| services.atuin.path | A path to prepend to all the routes of the server.
|
| systemd.paths.<name>.pathConfig | Each attribute in this set specifies an option in the
[Path] section of the unit
|
| services.udev.path | Packages added to the PATH environment variable when
executing programs from Udev rules.
coreutils, gnu{sed,grep}, util-linux and config.systemd.package are
automatically included.
|
| services.tftpd.path | Where the tftp server files are stored.
|
| boot.loader.grub.mirroredBoots.*.path | The path to the boot directory where GRUB will be written
|
| services.leaps.path | Subdirectory used for reverse proxy setups
|
| systemd.user.paths.<name>.pathConfig | Each attribute in this set specifies an option in the
[Path] section of the unit
|
| services.public-inbox.path | Additional packages to place in the path of public-inbox-mda,
public-inbox-watch, etc.
|
| services.olivetin.path | Packages added to the service's PATH.
|
| services.gitlab.backup.path | GitLab path for backups.
|
| containers.<name>.path | As an alternative to specifying
config, you can specify the path to
the evaluated NixOS system configuration, typically a
symlink to a system profile.
|
| services.gitwatch.<name>.path | The path to repo in local machine
|
| systemd.services.<name>.path | Packages added to the service's PATH
environment variable
|
| security.dhparams.path | Path to the directory in which Diffie-Hellman parameters will be
stored
|
| systemd.paths | Definition of systemd path units; see systemd.path(5).
|
| services.mediawiki.path | Extra packages to add to the PATH of phpfpm-pool.
|
| services.gitea.database.path | Path to the sqlite3 database file.
|
| systemd.user.services.<name>.path | Packages added to the service's PATH
environment variable
|
| security.auditd.plugins.<name>.path | This is the absolute path to the plugin executable.
|
| security.dhparams.params.<name>.path | The resulting path of the generated Diffie-Hellman parameters
file for other services to reference
|
| services.doh-server.settings.path | HTTP path for resolve application
|
| services.gammu-smsd.device.path | Device node or address of the phone
|
| systemd.user.paths | Definition of systemd per-user path units.
|
| services.forgejo.database.path | Path to the sqlite3 database file.
|
| services.vikunja.database.path | Path to the sqlite3 database file.
|
| services.kubernetes.path | Packages added to the services' PATH environment variable
|
| services.fedimintd.<name>.nginx.path | Path to host the API on and forward to the daemon's api port
|
| services.offlineimap.path | List of derivations to put in Offlineimap's path.
|
| services.multipath.pathGroups | This option allows you to define multipath groups as described
in http://christophe.varoqui.free.fr/usage.html.
|
| services.aria2.settings.conf-path | Configuration file path.
|
| services.thanos.sidecar.tsdb.path | Data directory of TSDB.
|
| services.protonmail-bridge.path | List of derivations to put in protonmail-bridge's path.
|
| services.multipath.pathGroups.*.wwid | The identifier for the multipath device
|
| services.multipath.pathGroups.*.fsType | Type of the filesystem
|
| security.apparmor.policies.<name>.path | A path of a profile file to include
|
| services.hedgedoc.settings.path | Path to UNIX domain socket to listen on
If specified, host and port will be ignored.
|
| services.nbd.server.exports.<name>.path | File or block device to export.
|
| services.multipath.pathGroups.*.alias | The name of the multipath device
|
| services.multipath.pathGroups.*.array | The DNS name of the storage array
|
| services.athens.pathPrefix | Sets basepath for all routes.
|
| services.stash.settings.stash.*.path | location of your media files
|
| services.tor.relay.onionServices.<name>.path | Path where to store the data files of the hidden service
|
| services.rss-bridge.config.FileCache.path | Directory where to store cache files (if cache.type = "file").
|
| boot.initrd.luks.devices.<name>.yubikey.storage.path | Absolute path of the salt on the unencrypted device with
that device's root directory as "/".
|
| boot.initrd.systemd.paths | Definition of systemd path units.
|
| services.frigate.settings.database.path | Path to the SQLite database used
|
| services.multipath.pathGroups.*.options | Options used to mount the file system
|
| services.reposilite.database.path | Path to the embedded database file
|
| services.grafana.settings.database.path | Only applicable to sqlite3 database
|
| services.displayManager.dms-greeter.logs.path | File path where DMS greeter logs will be saved
|
| services.woodpecker-agents.agents.<name>.path | Additional packages that should be added to the agent's PATH
|
| services.headscale.settings.policy.path | If the mode is set to "file", the path to a
HuJSON file containing ACL policies.
|
| services.trafficserver.plugins.*.path | Path to plugin
|
| services.mailcatcher.http.path | Prefix to all HTTP paths.
|
| services.hadoop.hdfs.datanode.dataDirs.*.path | Determines where on the local filesystem a data node should store its blocks.
|
| services.mattermost.socket.path | Default location for the Mattermost control socket used by mmctl.
|
| services.borgbackup.repos.<name>.path | Where to store the backups
|
| services.frigate.settings.ffmpeg.path | Package providing the ffmpeg and ffprobe executables below the bin/ directory.
|
| programs.xfs_quota.projects.<name>.path | Project directory.
|
| virtualisation.xen.boot.bios.path | Path to the Xen multiboot binary used for BIOS booting
|
| virtualisation.xen.store.path | Path to the Xen Store Daemon
|
| services.multipath.devices.*.san_path_err_threshold | If set to a value greater than 0, multipathd will watch paths and check
how many times a path has been failed due to errors
|
| virtualisation.xen.efi.path | Path to xen.efi. pkgs.xen is patched to install the xen.efi file
on $boot/boot/xen.efi, but an unpatched Xen build may install it
somewhere else, such as $out/boot/efi/efi/nixos/xen.efi
|
| services.inadyn.settings.custom.<name>.ddns-path | DDNS server path
|
| services.syncthing.settings.folders.<name>.path | The path to the folder which should be shared
|
| services.multipath.devices.*.path_grouping_policy | The default path grouping policy to apply to unspecified multipaths
|
| services.warpgate.settings.recordings.path | Path to store session recordings.
|
| services.mediatomb.mediaDirectories.*.path | Absolute directory path to the media directory to index.
|
| virtualisation.xen.boot.efi.path | Path to xen.efi. pkgs.xen is patched to install the xen.efi file
on $boot/boot/xen.efi, but an unpatched Xen build may install it
somewhere else, such as $out/boot/efi/efi/nixos/xen.efi
|
| services.grafana-image-renderer.settings.browser.path | Path to the executable of the chromium to use.
|
| services.grafana.provision.alerting.rules.path | Path to YAML rules configuration
|
| services.headscale.settings.database.sqlite.path | Path to the sqlite3 database file.
|
| services.multipath.devices.*.path_selector | The default path selector algorithm to use; they are offered by the kernel multipath target
|
| services.suricata.settings.default-rule-path | Path in which suricata-update managed rules are stored by default.
|
| services.druid.historical.segmentLocations.*.path | the path to store the segments
|
| services.matrix-synapse.settings.listeners.*.path | Unix domain socket path to bind this listener to.
|
| services.grafana.provision.dashboards.path | Path to YAML dashboard configuration
|
| services.multipath.devices.*.san_path_err_recovery_time | If set to a value greater than 0, multipathd will make sure that when
path failures has exceeded the san_path_err_threshold within
san_path_err_forget_rate then the path will be placed in failed state
for san_path_err_recovery_time duration
|
| networking.modemmanager.fccUnlockScripts.*.path | Path to the unlock script
|
| systemd.paths.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.grafana.provision.alerting.muteTimings.path | Path to YAML mute timings configuration
|
| systemd.paths.<name>.wants | Start the specified units when this unit is started.
|
| systemd.paths.<name>.name | The name of this systemd unit, including its extension
|
| services.grafana.provision.datasources.path | Path to YAML datasource configuration
|
| services.gitDaemon.basePath | Remap all the path requests as relative to the given path
|
| boot.loader.generic-extlinux-compatible.mirroredBoots.*.path | The path to the boot directory where the extlinux-compatible
configuration files will be written.
|
| services.grafana.provision.alerting.policies.path | Path to YAML notification policies configuration
|
| networking.supplicant.<name>.configFile.path | External wpa_supplicant.conf configuration file
|
| systemd.paths.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.borgmatic.settings.repositories.*.path | Path to the repository
|
| services.grafana.provision.alerting.contactPoints.path | Path to YAML contact points configuration
|
| services.grafana.provision.alerting.templates.path | Path to YAML templates configuration
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs.*.path | Stream URL
|
| services.multipath.devices.*.path_checker | The default method used to determine the paths state
|
| services.kanidm.serverSettings.online_backup.path | Path to the output directory for backups.
|
| systemd.paths.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.kanidm.server.settings.online_backup.path | Path to the output directory for backups.
|
| services.multipath.devices.*.san_path_err_forget_rate | If set to a value greater than 0, multipathd will check whether the path
failures has exceeded the san_path_err_threshold within this many checks
i.e san_path_err_forget_rate
|
| systemd.user.paths.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.keycloak.settings.http-relative-path | The path relative to / for serving
resources.
In versions of Keycloak using Wildfly (<17),
this defaulted to /auth
|
| systemd.user.paths.<name>.wants | Start the specified units when this unit is started.
|
| systemd.paths.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.paths.<name>.name | The name of this systemd unit, including its extension
|
| services.prometheus.alertmanagerGotify.metrics.path | The path under which the metrics will be exposed.
|
| users.defaultUserShell | This option defines the default shell assigned to user
accounts
|
| systemd.paths.<name>.aliases | Aliases of that unit.
|
| systemd.user.paths.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.multipath.devices.*.prio | The name of the path priority routine
|
| services.angrr.settings.temporary-root-policies.<name>.path-regex | Regex pattern to match the GC root path.
|
| systemd.paths.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.multipath.devices.*.rr_weight | If set to priorities the multipath configurator will assign path weights
as "path prio * rr_min_io".
|
| services.frr.pathd.enable | Whether to enable FRR pathd.
|
| services.fedimintd.<name>.nginx.path_ws | Path to host the API on and forward to the daemon's api port
|
| services.fedimintd.<name>.nginx.path_ui | Path to host the built-in UI on and forward to the daemon's api port
|
| systemd.user.paths.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.icingaweb2.modules.monitoring.transports.<name>.path | Path to the socket for local or remote transports
|
| services.multipath.devices.*.rr_min_io | Number of I/O requests to route to a path before switching to the next in the
same path group
|
| systemd.paths.<name>.upholds | Keeps the specified running while this unit is running
|
| services.borgbackup.jobs.<name>.paths | Path(s) to back up
|
| nixpkgs.flake.source | The path to the nixpkgs sources used to build the system
|
| systemd.user.paths.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.umurmur.settings.ca_path | Path to your SSL CA certificate.
|
| systemd.paths.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.paths.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.paths.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.user.paths.<name>.aliases | Aliases of that unit.
|
| services.frr.pathd.options | Options for the FRR pathd daemon.
|
| services.multipath.devices.*.marginal_path_err_recheck_gap_time | One of the four parameters of supporting path check based on accounting IO error such as intermittent error
|
| boot.initrd.secrets | Secrets to append to the initrd
|
| systemd.user.paths.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.kanidm.serverSettings.db_path | Path to Kanidm database.
|
| services.multipath.devices.*.no_path_retry | Specify what to do when all paths are down
|
| services.mongodb.dbpath | Location where MongoDB stores its files
|
| services.kanidm.server.settings.db_path | Path to Kanidm database.
|
| services.prometheus.pushgateway.web.telemetry-path | Path under which to expose metrics.
null will default to /metrics.
|
| systemd.user.paths.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.paths.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.multipath.devices.*.marginal_path_double_failed_time | One of the four parameters of supporting path check based on accounting IO error such as intermittent error
|
| systemd.user.paths.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.paths.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.user.paths.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.stash.settings.blobs_path | Path to blobs
|
| services.grafana.provision.dashboards.settings.providers.*.options.path | Path grafana will watch for dashboards
|
| systemd.paths.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| systemd.paths.<name>.startLimitBurst | Configure unit start rate limiting
|
| nix.settings.extra-sandbox-paths | Directories from the host filesystem to be included
in the sandbox.
