|
| services.prometheus.exporters.collectd.collectdBinary.authFile | File mapping user names to pre-shared keys (passwords).
|
| boot.initrd.availableKernelModules | The set of kernel modules in the initial ramdisk used during the
boot process
|
| services.jellyfin.forceEncodingConfig | Whether to overwrite Jellyfin's encoding.xml configuration file on each service start
|
| networking.resolvconf.dnsExtensionMechanism | Enable the edns0 option in resolv.conf
|
| services.prometheus.exporters.restic.environmentFile | File containing the credentials to access the repository, in the
format of an EnvironmentFile as described by systemd.exec(5)
|
| services.mautrix-discord.registrationServiceUnit | The registration service that generates the registration file
|
| services.grafana.provision.alerting.templates.settings.apiVersion | Config file version.
|
| services.outline.googleAuthentication.clientSecretFile | File path containing the authentication secret.
|
| services.kubernetes.apiserver.serviceAccountSigningKeyFile | Path to the file that contains the current private key of the service
account token issuer
|
| networking.wg-quick.interfaces.<name>.peers.*.presharedKeyFile | File pointing to preshared key as generated by wg genpsk
|
| services.limesurvey.nginx.virtualHost.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.akkoma.config.":web_push_encryption".":vapid_details".private_key | base64-encoded private ECDH key
|
| services.prometheus.exporters.ecoflow.ecoflowPasswordFile | Path to the file with your personal ecoflow app login email password
|
| services.stash.settings.preview_segments | Number of segments in a preview file
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.victoriametrics.basicAuthPasswordFile | File that contains the Basic Auth password used to protect VictoriaMetrics instance by authorization
|
| services.veilid.settings.client_api.ipc_directory | IPC directory where file sockets are stored.
|
| services.outline.slackIntegration.verificationTokenFile | File path containing the verification token.
|
| services.kubernetes.controllerManager.serviceAccountKeyFile | Kubernetes controller manager PEM-encoded private RSA key file used to
sign service account tokens
|
| networking.openconnect.interfaces.<name>.passwordFile | File containing the password to authenticate with
|
| services.outline.discordAuthentication.clientSecretFile | File path containing the authentication secret.
|
| services.syncthing.settings.folders.<name>.copyOwnershipFromParent | On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in)
|
| services.opentelemetry-collector.validateConfigFile | Whether to enable Validate configuration file.
|
| services.archisteamfarm.settings | The ASF.json file, all the options are documented here
|
| services.strongswan-swanctl.swanctl.authorities.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.mastodon.activeRecordEncryptionPrimaryKeyFile | This key must be set to enable the Active Record Encryption feature within
Rails that Mastodon uses to encrypt and decrypt some database attributes
|
| services.mautrix-telegram.environmentFile | File containing environment variables to be passed to the mautrix-telegram service,
in which secret tokens can be specified securely by defining values for e.g.
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN,
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN,
MAUTRIX_TELEGRAM_TELEGRAM_API_ID,
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH and optionally
MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN
|
| services.firezone.server.settingsSecret.COOKIE_ENCRYPTION_SALT | A file containing a unique base64 encoded secret for the
COOKIE_ENCRYPTION_SALT
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.prometheus.exporters.junos-czerwonk.environmentFile | File containing env-vars to be substituted into the exporter's config.
|
| services.prometheus.exporters.restic.rcloneConfig | Configuration for the rclone remote being used for backup
|
| services.strongswan-swanctl.swanctl.authorities.<name>.cacert | The certificates may use a relative path from the swanctl
x509ca directory or an absolute path
|
| services.kubernetes.apiserver.authorizationPolicy | Kubernetes apiserver authorization policy file
|
| services.wstunnel.clients.<name>.upgradeCredentials | Use these credentials to authenticate during the HTTP upgrade request
(Basic authorization type, USER:[PASS]).
Passwords specified here will be world-readable in the Nix store!
To pass a password to the service, point the environmentFile option
to a file containing HTTP_PASSWORD=<your-password-here> and set this
option to <user>:$HTTP_PASSWORD
|
| services.prometheus.exporters.tailscale.environmentFile | Environment file containg at least the TAILSCALE_TAILNET,
TAILSCALE_OAUTH_CLIENT_ID, and TAILSCALE_OAUTH_CLIENT_SECRET
environment variables.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.crl_uris | List of CRL distribution points (ldap, http, or file URI)
|
| services.prometheus.exporters.ecoflow.ecoflowDevicesFile | File must contain one line, example: R3300000,R3400000,NC430000,...
|
| services.icingaweb2.authentications | authentication.ini contents
|
| services.postgresql.systemCallFilter.<name>.priority | Set the priority of the system call filter setting
|
| services.nextcloud-spreed-signaling.settings.sessions.hashkeyFile | The path to the file containing the value for sessions.hashkey
|
| services.gitlab.secrets.activeRecordDeterministicKeyFile | A file containing the secret used to encrypt some rails data in a deterministic way
in the DB
|
| security.auditd.settings.space_left | If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by
space_left_action
|
| services.xserver.displayManager.lightdm.greeters.gtk.indicators | List of allowed indicator modules to use for the lightdm gtk
greeter panel
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.round | Optional numeric identifier by which authentication rounds are
sorted
|
| services.nextcloud-spreed-signaling.settings.sessions.blockkeyFile | The path to the file containing the value for sessions.blockkey
|
| services.prometheus.pushgateway.persistence.interval | The minimum interval at which to write out the persistence file.