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.path | Unix domain socket path to bind this listener to.
|
| services.borgmatic.configurations.<name>.repositories.*.path | Path to the repository
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| services.multipath.devices.*.failback | Tell multipathd how to manage path group failback
|
| services.chromadb.dbpath | Location where ChromaDB stores its files
|
| services.multipath.devices.*.rr_min_io_rq | Number of I/O requests to route to a path before switching to the next in the
same path group
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| systemd.user.paths.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.frr.pathd.extraOptions | Extra options to be appended to the FRR pathd daemon options.
|
| systemd.paths.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.paths.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| environment.pathsToLink | List of directories to be symlinked in /run/current-system/sw.
|
| nix.nixPath | The default Nix expression search path, used by the Nix
evaluator to look up paths enclosed in angle brackets
(e.g. <nixpkgs>).
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| security.agnos.settings.accounts.*.private_key_path | Path of the PEM-encoded private key for this account
|
| systemd.user.paths.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.user.paths.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.paths.<name>.requisite | Similar to requires
|
| services.gemstash.settings.base_path | Path to store the gem files and the sqlite database
|
| services.multipath.devices.*.marginal_path_err_sample_time | One of the four parameters of supporting path check based on accounting IO error such as intermittent error
|
| systemd.user.paths.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| systemd.user.paths.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.multipath.devices.*.marginal_path_err_rate_threshold | The error rate threshold as a permillage (1/1000)
|
| system.build.toplevel | This option contains the store path that typically represents a NixOS system
|
| services.stash.settings.plugins_path | Path to scrapers
|
| systemd.paths.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| services.multipath.enable | Whether to enable the device mapper multipath (DM-MP) daemon.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| systemd.user.paths.<name>.requisite | Similar to requires
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| services.rethinkdb.dbpath | Location where RethinkDB stores its data, 1 data directory per instance.
|
| services.multipath.devices.*.getuid_callout | (Superseded by uid_attribute) The default program and args to callout
to obtain a unique path identifier
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| services.scrutiny.settings.web.listen.basepath | If Scrutiny will be behind a path prefixed reverse proxy, you can override this
value to serve Scrutiny on a subpath.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| services.multipath.package | The multipath-tools package to use.
|
| services.telepathy.enable | Whether to enable Telepathy service, a communications framework
that enables real-time communication via pluggable protocol backends.
|
| services.rethinkdb.pidpath | Location where each instance's pid file is located.
|
| systemd.paths.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.kanidm.unixSettings.hsm_pin_path | Path to a HSM pin.
|
| systemd.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.multipath.devices | This option allows you to define arrays for use in multipath
groups.
|
| security.isolate.cgRoot | Control group which subgroups are placed under
|
| services.multipath.extraConfig | Lines to append to default multipath.conf
|
| services.ebusd.configpath | Directory to read CSV config files from
|
| services.kanidm.unix.settings.hsm_pin_path | Path to a HSM pin.
|
| systemd.user.paths.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.stash.settings.scrapers_path | Path to scrapers
|
| systemd.paths.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.restic.backups.<name>.paths | Which paths to backup, in addition to ones specified via
dynamicFilesFrom
|
| services.logstash.dataDir | A path to directory writable by logstash that it uses to store data
|
| services.zammad.secretKeyBaseFile | The path to a file containing the
secret_key_base secret
|
| services.castopod.dataDir | The path where castopod stores all data
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| systemd.user.paths.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.paths.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.maubot.settings.server.ui_base_path | The base path for the UI.
|
| services.multipath.extraConfigFile | Append an additional file's contents to /etc/multipath.conf
|
| systemd.user.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.osquery.flags.database_path | Path used for the database file.
If left as the default value, this directory will be automatically created before the
service starts, otherwise you are responsible for ensuring the directory exists with
the appropriate ownership and permissions.
|
| security.doas.extraRules.*.cmd | The command the user is allowed to run
|
| services.dendrite.settings.media_api.base_path | Storage path for uploaded media.
|
| services.thanos.rule.query.sd-files | Path to file that contain addresses of query peers
|
| systemd.user.paths.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.youtrack.statePath | Path were the YouTrack state is stored
|
| image.filePath | Path of the image, relative to $out in system.build.image
|
| services.prometheus.exporters.pve.configFile | Path to the service's config file
|
| services.gancio.settings.log_path | Directory Gancio logs into
|
| services.headscale.settings.tls_key_path | Path to key for already created certificate.
|
| services.multipath.defaults | This section defines default values for attributes which are used
whenever no values are given in the appropriate device or multipath
sections.
|
| services.multipath.devices.*.deferred_remove | If set to "yes", multipathd will do a deferred remove instead of a
regular remove when the last path device has been deleted
|
| services.terraria.worldPath | The path to the world file (.wld) which should be loaded
|
| systemd.user.paths.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.multipath.devices.*.vendor | Regular expression to match the vendor name
|
| nix.buildMachines.*.sshKey | The path to the SSH private key with which to authenticate on
the build machine
|
| services.thanos.query.store.sd-files | Path to files that contain addresses of store API servers
|
| services.multipath.devices.*.uid_attribute | The udev attribute providing a unique path identifier (WWID)
|
| services.multipath.blacklist | This section defines which devices should be excluded from the
multipath topology discovery.
|
| services.authelia.instances.<name>.settings.log.file_path | File path where the logs will be written
|
| boot.loader.grub.font | Path to a TrueType, OpenType, or pf2 font to be used by Grub.
|
| boot.loader.grub.theme | Path to the grub theme to be used.
|
| services.multipath.overrides | This section defines values for attributes that should override the
device-specific settings for all devices.
|
| services.hebbot.botPasswordFile | A path to the password file for your bot
|
| services.immich.database.host | Hostname or address of the postgresql server
|
| services.grafana.settings.database.ca_cert_path | The path to the CA certificate to use.
|
| services.headscale.settings.tls_cert_path | Path to already created certificate.
|
| services.dendrite.settings.sync_api.search.index_path | The path the search index will be created in.
|
| swapDevices.*.device | Path of the device or swap file.
|
| services.multipath.devices.*.product | Regular expression to match the product name
|
| documentation.man.mandoc.settings.manpath | Override the default search path for man(1),
apropos(1), and makewhatis(8)
|
| services.discourse.secretKeyBaseFile | The path to a file containing the
secret_key_base secret
|
| services.grafana.settings.paths.plugins | Directory where grafana will automatically scan and look for plugins
|
| services.prometheus.scrapeConfigs.*.metrics_path | The HTTP resource path on which to fetch metrics from targets
|
| systemd.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.go-camo.sslKey | Path to TLS private key.
|
| fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.supybot.configFile | Path to initial supybot config file
|
| services.multipath.devices.*.max_sectors_kb | Sets the max_sectors_kb device parameter on all path devices and the multipath device to the specified value
|
| services.netdata.configDir | Complete netdata config directory except netdata.conf
|
| services.multipath.devices.*.revision | Regular expression to match the product revision
|
| services.multipath.devices.*.features | Specify any device-mapper features to be used
|
| services.coder.tlsKey | The path to the TLS key.
|
| services.go-camo.sslCert | Path to TLS certificate.
|
| services.yarr.baseUrl | Base path of the service url.
|
| services.headscale.settings.derp.paths | List of file paths containing DERP maps
|
| services.riemann.extraClasspathEntries | Extra entries added to the Java classpath when running Riemann.
|
| boot.loader.grub.mirroredBoots.*.efiSysMountPoint | The path to the efi system mount point
|
| services.prometheus.exporters.pve.environmentFile | Path to the service's environment file
|
| systemd.paths.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.mpd.dbFile | The path to MPD's database
|
| swapDevices.*.size | If this option is set, ‘device’ is interpreted as the
path of a swapfile that will be created automatically
with the indicated size in MiB (1024×1024 bytes).
|
| services.radicle.privateKeyFile | Absolute file path to an SSH private key,
usually generated by rad auth
|
| systemd.user.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.hedgedoc.settings.urlPath | URL path for the website
|
| services.confd.confDir | The path to the confd configs.
|
| services.coder.tlsCert | The path to the TLS certificate.
|
| services.ttyd.certFile | SSL certificate file path.
|
| services.rustus.url | url path for uploads
|
| services.ttyd.caFile | SSL CA file path for client certificate verification.
|
| systemd.mounts.*.what | Absolute path of device node, file or other resource. (Mandatory)
|
| services.dawarich.database.host | Hostname or address of the postgresql server
|
| services.matrix-conduit.settings.global.database_path | Path to the conduit database, the directory where conduit will save its data
|
| services.multipath.devices.*.prio_args | Arguments to pass to to the prio function
|
| services.swapspace.settings.swappath | Location where swapspace may create and delete swapfiles
|
| services.step-ca.intermediatePasswordFile | Path to the file containing the password for the intermediate
certificate private key.
Make sure to use a quoted absolute path instead of a path literal
to prevent it from being copied to the globally readable Nix
store.
|
| services.hydra.logo | Path to a file containing the logo of your Hydra instance.
|
| services.multipath.devices.*.all_tg_pt | Set the 'all targets ports' flag when registering keys with mpathpersist
|
| systemd.user.paths.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.llama-cpp.model | Model path.
|
| services.murmur.sslCa | Path to your SSL CA certificate.
|
| services.ttyd.indexFile | Custom index.html path
|
| services.murmur.sslKey | Path to your SSL key.
|
| services.forgejo.secrets | This is a small wrapper over systemd's LoadCredential
|
| services.i2pd.dataDir | Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)
|
| services.nntp-proxy.sslKey | Proxy ssl key path
|
| services.tox-node.keysFile | Path to the file where DHT keys are stored.
|
| users.users.<name>.cryptHomeLuks | Path to encrypted luks device that contains
the user's home directory.
|
| services.xrdp.sslKey | ssl private key path
A self-signed certificate will be generated if file not exists.
|
| services.osquery.flags.logger_path | Base directory used for logging.
If left as the default value, this directory will be automatically created before the
service starts, otherwise you are responsible for ensuring the directory exists with
the appropriate ownership and permissions.
|
| boot.loader.grub.storePath | Path to the Nix store when looking for kernels at boot
|
| services.cgit.<name>.scanPath | A path which will be scanned for repositories.
|
| services.ttyd.socket | UNIX domain socket path to bind.
|
| services.murmur.sslCert | Path to your SSL certificate.
|
| services.netbox.dataDir | Storage path of netbox.
|
| services.xrdp.sslCert | ssl certificate path
A self-signed certificate will be generated if file not exists.
|
| services.prometheus.exporters.node-cert.paths | List of paths to search for SSL certificates.
|
| services.maubot.settings.server.plugin_base_path | The base path for plugin endpoints
|
| services.matrix-synapse.settings.signing_key_path | Path to the signing key to sign messages with.
|
| services.bosun.ledisDir | Path to bosun's ledis data dir
|
| services.cook-cli.basePath | Path to the directory cook-cli will look for recipes.
|
| services.nntp-proxy.sslCert | Proxy ssl certificate path
|
| services.oink.apiKeyFile | Path to a file containing the API key to use when modifying DNS records.
|
| users.users.<name>.shell | The path to the user's shell
|
| services.k3s.tokenFile | File path containing the k3s token to use when connecting to a server.
|
| users.users.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| systemd.mounts.*.where | Absolute path of a directory of the mount point
|
| services.grafana.settings.database.client_key_path | The path to the client key
|
| programs.nix-required-mounts.allowedPatterns.<name>.paths | A list of glob patterns, indicating which paths to expose to the sandbox
|
| services.grafana.settings.server.static_root_path | Root path for static assets.
|
| services.multipath.devices.*.vpd_vendor | The vendor specific vpd page information, using the vpd page abbreviation
|
| services.sourcehut.settings."hg.sr.ht".hg_ssh | Path to hg-ssh (if not in $PATH).
|
| services.athens.hgrcPath | Path to the .hgrc file.
|
| security.pki.caBundle | (Read-only) the path to the final bundle of certificate authorities as a single file.
|
| services.hound.home | The path to use as hound's $HOME
|
| services.bosun.stateFile | Path to bosun's state file.
|
| services.rke2.tokenFile | File path containing the rke2 token to use when connecting to a server.
|
| services.pgbackrest.repos | An attribute set of repositories as described in:
https://pgbackrest.org/configuration.html#section-repository
Each repository defaults to set repo-host to the attribute's name
|
| services.parsedmarc.settings.elasticsearch.cert_path | The path to a TLS certificate bundle used to verify
the server's certificate.
|
| services.firefly-iii.settings.APP_KEY_FILE | The path to your appkey
|
| services.ocis.configDir | Path to directory containing oCIS config file
|
| services.prometheus.exporters.idrac.configurationPath | Path to the service's config file
|
| services.mautrix-meta.instances.<name>.dataDir | Path to the directory with database, registration, and other data for the bridge service
|
| services.dae.configFile | The path of dae config file, end with .dae.
|
| services.athens.tlsKeyFile | Path to the TLS key file.
|
| services.cfssl.caBundle | Path to root certificate store.
|
| users.mysql.passwordFile | The path to the file containing the password for the user
|
| services.linkwarden.database.host | Hostname or address of the postgresql server
|
| services.gateone.pidDir | Path of pid files for GateOne.
|
| services.davis.nginx.root | The path of the web root directory.
|
| services.cfssl.intBundle | Path to intermediate certificate store.
|
| services.slskd.nginx.root | The path of the web root directory.
|
| services.ttyd.keyFile | SSL key file path
|
| services.movim.nginx.root | The path of the web root directory.
|
| swapDevices | The swap devices and swap files
|
| services.zammad.dataDir | Path to a folder that will contain Zammad working directory.
|
| services.hickory-dns.settings.zones.*.file | Path to the .zone file
|
| swapDevices.*.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| boot.specialFileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.headscale.settings.noise.private_key_path | Path to noise private key file, generated automatically if it does not exist.
|
| services.freeswitch.configDir | Override file in FreeSWITCH config template directory
|
| services.grafana.settings.database.client_cert_path | The path to the client cert
|
| services.multipath.devices.*.flush_on_last_del | If set to "yes" multipathd will disable queueing when the last path to a
device has been deleted.
|
| services.neo4j.directories.home | Path of the Neo4j home directory
|
| services.athens.tlsCertFile | Path to the TLS certificate file.
|
| services.gammu-smsd.log.file | Path to file where information about communication will be stored
|
| services.athens.netrcPath | Path to the .netrc file.
|
| services.dae.assetsPath | The path which contains geolocation database
|
| services.snipe-it.nginx.root | The path of the web root directory.
|
| services.ndppd.configFile | Path to configuration file.
|
| services.prosody.ssl.key | Path to the key file.
|
| services.multipath.devices.*.skip_kpartx | If set to yes, kpartx will not automatically create partitions on the device
|
| services.discourse.admin.passwordFile | A path to a file containing the admin user's password
|
| boot.kernel.sysfs | sysfs attributes to be set as soon as they become available
|
| fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.snapper.configs.<name>.SUBVOLUME | Path of the subvolume or mount point
|
| services.seafile.dataDir | Path in which to store user data
|
| services.murmur.logFile | Path to the log file for Murmur daemon
|
| services.cfssl.dbConfig | Certificate db configuration file
|
| services.i2pd.reseed.file | Full path to SU3 file to reseed from.
|
| security.acme.certs.<name>.csr | Path to a certificate signing request to apply when fetching the certificate.
|
| hardware.alsa.plugins | List of ALSA plugins to be added to the search path.
|
| services.ncps.netrcFile | The path to netrc file for upstream authentication
|
| services.molly-brown.keyPath | Path to TLS key
|
| services.nghttpx.tls.key | Path to the TLS key file.
|
| users.extraUsers.<name>.cryptHomeLuks | Path to encrypted luks device that contains
the user's home directory.
|
| services.zerobin.dataDir | Path to the 0bin data directory
|
| services.nghttpx.tls.crt | Path to the TLS certificate file.
|
| services.yarr.authFilePath | Path to a file containing username:password. null means no authentication required to use the service.
|
| services.multipath.devices.*.ghost_delay | Sets the number of seconds that multipath will wait after creating a device with only ghost paths before marking it ready for use in systemd
|
| services.matrix-continuwuity.settings.global.database_path | Path to the continuwuity database, the directory where continuwuity will save its data
|
| services.gitea.camoHmacKeyFile | Path to a file containing the camo HMAC key.
|
| services.prosody.ssl.cert | Path to the certificate file.
|
| services.xserver.xkb.dir | Path used for -xkbdir xserver parameter.
|
| services.headscale.settings.derp.server.private_key_path | Path to derp private key file, generated automatically if it does not exist.
|
| services.diod.exports | List the file systems that clients will be allowed to mount
|
| services.bacula-sd.tls.key | The path of a PEM encoded TLS private key
|
| security.acme.certs.<name>.csrKey | Path to the private key to the matching certificate signing request.
|
| services.bacula-fd.tls.key | The path of a PEM encoded TLS private key
|
| services.gancio.nginx.root | The path of the web root directory.
|
| services.gns3-server.log.file | Path of the file GNS3 Server should log to.
|
| services.fluidd.nginx.root | The path of the web root directory.
|
| services.akkoma.nginx.root | The path of the web root directory.
|
| services.monica.nginx.root | The path of the web root directory.
|
| services.matomo.nginx.root | The path of the web root directory.
|
| services.marytts.basePath | The base path in which MaryTTS runs.
|
| services.oauth2-proxy.tls.key | Path to private key file.
|
| services.samba-wsdd.listen | Listen on path or localhost port in discovery mode.
|
| services.skydns.etcd.tlsPem | Skydns path of TLS client certificate - public key.
|
| services.tempo.configFile | Specify a path to a configuration file that Tempo should use.
|
| services.skydns.etcd.tlsKey | Skydns path of TLS client certificate - private key.
|
| users.extraUsers.<name>.shell | The path to the user's shell
|
| users.extraUsers.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| services.k3s.configPath | File path containing the k3s YAML config
|
| services.bookstack.settings.APP_KEY_FILE | The path to your appkey
|
| services.matrix-tuwunel.settings.global.unix_socket_path | Listen on a UNIX socket at the specified path
|
| security.pam.oath.usersFile | Set the path to file where the user's credentials are
stored
|
| services.code-server.userDataDir | Path to the user data directory.
|
| services.gitea.dump.backupDir | Path to the dump files.
|
| services.galene.keyFile | Path to the server's private key
|
| services.bacula-dir.tls.key | The path of a PEM encoded TLS private key
|
| services.gollum.stateDir | Specifies the path of the repository directory
|
| services.nginx.sslDhparam | Path to DH parameters file.
|
| services.skydns.etcd.caCert | Skydns path of TLS certificate authority public key.
|
| services.ncps.cache.tempPath | The path to the temporary directory that is used by the cache to download NAR files
|
| services.mptcpd.enable | Whether to enable the Multipath TCP path management daemon.
|
| services.node-red.configFile | Path to the JavaScript configuration file
|
| services.rke2.configPath | File path containing the rke2 YAML config
|
| boot.initrd.compressor | The compressor to use on the initrd image
|
| services.multipath.devices.*.alias_prefix | The user_friendly_names prefix to use for this device type, instead of the default mpath
|
| services.librenms.logDir | Path of the LibreNMS logging directory.
|
| services.jenkins.home | The path to use as JENKINS_HOME
|
| services.galene.certFile | Path to the server's certificate
|
| services.klipper.inputTTY | Path of the virtual printer symlink to create.
|
| services.qui.secretFile | Path to a file that contains the session secret
|
| services.self-deploy.nixFile | Path to nix file in repository
|
| services.slskd.domain | If non-null, enables an nginx reverse proxy virtual host at this FQDN,
at the path configurated with services.slskd.web.url_base.
|
| services.minio.dataDir | The list of data directories or nodes for storing the objects
|
| services.slurm.mpi.PmixCliTmpDirBase | Base path for PMIx temporary files.
|
| services.zwave-js.serialPort | Serial port device path for Z-Wave controller.
|
| services.keycloak.database.passwordFile | The path to a file containing the database password
|
| services.multipath.devices.*.detect_prio | If set to "yes", multipath will try to detect if the device supports
SCSI-3 ALUA
|
| services.graylog.nodeIdFile | Path of the file containing the graylog node-id
|
| services.cfssl.configFile | Path to configuration file
|
| programs.zsh.ohMyZsh.custom | Path to a custom oh-my-zsh package to override config of oh-my-zsh.
(Can't be used along with customPkgs).
|
| programs.rush.shell | The resolved shell path that users can inherit to set rush as their login shell
|
| services.klipper.logFile | Path of the file Klipper should log to
|
| services.uptermd.hostKey | Path to SSH host key
|
| users.ldap.bind.passwordFile | The path to a file containing the credentials to use when binding
to the LDAP server (if not binding anonymously).
|
| services.angrr.settings.profile-policies.<name>.profile-paths | Paths to the Nix profile
|
| services.librenms.dataDir | Path of the LibreNMS state directory.
|
| hardware.pcmcia.config | Path to the configuration file which maps the memory, IRQs
and ports used by the PCMCIA hardware.
|
| services.gatus.configFile | Path to the Gatus configuration file
|
| services.code-server.socket | Path to a socket (bind-addr will be ignored).
|
| services.self-deploy.sshKeyFile | Path to SSH private key used to fetch private repositories over
SSH.
|
| services.opengfw.rulesFile | Path to file containing OpenGFW rules.
|
| services.grafana.settings.paths.provisioning | Folder that contains provisioning config files that grafana will apply on startup and while running
|
| services.varnish.listen.*.address | If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").
(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
followed by the name of an abstract socket ("@myvarnishd") accept connections
on a Unix domain socket
|
| services.bitwarden-directory-connector-cli.secrets.bitwarden.client_path_secret | Path to file that contains Client Secret.
|
| services.headscale.settings.oidc.client_secret_path | Path to OpenID Connect client secret file
|
| services.quorum.nodekeyFile | Path to the nodekey.
|
| console.font | The font used for the virtual consoles
|
| services.klipper.apiSocket | Path of the API socket to create.
|
| services.bird-lg.proxy.birdSocket | Bird control socket path.
|
| services.dovecot2.sslCACert | Path to the server's CA certificate key.
|
| services.klipper.configDir | Path to Klipper config file.
|
| services.llama-swap.tls.keyFile | Path to the TLS private key file
|
| services.munge.password | The path to a daemon's secret key.
|
| services.nginx.proxyCachePath | Configure a proxy cache path entry
|
| services.llama-swap.tls.certFile | Path to the TLS certificate file
|
| services.netbox.secretKeyFile | Path to a file containing the secret key.
|
| services.slurm.controlAddr | Name that ControlMachine should be referred to in establishing a
communications path.
|
| services.oink.secretApiKeyFile | Path to a file containing the secret API key to use when modifying DNS records.
|
| services.soju.configFile | Path to config file
|
| services.v2ray.configFile | The absolute path to the configuration file
|
| services.bitwarden-directory-connector-cli.secrets.bitwarden.client_path_id | Path to file that contains Client ID.
|
| services.neo4j.ssl.policies.<name>.revokedDir | Path to directory of CRLs (Certificate Revocation Lists) in
PEM format
|
| services.duckdns.tokenFile | The path to a file containing the token
used to authenticate with DuckDNS.
|
| services.terraria.dataDir | Path to variable state data directory for terraria.
|
| services.sogo.ealarmsCredFile | Optional path to a credentials file for email alarms
|
| services.pangolin.dataDir | Path to variable state data directory for Pangolin.
|
| services.stash.jwtSecretKeyFile | Path to file containing a secret used to sign JWT tokens.
|
| services.borgbackup.repos.<name>.allowSubRepos | Allow clients to create repositories in subdirectories of the
specified path
|
| services.artalk.configFile | Artalk config file path
|
| services.gitea.minioAccessKeyId | Path to a file containing the Minio access key id.