null will default to 5m.
|
| networking.wireguard.interfaces.<name>.peers.*.presharedKeyFile | File pointing to preshared key as generated by wg genpsk
|
| services.grafana.provision.dashboards.settings.providers.*.options.path | Path grafana will watch for dashboards
|
| services.mautrix-meta.instances.<name>.registrationServiceUnit | The registration service that generates the registration file
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.round | Optional numeric identifier by which authentication rounds are
sorted
|
| services.draupnir.secrets.web.synapseHTTPAntispam.authorization | File containing the secret token when using the Synapse HTTP Antispam module
to be used in place of
services.draupnir.settings.web.synapseHTTPAntispam.authorization
|
| virtualisation.lxd.recommendedSysctlSettings | Enables various settings to avoid common pitfalls when
running containers requiring many file operations
|
| services.authelia.instances.<name>.environmentVariables | Additional environment variables to provide to authelia
|
| services.neo4j.directories.certificates | Directory for storing certificates to be used by Neo4j for
TLS connections
|
| services.prometheus.alertmanagerGotify.environmentFile | File containing additional config environment variables for alertmanager-gotify-bridge
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.postgresqlWalReceiver.receivers.<name>.slot | Require pg_receivewal to use an existing replication slot (see
Section 26.2.6 of the PostgreSQL manual)
|
| services.prometheus.exporters.pgbouncer.connectionEnvFile | File that must contain the environment variable
PGBOUNCER_EXPORTER_CONNECTION_STRING which is set to the connection
string used by pgbouncer
|
| services.headscale.settings.noise.private_key_path | Path to noise private key file, generated automatically if it does not exist.
|
| services.mastodon.activeRecordEncryptionKeyDerivationSaltFile | This key must be set to enable the Active Record Encryption feature within
Rails that Mastodon uses to encrypt and decrypt some database attributes
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.peertube-runner.instancesToRegister.<name>.registrationTokenFile | Path to a file containing a registration token for the PeerTube instance
|
| services.bacula-sd.autochanger.<name>.changerCommand | The name-string specifies an external program to be called that will
automatically change volumes as required by Bacula
|
| programs.openvpn3.log-service.settings.log_dbus_details | Add D-Bus details in log file/syslog
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.api_server | The API server addresses
|
| virtualisation.oci-containers.containers.<name>.login.passwordFile | Path to file containing password.
|
| services.headscale.settings.derp.server.private_key_path | Path to derp private key file, generated automatically if it does not exist.
|
| services.prometheus.exporters.ecoflow.ecoflowDevicesPrettyNamesFile | File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...}
The key/value map of custom names for your devices
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.bacula-sd.device.<name>.mediaType | The specified name-string names the type of media supported by this
device, for example, DLT7000
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPasswordFile | Sets the password for WPA-PSK
|
| services.sshguard.blacklist_threshold | Blacklist an attacker when its score exceeds threshold
|
| services.changedetection-io.environmentFile | Securely pass environment variables to changedetection-io
|
| services.mastodon.activeRecordEncryptionDeterministicKeyFile | This key must be set to enable the Active Record Encryption feature within
Rails that Mastodon uses to encrypt and decrypt some database attributes
|
| services.headscale.settings.oidc.client_secret_path | Path to OpenID Connect client secret file
|
| services.gitlab-runner.services.<name>.registrationConfigFile | Absolute path to a file with environment variables
used for gitlab-runner registration with runner registration
tokens
|
| services.nextcloud-spreed-signaling.settings.clients.internalsecretFile | The path to the file containing the value for clients.internalsecret
|
| services.gitlab-runner.services.<name>.authenticationTokenConfigFile | Absolute path to a file containing environment variables used for
gitlab-runner registrations with runner authentication tokens
|
| services.bitwarden-directory-connector-cli.secrets.bitwarden.client_path_id | Path to file that contains Client ID.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords | Sets allowed passwords for WPA3-SAE
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPassword | Sets the password for WPA-PSK that will be converted to the pre-shared key
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswordsFile | Sets the password for WPA3-SAE
|
| services.multipath.devices.*.user_friendly_names | If set to "yes", using the bindings file /etc/multipath/bindings
to assign a persistent and unique alias to the multipath, in the
form of mpath
|
| services.bitwarden-directory-connector-cli.secrets.bitwarden.client_path_secret | Path to file that contains Client Secret.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.auth | Authentication to expect from remote
|
| services.nixseparatedebuginfod2.substituters | nix substituter to fetch debuginfo from
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.auth | Authentication to perform locally.
- The default
pubkey uses public key authentication
using a private key associated to a usable certificate.
psk uses pre-shared key authentication.
- The IKEv1 specific
xauth is used for XAuth or Hybrid
authentication,
- while the IKEv2 specific
eap keyword defines EAP
authentication.
- For
xauth, a specific backend name may be appended,
separated by a dash
|
| services.buffyboard.settings.quirks.ignore_unused_terminals | If true, buffyboard won't automatically update the layout of a new terminal and
draw the keyboard, if the terminal is not opened by any process
|