|
| boot.initrd.systemd.users.<name>.shell | The path to the user's shell in initrd.
|
| services.dnsmasq.configFile | Path to the configuration file of dnsmasq.
|
| services.erigon.secretJwtPath | Path to the secret jwt used for the http api authentication.
|
| services.getty.loginProgram | Path to the login binary executed by agetty.
|
| services.klipper.configFile | Path to default Klipper config.
|
| programs.less.configFile | Path to lesskey configuration file.
configFile takes precedence over commands,
clearDefaultCommands, lineEditingKeys, and
envVariables.
|
| services.portunus.stateDir | Path where Portunus stores its state.
|
| services.terraria.banListPath | The path to the ban list.
|
| services.mailman.restApiPassFile | Path to the file containing the value for MAILMAN_REST_API_PASS.
|
| environment.homeBinInPath | Include ~/bin/ in $PATH.
|
| services.calibre-web.dataDir | Where Calibre-Web stores its data
|
| services.corerad.configFile | Path to CoreRAD TOML configuration file.
|
| services.public-inbox.nntp.key | Path to TLS key to use for connections to public-inbox-nntpd(1).
|
| services.nextcloud.home | Storage path of nextcloud.
|
| services.rshim.index | Specify the index to create device path /dev/rshim<index>
|
| services.public-inbox.imap.key | Path to TLS key to use for connections to public-inbox-imapd(1).
|
| services.solanum.motd | Solanum MOTD text
|
| services.lasuite-meet.bind | The path, host/port or file descriptior to bind the gunicorn socket to
|
| services.lasuite-docs.bind | The path, host/port or file descriptior to bind the gunicorn socket to
|
| services.webdav.configFile | Path to config file
|
| services.webhook.urlPrefix | The URL path prefix to use for served hooks (protocol://yourserver:port/${prefix}/hook-id).
|
| containers.<name>.flake | The Flake URI of the NixOS configuration to use for the container
|
| services.tor.relay.onionServices | See torrc manual.
Because tor.service runs in its own RootDirectory=,
when using a onion service to reverse-proxy to a Unix socket,
you need to make that Unix socket available
within the mount namespace of tor.service
|
| services.pingvin-share.dataDir | The path to the data directory in which Pingvin Share will store its data.
|
| boot.initrd.luks.devices.<name>.device | Path of the underlying encrypted block device.
|
| services.gns3-server.ssl.certFile | Path to the SSL certificate file
|
| services.knot.enableXDP | Extends the systemd unit with permissions to allow for the use of
the eXpress Data Path (XDP).
Make sure to read up on functional limitations
when running in XDP mode.
|
| programs.dms-shell.plugins.<name>.src | Source of the plugin package or path
|
| services.jenkinsSlave.home | The path to use as JENKINS_HOME
|
| services.atalkd.configFile | Optional path to a custom atalkd.conf file
|
| services.conman.configFile | The absolute path to the configuration file
|
| services.nipap.nipap-www.unixSocket | Path to UNIX socket to bind to.
|
| services.snmpd.configFile | Path to the snmpd.conf file
|
| services.k3s.agentTokenFile | File path containing the k3s token agents can use to connect to the server
|
| services.cyrus-imap.cyrusConfigFile | Path to the configuration file used for Cyrus.
|
| services.bluesky-pds.goat.enable | Add goat to PATH
|
| services.incron.enable | Whether to enable the incron daemon
|
| services.i2pd.reseed.zipfile | Path to local .zip file to reseed from.
|
| services.darkhttpd.rootDir | Path from which to serve files.
|
| services.nagios.plugins | Packages to be added to the Nagios PATH
|
| services.rspamd.localLuaRules | Path of file to link to /etc/rspamd/rspamd.local.lua for local
rules written in Lua
|
| services.rutorrent.dataDir | Storage path of ruTorrent.
|
| services.public-inbox.imap.cert | Path to TLS certificate to use for connections to public-inbox-imapd(1).
|
| services.public-inbox.nntp.cert | Path to TLS certificate to use for connections to public-inbox-nntpd(1).
|
| services.rtorrent.rpcSocket | RPC socket path.
|
| services.rke2.agentTokenFile | File path containing the rke2 token agents can use to connect to the server
|
| programs.uwsm.waylandCompositors.<name>.binPath | The wayland-compositor binary path that will be called by UWSM
|
| services.neo4j.ssl.policies.<name>.trustedDir | Path to directory of X.509 certificates in PEM format for
trusted parties
|
| security.dhparams.params | Diffie-Hellman parameters to generate
|
| services.ceph.global.mgrModulePath | Path at which to find ceph-mgr modules.
|
| services.disnix.profiles | Names of the Disnix profiles to expose in the system's PATH
|
| services.bluemap.maps.<name>.world | Path to world folder containing the dimension to render
|
| services.cyrus-imap.imapdConfigFile | Path to the configuration file used for cyrus-imap.
|
| services.dolibarr.nginx.root | The path of the web root directory.
|
| services.gocd-agent.packages | Packages to add to PATH for the Go
|
| power.ups.users.<name>.passwordFile | The full path to a file that contains the user's (clear text)
password
|
| services.fediwall.nginx.root | The path of the web root directory.
|
| services.agorakit.nginx.root | The path of the web root directory.
|
| services.librenms.nginx.root | The path of the web root directory.
|
| services.ceph.global.rgwMimeTypesFile | Path to mime types used by radosgw.
|
| programs.command-not-found.dbPath | Absolute path to programs.sqlite
|
| services.kanboard.nginx.root | The path of the web root directory.
|
| services.athens.unixSocket | Path to the unix socket file
|
| services.pixelfed.nginx.root | The path of the web root directory.
|
| services.mainsail.nginx.root | The path of the web root directory.
|
| services.syncplay.motdFile | Path to text to display when users join
|
| services.monero.banlist | Path to a text file containing IPs to block
|
| services.sickbeard.dataDir | Path where to store data files.
|
| services.nsd.keys.<name>.keyFile | Path to the file which contains the actual base64 encoded
key
|
| services.xserver.modules | Packages to be added to the module search path of the X server.
|
| services.redmine.components.minimagick_font_path | MiniMagick font path
|
| systemd.watchdog.device | The path to a hardware watchdog device which will be managed by systemd
|
| services.angrr.configFile | Path to the angrr configuration file in TOML format
|
| services.dovecot2.sslServerKey | Path to the server's private key.
|
| services.beszel.agent.extraPath | Extra packages to add to beszel path (such as nvidia-smi or rocm-smi).
|
| services.gitea.metricsTokenFile | Path to a file containing the metrics authentication token.
|
| boot.initrd.systemd.storePaths.*.target | Path of the symlink.
|
| services.datadog-agent.apiKeyFile | Path to a file containing the Datadog API key to associate the
agent with your account.
|
| environment.localBinInPath | Add ~/.local/bin/ to $PATH
|
| services.syncthing.dataDir | The path where synchronised directories will exist.
|
| services.syncthing.key | Path to the key.pem file, which will be copied into Syncthing's
configDir.
|
| services.sftpgo.loadDataFile | Path to a json file containing users and folders to load (or update) on startup
|
| services.uhub.<name>.plugins.*.plugin | Path to plugin file.
|
| services.oxidized.routerDB | Path to the file/database which contains the targets for oxidized.
|
| services.portunus.seedPath | Path to a portunus seed file in json format
|
| services.stash.settings.cache | Path to cache
|
| services.wiki-js.settings.db.host | Hostname or socket-path to connect to.
|
| services.beesd.filesystems.<name>.spec | Description of how to identify the filesystem to be duplicated by this
instance of bees
|
| services.multipath.devices.*.dev_loss_tmo | Specify the number of seconds the SCSI layer will wait after a problem has
been detected on a FC remote port before removing it from the system
|
| services.alloy.configPath | Alloy configuration file/directory path
|
| services.kubernetes.pki.etcClusterAdminKubeconfig | Symlink a kubeconfig with cluster-admin privileges to environment path
(/etc/<path>).
|
| services.pds.pdsadmin.enable | Add pdsadmin script to PATH
|
| services.gotenberg.rootPath | Root path for the Gotenberg API.
|
| services.asusd.asusdConfig.source | Path of the source file.
|
| services.dspam.domainSocket | Path to local domain socket which is used for communication with the daemon
|
| services.asusd.animeConfig.source | Path of the source file.
|
| services.honk.passwordFile | Password for admin account
|
| security.wrappers.<name>.source | The absolute path to the program to be wrapped.
|
| services.forgejo.dump.backupDir | Path to the directory where the dump archives will be stored.
|
| services.iperf3.rsaPrivateKey | Path to the RSA private key (not password-protected) used to decrypt authentication credentials from the client.
|
| boot.initrd.systemd.storePaths.*.source | Path of the source file.
|
| services.envfs.enable | Fuse filesystem that returns symlinks to executables based on the PATH
of the requesting process
|
| services.sabnzbd.configFile | Path to config file (deprecated, use settings instead and set this value to null)
|
| services.radicle.publicKey | An SSH public key (as an absolute file path or directly as a string),
usually generated by rad auth.
|
| services.paisa.settings.dataDir | Path to paisa data directory.
|
| services.oauth2-proxy.proxyPrefix | The url root path that this proxy should be nested under.
|
| services.opendkim.keyPath | The path that opendkim should put its generated private keys into
|
| services.outline.sslKeyFile | File path that contains the Base64-encoded private key for HTTPS
termination
|
| services.nitter.server.staticDir | Path to the static files directory.
|
| services.oxidized.configFile | Path to the oxidized configuration file.
|
| services.xray.settingsFile | The absolute path to the configuration file
|
| security.tpm2.pkcs11.enable | Whether to enable TPM2 PKCS#11 tool and shared library in system path
(/run/current-system/sw/lib/libtpm2_pkcs11.so)
.
|
| services.dendrite.tlsKey | The path to the TLS key.
nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
|
| services.hadoop.hdfs.httpfs.tempPath | HTTPFS_TEMP path used by HTTPFS
|
| services.libinput.mouse.dev | Path for mouse device
|
| services.harmonia.signKeyPath | DEPRECATED: Use services.harmonia.signKeyPaths instead
|
| hardware.deviceTree.dtbSource | Path to dtb directory that overlays and other processing will be applied to
|
| services.dovecot2.sslServerCert | Path to the server's public key.
|
| services.outline.sslCertFile | File path that contains the Base64-encoded certificate for HTTPS
termination
|
| services.rspamd.locals.<name>.source | Path of the source file.
|
| services.syncthing.cert | Path to the cert.pem file, which will be copied into Syncthing's
configDir.
|
| services.oauth2-proxy.keyFile | oauth2-proxy allows passing sensitive configuration via environment variables
|
| services.ncps.cache.secretKeyPath | The path to load the secretKey for signing narinfos
|
| services.routedns.configFile | Path to RouteDNS TOML configuration file.
|
| services.radicle.httpd.nginx.root | The path of the web root directory.
|
| services.lk-jwt-service.keyFile | Path to a file containing the credential mapping (<keyname>: <secret>) to access LiveKit
|
| services.stash.sessionStoreKeyFile | Path to file containing a secret for session store.
|
| services.matrix-continuwuity.settings.global.unix_socket_path | Listen on a UNIX socket at the specified path
|
| programs.ssh.setXAuthLocation | Whether to set the path to xauth for X11-forwarded connections
|
| services.jenkins.packages | Packages to add to PATH for the jenkins process.
|
| services.cfdyndns.apiTokenFile | The path to a file containing the API Token
used to authenticate with CloudFlare.
|
| services.gocd-server.packages | Packages to add to PATH for the Go
|
| services.unpoller.loki.pass | Path of a file containing the password for Loki
|
| services.netbox.ldapConfigPath | Path to the Configuration-File for LDAP-Authentication, will be loaded as ldap_config.py
|
| services.snapserver.streams.<name>.location | For type pipe or file, the path to the pipe or file
|
| services.multipath.devices.*.detect_checker | If set to "yes", multipath will try to detect if the device supports
SCSI-3 ALUA
|
| services.gateone.settingsDir | Path of configuration files for GateOne.
|
| services.dendrite.tlsCert | The path to the TLS certificate.
nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
|
| services.anuko-time-tracker.nginx.root | The path of the web root directory.
|
| services.devpi-server.secretFile | Path to a shared secret file used for synchronization,
Required for all nodes in a replica/primary setup.
|
| environment.etc.<name>.source | Path of the source file.
|
| hardware.sata.timeout.drives.*.name | Drive name without the full path.
|
| services.stargazer.store | Path to the certificate store on disk
|
| services.pomerium.configFile | Path to Pomerium config YAML
|
| services.molly-brown.certPath | Path to TLS certificate
|
| services.sshwifty.sharedKeyFile | Path to a file containing the shared key.
|
| services.traefik.static.file | Path to Traefik's static configuration file.
|
| services.nomad.extraPackages | Extra packages to add to PATH for the Nomad agent process.
|
| services.opengfw.pcapReplay | Path to PCAP replay file
|
| services.sympa.database.name | Database name
|
| services.nginx.virtualHosts.<name>.root | The path of the web root directory.
|
| services.nebula.networks.<name>.ca | Path to the certificate authority certificate.
|
| services.zitadel.masterKeyFile | Path to a file containing a master encryption key for ZITADEL
|
| services.stash.passwordFile | Path to file containing password for login.
|
| containers.<name>.networkNamespace | Takes the path to a file representing a kernel network namespace that the container
shall run in
|
| services.simplesamlphp.<name>.settings.baseurlpath | URL where SimpleSAMLphp can be reached.
|
| security.wrappers | This option effectively allows adding setuid/setgid bits, capabilities,
changing file ownership and permissions of a program without directly
modifying it
|
| services.etebase-server.unixSocket | The path to the socket to bind to.
|
| services.cfdyndns.apikeyFile | The path to a file containing the API Key
used to authenticate with CloudFlare.
|
| services.db-rest.redis.passwordFile | Path to a file containing the redis password.
|
| services.gitea.minioSecretAccessKey | Path to a file containing the Minio secret access key.
|
| boot.initrd.luks.devices.<name>.gpgCard.publicKey | Path to the Public Key.
|
| services.openssh.hostKeys | NixOS can automatically generate SSH host keys
|
| services.osquery.flags.pidfile | Path used for pid file.
|
| services.nezha-agent.clientSecretFile | Path to the file contained the client_secret of the dashboard.
|
| services.mpd.settings.db_file | The path to MPD's database.
|
| services.nebula.networks.<name>.key | Path or reference to the host key.
|
| services.syncplay.statsDBFile | Path to SQLite database file to store stats
|
| services.kea.dhcp6.configFile | Kea DHCP6 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html
|
| services.kea.dhcp4.configFile | Kea DHCP4 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html
|
| services.xserver.windowManager.xmonad.config | Configuration from which XMonad gets compiled
|
| services.peertube.settings.video_transcription.engine_path | Custom engine path for local transcription.
|
| services.gitea.captcha.secretFile | Path to a file containing the CAPTCHA secret key.
|
| services.bitcoind.<name>.configFile | The configuration file path to supply bitcoind.
|
| services.ddclient.configFile | Path to configuration file
|
| services.bookstack.nginx.root | The path of the web root directory.
|
| services.syncplay.roomsDBFile | Path to SQLite database file to store room states
|
| services.rutorrent.rpcSocket | Path to rtorrent rpc socket.
|
| services.openssh.moduliFile | Path to moduli file to install in
/etc/ssh/moduli
|
| services.nebula.networks.<name>.cert | Path to the host certificate.
|
| services.siproxd.passwordFile | Path to per-user password file.
|
| services.asusd.auraConfigs.<name>.source | Path of the source file.
|
| services.coturn.static-auth-secret-file | Path to the file containing the static authentication secret.
|
| programs.neovim.runtime.<name>.source | Path of the source file.
|
| services.chisel-server.authfile | Path to auth.json file
|
| services.asusd.fanCurvesConfig.source | Path of the source file.
|
| services.gitlab.registry.keyFile | Path to GitLab container registry certificate-key.
|
| services.asusd.userLedModesConfig.source | Path of the source file.
|
| services.headphones.dataDir | Path where to store data files.
|
| services.promtail.configFile | Config file path for Promtail
|
| services.pixiecore.initrd | Initrd path
|
| services.pixiecore.kernel | Kernel path
|
| services.suwayomi-server.dataDir | The path to the data directory in which Suwayomi-Server will download scans.
|
| services.redis.servers.<name>.unixSocket | The path to the socket to bind to.
|
| services.sickbeard.configFile | Path to config file.
|
| services.trickster.configFile | Path to configuration file.
|
| services.prosody.extraPluginPaths | Additional path in which to look find plugins/modules
|
| services.phpfpm.pools.<name>.socket | Path to the unix socket file on which to accept FastCGI requests.
This option is read-only and managed by NixOS.
|
| services.opengfw.settingsFile | Path to file containing OpenGFW settings.
|
| systemd.automounts.*.where | Absolute path of a directory of the mount point
|
| services.xandikos.routePrefix | Path to Xandikos
|
| services.wakapi.passwordSaltFile | The path to a file containing the password salt to use for Wakapi.
|
| services.jigasi.userPasswordFile | Path to file containing password for XMPP user connection.
|
| services.bonsaid.configFile | Path to a .json file specifying the state transitions
|
| services.gitea.settings.log.ROOT_PATH | Root path for log files.
|
| services.jicofo.userPasswordFile | Path to file containing password for XMPP user connection.
|
| services.gitea.database.socket | Path to the unix socket file to use for authentication.
|
| services.gitlab.registry.certFile | Path to GitLab container registry certificate.
|
| services.headscale.configFile | Path to the configuration file of headscale.
|
| services.nginx.proxyCachePath.<name>.enable | Whether to enable this proxy cache path entry.
|
| services.ncdns.dnssec.keys.private | Path to the file containing the KSK private key.
|
| services.kea.dhcp-ddns.configFile | Kea DHCP-DDNS configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html
|
| services.slurm.extraConfigPaths | Slurm expects config files for plugins in the same path
as slurm.conf
|
| services.maubot.settings.server.override_resource_path | Override path from where to load UI resources.
|
| services.pid-fan-controller.settings.heatSources.*.wildcardPath | Path of the heat source's hwmon temp_input file
|
| services.postsrsd.socketPath | Path to the Unix socket for connecting to postsrsd
|
| services.charybdis.motd | Charybdis MOTD text
|
| services.wakapi.smtpPasswordFile | The path to a file containing the password for the smtp mailer used by Wakapi.
|
| services.froide-govplan.secretKeyFile | Path to a file containing the secret key.
|
| services.librechat.dataDir | Absolute path for where the LibreChat server will use as its data directory to store logs, user uploads, and generated images.
|
| hardware.facter.reportPath | Path to a hardware report generated by nixos-facter
|
| services.gitea.mailerPasswordFile | Path to a file containing the SMTP password.
|
| services.duckdns.domainsFile | The path to a file containing a
newline-separated list of DuckDNS
domain(s) to be updated
(without the .duckdns.org suffix)
|
| fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.httpd.extraModules | Additional Apache modules to be used
|
| services.disnix.enableProfilePath | Whether to enable exposing the Disnix profiles in the system's PATH.
|
| services.davis.adminPasswordFile | The full path to a file that contains the admin's password
|
| services.bepasty.servers.<name>.dataDir | Path to the directory where the pastes will be saved to
|
| boot.swraid.enable | Whether to enable support for Linux MD RAID arrays
|
| services.pihole-ftl.logDirectory | Path for Pi-hole log files
|
| services.surrealdb.dbPath | The path that surrealdb will write data to
|
| services.mycelium.keyFile | Optional path to a file containing the mycelium key material
|
| services.nohang.configPath | Configuration file to use with nohang
|
| services.syslog-ng.extraModulePaths | A list of paths that should be included in syslog-ng's
--module-path option
|
| services.journald.remote.settings.Remote.ServerKeyFile | A path to a SSL secret key file in PEM format
|
| services.thanos.rule.alertmanagers.urls | Alertmanager replica URLs to push firing alerts
|
| programs.river.package | The river package to use
|
| services.asusd.profileConfig.source | Path of the source file.
|
| security.apparmor.packages | List of packages to be added to AppArmor's include path
|
| services.hledger-web.stateDir | Path the service has access to
|
| services.movim.h2o.tls.identity.*.key-file | Path to key file
|
| services.oauth2-proxy.clientSecretFile | The path to a file containing the OAuth Client Secret.
|
| services.lubelogger.dataDir | Path to LubeLogger config and metadata inside of /var/lib/.
|
| services.szurubooru.dataDir | The path to the data directory in which Szurubooru will store its data.
|
| services.traefik.dynamic.file | Path to Traefik's dynamic configuration file.
You cannot use this option alongside the declarative configuration options.
|
| services.jirafeau.nginxConfig.root | The path of the web root directory.
|
| containers.<name>.bindMounts.<name>.hostPath | Location of the host path to be mounted.
|
| services.webdav-server-rs.configFile | Path to config file
|
| services.xinetd.services.*.server | Path of the program that implements the service.
|
| system.preSwitchChecks | A set of shell script fragments that are executed before the switch to a
new NixOS system configuration
|
| programs.k3b.enable | Whether to enable k3b, the KDE disk burning application
|
| services.multipath.devices.*.hardware_handler | The hardware handler to use for this device type
|
| services.i2pd.reseed.floodfill | Path to router info of floodfill to reseed from.
|
| services.ergochat.configFile | Path to configuration file
|
| services.chhoto-url.settings.db_url | The path of the sqlite database.
|
| services.code-server.extraPackages | Additional packages to add to the code-server PATH.
|
| services.gitea.repositoryRoot | Path to the git repositories.
|
| services.athens.storage.mongo.certPath | Path to the certificate file for the mongo database.
|
| services.outline.utilsSecretFile | File path that contains the utility secret key
|
| services.mackerel-agent.apiKeyFile | Path to file containing the Mackerel API key
|
| services.podgrab.passwordFile | The path to a file containing the PASSWORD environment variable
definition for Podgrab's authentication.
|
| services.mailman.serve.virtualRoot | Path to mount the mailman-web django application on.
|
| services.waagent.extraPackages | Additional packages to add to the waagent PATH.
|
| xdg.portal.extraPortals | List of additional portals to add to path
|
| services.kea.ctrl-agent.configFile | Kea Control Agent configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html
|
| services.oauth2-proxy.upstream | The http url(s) of the upstream endpoint or file://
paths for static files
|
| services.traefik.staticConfigFile | Path to traefik's static configuration to use.
(Using that option has precedence over staticConfigOptions and dynamicConfigOptions)
|
| services.ente.api.settings | Museum yaml configuration
|
| boot.initrd.systemd.contents.<name>.target | Path of the symlink.
|
| hardware.deviceTree.overlays.*.dtboFile | Path to .dtbo compiled overlay file.
|
| services.airsonic.contextPath | The context path, i.e., the last part of the Airsonic
URL
|
| services.subsonic.contextPath | The context path, i.e., the last part of the Subsonic
URL
|
| services.outline.secretKeyFile | File path that contains the application secret key
|
| services.moodle.database.socket | Path to the unix socket file to use for authentication.
|
| services.ncdns.dnssec.keys.zonePrivate | Path to the file containing the ZSK private key.
|
| services.rkvm.server.settings.key | TLS key path.
This should be generated with rkvm-certificate-gen.
|
| services.mirakurun.unixSocket | Path to unix socket to listen on
|
| services.k3s.manifests.<name>.source | Path of the source .yaml file.
|
| systemd.shutdownRamfs.storePaths.*.target | Path of the symlink.
|
| services.zabbixWeb.nginx.virtualHost.root | The path of the web root directory.
|
| services.matrix-synapse.settings.media_store_path | Directory where uploaded images and attachments are stored.
|
| services.jupyter.kernels.<name>.logo64 | Path to 64x64 logo png.
|
| services.cross-seed.settingsFile | Path to a JSON file containing settings that will be merged with the
settings option
|
| boot.loader.external.installHook | The full path to a program of your choosing which performs the bootloader installation process
|
| services.jupyter.kernels.<name>.logo32 | Path to 32x32 logo png.
|
| boot.initrd.systemd.contents.<name>.source | Path of the source file.
|
| services.hound.settings | The full configuration of the Hound daemon
|
| services.pihole-ftl.stateDirectory | Path for pihole state files.
|
| services.nix-serve.secretKeyFile | The path to the file used for signing derivation data
|
| services.moodle.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.nagios.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.pairdrop.rtcConfig | Configuration for STUN/TURN servers
|
| services.outline.smtp.passwordFile | File path containing the password to authenticate with.
|
| services.minetest-server.logPath | Path to logfile for logging
|
| services.sympa.settingsFile.<name>.source | Path of the source file.
|
| services.oauth2-proxy.cookie.secretFile | The path to a file containing the seed string for secure cookies.
|
| services.tailscaleAuth.socketPath | Path of the socket listening to authorization requests.
|
| services.rke2.manifests.<name>.source | Path of the source .yaml file.
|
| systemd.shutdownRamfs.storePaths.*.source | Path of the source file.
|
| services.matrix-synapse.configFile | Path to the configuration file on the target system
|
| virtualisation.fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.snapserver.http.docRoot | Path to serve from the HTTP servers root.
|
| programs.xwayland.defaultFontPath | Default font path
|
| services.actual.settings | Server settings, refer to the documentation for available options
|
| services.hickory-dns.configFile | Path to an existing toml file to configure hickory-dns with
|
| services.bepasty.servers.<name>.workDir | Path to the working directory (used for config and pidfile)
|
| services.h2o.hosts.<name>.tls.identity.*.key-file | Path to key file
|
| fileSystems.<name>.device | The device as passed to mount
|
| services.hadoop.hdfs.datanode.dataDirs | Tier and path definitions for datanode storage.
|
| services.komodo-periphery.ssl.keyFile | Path to SSL key file.
|
| services.paperless.manage | The package derivation for the paperless-manage wrapper script
|
| services.patroni.namespace | Path within the configuration store where Patroni will keep information about the cluster.
|
| services.syncthing.configDir | The path where the settings and keys will exist.
|
| services.transfer-sh.secretFile | Path to file containing environment variables
|
| services.nagios.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.pretix.settings.tools.pdftk | Path to the pdftk executable.
|
| services.peering-manager.secretKeyFile | Path to a file containing the secret key.
|
| services.moodle.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.prosody.virtualHosts.<name>.ssl.key | Path to the key file.
|
| services.thanos.rule.web.route-prefix | Prefix for API and UI endpoints
|
| services.zabbixWeb.database.socket | Path to the unix socket file to use for authentication.
|
| services.postsrsd.secretsFile | Secret keys used for signing and verification.
The secret will be generated, if it does not exist at the given path.
|
| services.lasuite-docs.settings.DATA_DIR | Path to the data directory
|
| hardware.sensor.hddtemp.drives | List of drives to monitor
|
| services.freeradius.configDir | The path of the freeradius server configuration directory.
|
| services.athens.storage.s3.forcePathStyle | Force path style for the S3 storage backend.
|
| services.headphones.configFile | Path to config file.
|
| services.tahoe.nodes.<name>.sftpd.hostPublicKeyFile | Path to the SSH host public key.
|
| services.nipap.nipap-www.xmlrpcURIFile | Path to file containing XMLRPC URI for use by web UI - this is a secret, since it contains auth credentials
|
| services.syncplay.saltFile | Path to the file that contains the server salt
|
| containers.<name>.bindMounts.<name>.isReadOnly | Determine whether the mounted path will be accessed in read-only mode.
|
| services.zitadel.settings.TLS.KeyPath | Path to the TLS certificate private key.
|
| services.zitadel.settings.TLS.CertPath | Path to the TLS certificate.
|
| documentation.man.mandoc.settings.output.includes | A string of relative path used as a template for the output path of
linked header files (usually via the In macro) in HTML output
|
| services.traefik.dynamicConfigFile | Path to traefik's dynamic configuration to use.
(Using that option has precedence over dynamicConfigOptions)
|
| services.komodo-periphery.ssl.certFile | Path to SSL certificate file.
|
| services.httpd.virtualHosts.<name>.sslServerKey | Path to server SSL certificate key.
|
| services.bacula-sd.director.<name>.tls.key | The path of a PEM encoded TLS private key
|
| services.immich-kiosk.settings | Configuration for immich-kiosk
|
| hardware.deviceTree.overlays.*.dtsFile | Path to .dts overlay file, overlay is applied to
each .dtb file matching "compatible" of the overlay.
|
| services.bacula-fd.director.<name>.tls.key | The path of a PEM encoded TLS private key
|
| services.rustus.storage.data_dir | path to the local directory where all files are stored
|
| services.outline.storage.forcePathStyle | Force S3 path style.
|
| services.prosody.virtualHosts.<name>.ssl.cert | Path to the certificate file.
|
| services.phylactery.library | Path to CBZ library
|
| services.soju.tlsCertificate | Path to server TLS certificate.
|
| services.pomerium.secretsFile | Path to file containing secrets for Pomerium, in systemd
EnvironmentFile format
|
| services.stash.settings.database | Path to the SQLite database
|
| services.multipath.devices.*.fast_io_fail_tmo | Specify the number of seconds the SCSI layer will wait after a problem has been
detected on a FC remote port before failing I/O to devices on that remote port
|
| services.multipath.devices.*.delay_wait_checks | This option is deprecated, and mapped to san_path_err_recovery_time
|
| services.forgejo.database.socket | Path to the unix socket file to use for authentication.
|
| services.gokapi.settingsFile | Path to config file to parse and append to settings
|
| services.libinput.touchpad.dev | Path for touchpad device
|
| services.fedimintd.<name>.dataDir | Path to the data dir fedimintd will use to store its data
|
| services.code-server.extensionsDir | Path to the extensions directory.
|
| services.bluesky-pds.pdsadmin.enable | Add pdsadmin script to PATH
|
| services.buildbot-master.masterCfg | Optionally pass master.cfg path
|
| services.httpd.virtualHosts.<name>.sslServerCert | Path to server SSL certificate.
|
| services.forgejo.settings.log.ROOT_PATH | Root path for log files.
|
| services.shibboleth-sp.configFile | Path to shibboleth config file
|
| services.outline.storage.secretKeyFile | File path that contains the S3 secret key.
|
| services.redmine.database.socket | Path to the unix socket file to use for authentication.
|
| services.restic.server.htpasswd-file | The path to the servers .htpasswd file
|
| services.syncplay.passwordFile | Path to the file that contains the server password
|
| services.ncps.cache.storage.s3.accessKeyIdPath | The path to a file containing only the access-key-id.
|
| services.lasuite-docs.secretKeyPath | Path to the Django secret key
|
| services.lasuite-meet.secretKeyPath | Path to the Django secret key
|
| boot.loader.grub.mirroredBoots.*.devices | The path to the devices which will have the GRUB MBR written
|
| services.multipath.devices.*.product_blacklist | Products with the given vendor matching this string are blacklisted
|
| services.cockroachdb.certsDir | The path to the certificate directory.
|
| security.pam.makeHomeDir.skelDirectory | Path to skeleton directory whose contents are copied to home
directories newly created by pam_mkhomedir.
|
| programs.sway.package | The sway package to use
|
| services.dnsproxy.settings | Contents of the config.yaml config file
|
| services.hebbot.templates.report | A path to the Markdown file for the report template.
|
| services.thanos.query.web.route-prefix | Prefix for API and UI endpoints
|
| services.moodle.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.plausible.server.baseUrl | Public URL where plausible is available
|
| services.sympa.domains.<name>.webLocation | URL path part of the web interface.
|
| services.pleroma.secretConfigFile | Path to the file containing your secret pleroma configuration.
DO NOT POINT THIS OPTION TO THE NIX
STORE, the store being world-readable, it'll
compromise all your secrets.
|
| services.thinkfan.fans | List of fans thinkfan will control.
This section slightly departs from the thinkfan.conf syntax
|
| services.misskey.redis.passwordFile | The path to a file containing the Redis password
|
| services.nagios.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.xserver.synaptics.dev | Path for touchpad device
|
| containers.<name>.allowedDevices.*.node | Path to device node
|
| boot.loader.grub.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the account
|
| services.dawarich.smtp.passwordFile | Path to file containing the SMTP password.
|
| services.immich.secretsFile | Path of a file with extra environment variables to be loaded from disk
|
| services.soju.tlsCertificateKey | Path to server TLS certificate key.
|
| services.sharkey.settings.socket | If specified, creates a UNIX socket at the given path that Sharkey listens on.
|
| services.mastodon.smtp.passwordFile | Path to file containing the SMTP password.
|
| services.zabbixProxy.extraPackages | Packages to be added to the Zabbix PATH
|
| services.zabbixAgent.extraPackages | Packages to be added to the Zabbix PATH
|
| services.zabbixProxy.database.socket | Path to the unix socket file to use for authentication.
|
| services.warpgate.settings.http.key | Path to HTTPS listener private key.
|
| services.gitlab.smtp.passwordFile | File containing the password of the SMTP server for GitLab
|
| services.filesender.settings.storage_filesystem_path | When using storage type filesystem this is the absolute path to the file system where uploaded files are stored until they expire
|
| services.buildbot-master.packages | Packages to add to PATH for the buildbot process.
|
| services.gitea.settings.server.HTTP_ADDR | Listen address
|
| services.forgejo.repositoryRoot | Path to the git repositories.
|
| services.buildbot-worker.packages | Packages to add to PATH for the buildbot process.
|
| services.tahoe.nodes.<name>.sftpd.accounts.file | Path to the accounts file.
|
| services.thanos.rule.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.ncps.cache.storage.s3.forcePathStyle | Force path-style S3 addressing (bucket/key vs key.bucket).
|
| services.radicle.ci.broker.settings.db | Database file path.
|
| services.rspamd.overrides.<name>.source | Path of the source file.
|
| services.moonraker.klipperSocket | Path to Klipper's API socket.
|
| services.minetest-server.configPath | Path to the config to use
|
| services.tinc.networks.<name>.rsaPrivateKeyFile | Path of the private RSA keyfile.
|
| services.tahoe.nodes.<name>.sftpd.hostPrivateKeyFile | Path to the SSH host private key.
|
| services.warpgate.settings.ssh.keys | Path to store SSH host & client keys.
|
| services.weblate.smtp.passwordFile | Location of a file containing the SMTP password
|
| services.kimai.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| services.dockerRegistry.configFile | Path to CNCF distribution config file
|
| services.kmonad.keyboards.<name>.device | Path to the keyboard's device file.
|
| services.httpd.virtualHosts.<name>.sslServerChain | Path to server SSL chain file.
|
| services.geth.<name>.authrpc.jwtsecret | Path to a JWT secret for authenticated RPC endpoint.
|
| boot.iscsi-initiator.extraConfigFile | Append an additional file's contents to /etc/iscsid.conf
|
| services.invidious.hmacKeyFile | A path to a file containing the hmac_key
|
| services.send.redis.passwordFile | The path to the file containing the Redis password
|
| services.unpoller.influxdb.pass | Path of a file containing the password for influxdb
|
| services.nsd.remoteControl.serverKeyFile | Path to the server private key, which is used by the server
but not by nsd-control
|
| services.hylafax.sendmailPath | Path to sendmail program
|
| services.strongswan-swanctl.swanctl.authorities.<name>.cacert | The certificates may use a relative path from the swanctl
x509ca directory or an absolute path
|
| services.vmalert.settings.rule | Path to the files with alerting and/or recording rules.
Consider using the services.vmalert.rules option as a convenient alternative for declaring rules
directly in the nix language.
|
| services.flannel.kubeconfig | Path to kubeconfig to use for storing flannel config using the
Kubernetes API
|
| services.duplicity.secretFile | Path of a file containing secrets (gpg passphrase, access key...) in
the format of EnvironmentFile as described by
systemd.exec(5)
|
| services.slskd.settings.web.url_base | The base path in the url for web requests.
|
| services.mailman.ldap.bindPasswordFile | Path to the file containing the bind password of the service account
defined by services.mailman.ldap.bindDn.
|
| services.tcsd.conformanceCred | Path to the conformance credential for your TPM
|
| services.tcsd.endorsementCred | Path to the endorsement credential for your TPM
|
| services.warpgate.settings.mysql.key | Path to MySQL listener private key.
|
| services.prometheus.scrapeConfigs.*.nerve_sd_configs.*.paths | Paths can point to a single service, or the root of a tree of services.
|
| services.journald.remote.settings.Remote.ServerCertificateFile | A path to a SSL certificate file in PEM format
|
| services.hebbot.templates.project | A path to the Markdown file for the project template.
|
| services.gitlab-runner.extraPackages | Extra packages to add to PATH for the gitlab-runner process
|
| services.grafana-to-ntfy.settings.bauthPass | The path to the password you will use in the Grafana webhook settings.
|
| services.fedimintd.<name>.nginx.config.root | The path of the web root directory.
|
| services.glusterfs.tlsSettings.tlsPem | Path to the certificate used for TLS.
|
| services.hebbot.templates.section | A path to the Markdown file for the section template.
|
| services.immich.settings | Configuration for Immich
|
| security.pam.services.<name>.u2fAuth | If set, users listed in
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set) are able to log in with the associated U2F key
|
| services.iodine.clients.<name>.passwordFile | Path to a file containing the password.
|
| fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.traefik.dynamic.dir | Path to the directory Traefik should watch for configuration files.
Files in this directory matching the glob _nixos-* (reserved for Nix-managed dynamic configurations) will be deleted as part of
systemd-tmpfiles-resetup.service, regardless of their origin..
|
| services.ncdns.dnssec.keys.public | Path to the file containing the KSK public key
|
| services.thanos.query.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.nextcloud.config.dbpassFile | The full path to a file that contains the database password.
|
| services.thanos.store.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.stash.settings.generated | Path to generated files
|
| services.zabbixServer.database.socket | Path to the unix socket file to use for authentication.
|
| services.zabbixServer.extraPackages | Packages to be added to the Zabbix PATH
|
| services.multipath.devices.*.delay_watch_checks | This option is deprecated, and mapped to san_path_err_forget_rate
|
| services.peering-manager.oidcConfigPath | Path to the Configuration-File for OIDC-Authentication, will be loaded as oidc_config.py
|
| services.hqplayerd.licenseFile | Path to the HQPlayer license key file
|
| fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| services.syncthing.guiPasswordFile | Path to file containing the plaintext password for Syncthing's GUI.
|
| services.sshwifty.socks5PasswordFile | Path to a file containing the SOCKS5 password.
|
| services.tcsd.platformCred | Path to the platform credential for your TPM
|
| services.nsd.remoteControl.serverCertFile | Path to the server self signed certificate, which is used by the server
but and by nsd-control
|
| services.miniflux.config.LISTEN_ADDR | Address to listen on
|
| services.openiscsi.extraConfigFile | Append an additional file's contents to /etc/iscsid.conf
|
| services.peering-manager.ldapConfigPath | Path to the Configuration-File for LDAP-Authentication, will be loaded as ldap_config.py
|
| services.oauth2-proxy.customTemplatesDir | Path to custom HTML templates.
|
| systemd.shutdownRamfs.contents.<name>.target | Path of the symlink.
|
| systemd.services.<name>.enableDefaultPath | Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
|
| services.weblate.djangoSecretKeyFile | Location of the Django secret key
|
| services.zabbixWeb.httpd.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.dnscrypt-proxy.configFile | Path to TOML config file
|
| services.gns3-server.auth.passwordFile | A file containing the password to access the GNS3 Server.
This should be a string, not a nix path, since nix paths
are copied into the world-readable nix store.
|
| services.dolibarr.h2o.tls.identity.*.key-file | Path to key file
|
| services.drupal.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| services.firezone.relay.tokenFile | A file containing the firezone relay token
|
| services.quicktun.<name>.privateKeyFile | Path to file containing local secret key in binary or hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| services.pulseaudio.configFile | The path to the default configuration options the PulseAudio server
should use
|
| services.microbin.passwordFile | Path to file containing environment variables
|
| services.ncdns.dnssec.keys.zonePublic | Path to the file containing the ZSK public key
|
| services.nextcloud.datadir | Nextcloud's data storage path
|
| services.oauth2-proxy.nginx.domain | The domain under which the oauth2-proxy will be accesible and the path of cookies are set to
|
| services.sillytavern.configFile | Path to the SillyTavern configuration file.
|
| services.linux-enable-ir-emitter.device | IR camera device to depend on
|
| users.ldap.daemon.rootpwmodpwFile | The path to a file containing the credentials with which to bind to
the LDAP server if the root user tries to change a user's password.
|
| services.zabbixWeb.httpd.virtualHost.sslServerCert | Path to server SSL certificate.
|
| systemd.shutdownRamfs.contents.<name>.source | Path of the source file.
|
| services.komodo-periphery.configFile | Path to the periphery configuration file
|
| services.drupal.sites.<name>.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.borgbackup.jobs | Deduplicating backups using BorgBackup
|
| services.beszel.agent.smartmon.enable | Include services.beszel.agent.smartmon.package in the Beszel agent path for disk monitoring and add the agent to the disk group.
|
| services.dokuwiki.sites.<name>.extraConfigs | Path(s) to additional configuration files that are then linked to the 'conf' directory.
|
| services.journald.gateway.trust | Specify the path to a file or AF_UNIX stream socket to read a CA
certificate from
|
| boot.initrd.luks.devices.<name>.gpgCard.encryptedPass | Path to the GPG encrypted passphrase.
|
| programs.firejail.wrappedBinaries | Wrap the binaries in firejail and place them in the global path.
|
| services.nsd.remoteControl.controlKeyFile | Path to the client private key, which is used by nsd-control
but not by the server
|
| services.quake3-server.baseq3 | Path to the baseq3 files (pak*.pk3)
|
| services.k3s.environmentFile | File path containing environment variables for configuring the k3s service in the format of an EnvironmentFile
|
| services.windmill.database.urlPath | Path to the file containing the database url windmill should connect to
|
| services.lasuite-meet.settings.DJANGO_DATA_DIR | Path to the data directory
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.certs | List of certificates to accept for authentication
|
| virtualisation.fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.borgbackup.repos.<name>.user | The user borg serve is run as
|
| security.agnos.generateKeys.enable | Enable automatic generation of account keys
|
| services.earlyoom.killHook | An absolute path to an executable to be run for each process killed
|
| services.cloudflare-dyndns.apiTokenFile | The path to a file containing the CloudFlare API token.
|
| power.ups.upsmon.monitor.<name>.passwordFile | The full path to a file containing the password from
upsd.users for accessing this UPS
|
| services.gitweb.projectroot | Path to git projects (bare repositories) that should be served by
gitweb
|
| programs.river-classic.package | The river-classic package to use
|
| services.dockerRegistry.storagePath | Docker registry storage path for the filesystem storage backend
|
| programs.tsmClient.wrappedPackage | The tsm-client package to use
|
| services.glusterfs.tlsSettings.caCert | Path certificate authority used to sign the cluster certificates.
|
| services.bird-lg.proxy.traceroute.binary | Traceroute's binary path.
|
| services.drupal.sites.<name>.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.dokuwiki.sites.<name>.plugins | List of path(s) to respective plugin(s) which are copied into the 'plugin' directory.
These plugins need to be packaged before use, see example.
|
| services.suricata.settings.rule-files | Files to load suricata-update managed rules, relative to 'default-rule-path'.
|
| services.tlsrpt.reportd.settings.dbname | Path to the sqlite database.
|
| services.ncps.cache.storage.s3.secretAccessKeyPath | The path to a file containing only the secret-access-key.
|
| services.searx.settingsFile | The path of the Searx server settings.yml file
|
| services.thanos.rule.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.pretix.settings.database.host | Database host or socket path.
|
| services.opensnitch.rules | Declarative configuration of firewall rules
|
| services.opengfw.settings.ruleset.geoip | Path to geoip.dat.
|
| services.rke2.environmentFile | File path containing environment variables for configuring the rke2 service in the format of an EnvironmentFile
|
| services.davis.nginx.sslCertificate | Path to server SSL certificate.
|
| services.docuseal.secretKeyBaseFile | Path to file containing the secret key base
|
| services.homebridge.userStoragePath | Path to store homebridge user files (needs to be writeable).
|
| services.glusterfs.tlsSettings.tlsKeyPath | Path to the private key used for TLS.
|
| services.c2fmzq-server.passphraseFile | Path to file containing the database passphrase
|
| services.journald.gateway.cert | The path to a file or AF_UNIX stream socket to read the server
certificate from
|
| services.homebridge.pluginPath | Path to the plugin download directory (needs to be writeable)
|
| services.iperf3.authorizedUsersFile | Path to the configuration file containing authorized users credentials to run iperf tests.
|
| environment.unixODBCDrivers | Specifies Unix ODBC drivers to be registered in
/etc/odbcinst.ini
|
| services.public-inbox.inboxes.<name>.inboxdir | The absolute path to the directory which hosts the public-inbox.
|
| services.slskd.nginx.sslCertificate | Path to server SSL certificate.
|
| services.openvscode-server.socketPath | The path to a socket file for the server to listen to.
|
| services.movim.nginx.sslCertificate | Path to server SSL certificate.
|
| services.openvpn.servers.<name>.config | Configuration of this OpenVPN instance
|
| services.netbird.clients.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.netbird.tunnels.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.wordpress.sites.<name>.themes | Path(s) to respective theme(s) which are copied from the 'theme' directory.
These themes need to be packaged before use, see example.
|
| services.github-runners.<name>.extraPackages | Extra packages to add to PATH of the service to make them available to workflows.
|
| services.journald.remote.settings.Remote.TrustedCertificateFile | A path to a SSL CA certificate file in PEM format, or all
|
| services.mastodon.otpSecretFile | Path to file containing the OTP secret
|
| services.dnscrypt-proxy2.configFile | Path to TOML config file
|
| services.forgejo.settings.server.HTTP_ADDR | Listen address
|
| services.asterisk.confFiles | Sets the content of config files (typically ending with
.conf) in the Asterisk configuration directory
|
| services.buildkite-agents.<name>.tokenPath | The token from your Buildkite "Agents" page
|
| services.nsd.remoteControl.controlCertFile | Path to the client certificate signed with the server certificate
|
| services.matrix-conduit.secretFile | Path to a file containing sensitive environment as described in {manpage}`systemd.exec(5)
|
| services.tailscale.serve.configFile | Path to a Tailscale Serve configuration file in JSON format
|
| services.qbittorrent.profileDir | the path passed to qbittorrent via --profile.
|
| services.onlyoffice.postgresHost | The Postgresql hostname or socket path OnlyOffice should connect to.
|
| services.snipe-it.nginx.sslCertificate | Path to server SSL certificate.
|
| services.zabbixWeb.httpd.virtualHost.sslServerChain | Path to server SSL chain file.
|
| containers.<name>.nixpkgs | A path to the nixpkgs that provide the modules, pkgs and lib for evaluating the container
|
| services.borgbackup.repos.<name>.group | The group borg serve is run as
|
| services.journald.gateway.key | Specify the path to a file or AF_UNIX stream socket to read the
secret server key corresponding to the certificate specified with
services.journald.gateway.cert from
|
| services.c2fmzq-server.settings.database | Path of the database
|
| services.klipper.firmwares.<name>.serial | Path to serial port this printer is connected to
|
| services.nitter.sessionsFile | Path to the session tokens file
|
| services.shiori.environmentFile | Path to file containing environment variables
|
| services.mediawiki.database.socket | Path to the unix socket file to use for authentication.
|
| services.thanos.store.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.sympa.database.host | Database host address
|
| services.mongodb.initialRootPasswordFile | Path to the file containing the password for the root user if auth is enabled.
|
| services.mail.sendmailSetuidWrapper.source | The absolute path to the program to be wrapped.
|
| systemd.user.services.<name>.enableDefaultPath | Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
|
| services.warpgate.databaseUrlFile | Path to file containing database connection string with credentials
|
| services.jigasi.componentPasswordFile | Path to file containing component secret.
|
| services.gitea.settings.server.STATIC_ROOT_PATH | Upper level of template and static files path.
|
| services.ghostunnel.servers.<name>.key | Path to certificate private key (PEM with private key)
|
| services.drupal.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| security.apparmor.policies.<name>.profile | The profile file contents
|
| services.draupnir.settings.dataPath | The path Draupnir will store its state/data in.
This option is read-only.
If you want to customize where this data is stored, use a bind mount.
|
| services.glance.settings | Configuration written to a yaml file that is read by glance
|
| services.icingaweb2.libraryPaths | Libraries to add to the Icingaweb2 library path
|
| services.ghostunnel.servers.<name>.cert | Path to certificate (PEM with certificate chain)
|
| services.klipper.firmwares.<name>.package | Path to the built firmware package.
|
| documentation.enable | Whether to install documentation of packages from
environment.systemPackages into the generated system path
|
| services.davis.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.calibre-web.options.calibreLibrary | Path to Calibre library.
|
| services.jicofo.componentPasswordFile | Path to file containing component secret.
|
| services.oauth2-proxy.tls.certificate | Path to certificate file.
|
| services.thinkfan.sensors | List of temperature sensors thinkfan will monitor.
This section slightly departs from the thinkfan.conf syntax
|
| services.onlyoffice.jwtSecretFile | Path to a file that contains the secret to sign web requests using JSON Web Tokens
|
| services.slskd.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.nextcloud.config.dbhost | Database host (+port) or socket path
|
| services.movim.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.zoneminder.storageDir | ZoneMinder can generate quite a lot of data, so in case you don't want
to use the default /var/lib/zoneminder, you can override the path here.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacerts | List of CA certificates to accept for
authentication
|
| services.akkoma.extraPackages | List of extra packages to include in the executable search path of the service unit
|
| services.akkoma.nginx.sslCertificate | Path to server SSL certificate.
|
| services.fluidd.nginx.sslCertificate | Path to server SSL certificate.
|
| services.borgbackup.jobs.<name>.wrapper | Name of the wrapper that is installed into PATH
|
| services.grafana.settings.smtp.key_file | File path to a key file.
|
| services.gancio.nginx.sslCertificate | Path to server SSL certificate.
|
| services.snipe-it.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.thanos.sidecar.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.thanos.receive.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.quassel.certificateFile | Path to the certificate used for SSL connections with clients.
|
| services.monica.nginx.sslCertificate | Path to server SSL certificate.
|
| services.oauth2-proxy.google.serviceAccountJSON | The path to the service account JSON credentials.
|
| services.thanos.compact.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.pretalx.settings.database.host | Database host or socket path.
|
| services.unpoller.unifi.defaults.pass | Path of a file containing the password for the unifi service user
|
| services.matomo.nginx.sslCertificate | Path to server SSL certificate.
|
| services.microsocks.authPasswordFile | Path to a file containing the password for authentication.
|
| services.gitlab.secrets.dbFile | A file containing the secret used to encrypt variables in
the DB
|
| services.gitlab.secrets.jwsFile | A file containing the secret used to encrypt session
keys
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.pubkeys | List of raw public keys to accept for
authentication
|
| services.klipper.firmwares.<name>.configFile | Path to firmware config which is generated using klipper-genconf
|
| services.hardware.pommed.configFile | The path to the pommed.conf file
|
| services.buffyboard.configFile | Path to an INI format configuration file to provide Buffyboard
|
| programs.tsmClient.servers.<name>.inclexcl | Text lines with include.* and exclude.* directives
to be used when sending files to the IBM TSM server,
or an absolute path pointing to a file with such lines.
|
| boot.loader.grub.users.<name>.hashedPasswordFile | Specifies the path to a file containing the password hash
for the account, generated with grub-mkpasswd-pbkdf2
|
| services.moodle.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.nagios.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.tlsrpt.fetcher.settings.storage | Path to the collectd sqlite database.
|
| services.opengfw.settings.ruleset | The path to load specific local geoip/geosite db files
|
| services.slurm.dbdserver.storagePassFile | Path to file with database password
|
| services.misskey.database.passwordFile | The path to a file containing the database password
|
| services.wordpress.sites.<name>.plugins | Path(s) to respective plugin(s) which are copied from the 'plugins' directory.
These plugins need to be packaged before use, see example.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.certs | List of certificate candidates to use for
authentication
|
| services.multipath.blacklist_exceptions | This section defines which devices should be included in the
multipath topology discovery, despite being listed in the
blacklist section.
|
| services.prosody.uploadHttp.httpUploadPath | Directory where the uploaded files will be stored when the http_upload module is used
|
| services.jupyterhub.kernels.<name>.logo64 | Path to 64x64 logo png.
|
| networking.firewall.extraPackages | Additional packages to be included in the environment of the system
as well as the path of networking.firewall.extraCommands.
|
| services.grafana-to-ntfy.settings.ntfyBAuthPass | The path to the password for the specified ntfy-sh user
|
| services.jupyterhub.kernels.<name>.logo32 | Path to 32x32 logo png.
|
| services.buildkite-agents.<name>.hooksPath | Path to the directory storing the hooks
|
| services.firezone.gateway.tokenFile | A file containing the firezone gateway token
|
| services.tinc.networks.<name>.ed25519PrivateKeyFile | Path of the private ed25519 keyfile.
|
| services.pgadmin.emailServer.passwordFile | Password for SMTP email account
|
| services.plausible.mail.smtp.passwordFile | The path to the file with the password in case SMTP auth is enabled.
|
| services.uwsgi.instance | uWSGI configuration
|
| services.xserver.displayManager.xserverBin | Path to the X server used by display managers.
|
| services.wyoming.satellite.sounds.done | Path to audio file in WAV format to play when voice command recording has ended.
|
| services.postsrsd.settings.chroot-dir | Path to chroot into at runtime as an additional layer of protection.
We confine the runtime environment through systemd hardening instead, so this option is read-only.
|
| services.xserver.windowManager.i3.configFile | Path to the i3 configuration file
|
| services.fluidd.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.gitea.settings.mailer.SENDMAIL_PATH | Path to sendmail binary or script.
|
| services.borgbackup.repos | Serve BorgBackup repositories to given public SSH keys,
restricting their access to the repository only
|
| services.keycloak.database.host | Hostname of the database to connect to
|
| services.gancio.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| hardware.nvidia-container-toolkit.csv-files | The path to the list of CSV files to use when generating the CDI specification in CSV mode.
|
| services.akkoma.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.gitlab-runner.services.<name>.buildsDir | Absolute path to a directory where builds will be stored
in context of selected executor (Locally, Docker, SSH).
|
| services.ejabberd.imagemagick | Add ImageMagick to server's path; allows for image thumbnailing
|
| services.foundationdb.pidfile | Path to pidfile for fdbmonitor.
|
| services.monica.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.public-inbox.settings.coderepo.<name>.dir | Path to a git repository
|
| services.matterbridge.configPath | The path to the matterbridge configuration file.
|
| services.thanos.rule.tracing.config | Tracing configuration
|
| services.peering-manager.peeringdbApiKeyFile | Path to a file containing the PeeringDB API key.
|
| services.matomo.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.taskserver.pki.manual.ca.cert | Fully qualified path to the CA certificate.
Setting this option will prevent automatic CA creation and handling.
|
| virtualisation.xen.qemu.pidFile | Path to the QEMU PID file.
|
| services.warpgate.settings.log.send_to | Path of UNIX socket of log forwarder
|
| services.gitlab.initialRootPasswordFile | File containing the initial password of the root account if
this is a new install
|
| services.gitlab.databasePasswordFile | File containing the GitLab database user password
|
| services.gitlab.secrets.otpFile | A file containing the secret used to encrypt secrets for OTP
tokens
|
| services.httpd.virtualHosts.<name>.documentRoot | The path of Apache's document root directory
|
| services.etesync-dav.sslCertificate | Path to server SSL certificate
|
| services.esphome.allowedDevices | A list of device nodes to which esphome has access to
|
| services.haven.environmentFile | Path to a file containing sensitive environment variables
|
| services.grafana.settings.server.socket | Path where the socket should be created when protocol=socket
|
| services.calibre-server.libraries | Make sure each library path is initialized before service startup
|
| boot.specialFileSystems.<name>.device | The device as passed to mount
|
| services.neo4j.ssl.policies.<name>.privateKey | The name of private PKCS #8 key file for this policy to be found
in the baseDirectory, or the absolute path to
the key file
|
| services.netdata.extraNdsudoPackages | Extra packages to add to PATH to make available to ndsudo.
ndsudo has SUID privileges, be careful what packages you list here.
cfg.package must be built with withNdsudo = true
|
| services.opengfw.settings.ruleset.geosite | Path to geosite.dat.
|
| services.mastodon.secretKeyBaseFile | Path to file containing the secret key base
|
| services.nullmailer.remotesFile | Path to the remotes control file
|
| services.limesurvey.nginx.virtualHost.root | The path of the web root directory.
|
| services.wyoming.satellite.sounds.awake | Path to audio file in WAV format to play when wake word is detected.
|
| networking.firewall.logReversePathDrops | Logs dropped packets failing the reverse path filter test if
the option networking.firewall.checkReversePath is enabled.
|
| services.blockbook-frontend.<name>.certFile | To enable SSL, specify path to the name of certificate files without extension
|
| services.photoprism.originalsPath | Storage path of your original media files (photos and videos).
|
| services.prefect.databasePasswordFile | path to a file containing e.g.:
DBPASSWORD=supersecret
stored outside the nix store, read by systemd as EnvironmentFile.
|
| services.postgresqlBackup.location | Path of directory where the PostgreSQL database dumps will be placed.
|
| services.kubernetes.kubelet.cni.configDir | Path to Kubernetes CNI configuration directory.
|
| services.warpgate.settings.postgres.key | Path to PostgreSQL listener private key.
|
| virtualisation.rootDevice | The path (inside the VM) to the device containing the root filesystem.
|
| services.multipath.devices.*.user_friendly_names | If set to "yes", using the bindings file /etc/multipath/bindings
to assign a persistent and unique alias to the multipath, in the
form of mpath
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.pubkeys | List of raw public key candidates to use for
authentication
|
| services.sourcehut.settings."hg.sr.ht".repos | Path to mercurial repositories on disk
|
| services.gerbil.environmentFile | Path to a file containing sensitive environment variables for Gerbil
|
| services.keycloak.sslCertificate | The path to a PEM formatted certificate to use for TLS/SSL
connections.
|
| services.netbird.server.coturn.passwordFile | The path to a file containing the password of the user used by netbird to connect to the coturn server.
|
| services.pgadmin.initialPasswordFile | Initial password file for the pgAdmin account
|
| services.limesurvey.database.socket | Path to the unix socket file to use for authentication.
|
| services.mattermost.database.host | Host to use for the database
|
| services.typesense.settings.server.data-dir | Path to the directory where data will be stored on disk.
|
| services.postfix-tlspol.settings.server.cache-file | Path to the cache file.
|
| services.misskey.meilisearch.keyFile | The path to a file containing the Meilisearch API key
|
| services.thanos.store.tracing.config | Tracing configuration
|
| services.thanos.query.tracing.config | Tracing configuration
|
| services.spiped.config.<name>.source | Address on which spiped should listen for incoming
connections
|
| services.samba.settings.global."passwd program" | Path to a program that can be used to set UNIX user passwords.
|
| services.sabnzbd.secretFiles | Path to a list of ini file containing confidential settings such as credentials
|
| services.vdirsyncer.jobs.<name>.config.statusPath | vdirsyncer's status path
|
| services.xserver.xkb.extraLayouts.<name>.typesFile | The path to the xkb types file
|
| services.kubernetes.pki.caCertPathPrefix | Path-prefrix for the CA-certificate to be used for cfssl signing
|
| services.discourse.redis.passwordFile | File containing the Redis password
|
| services.limesurvey.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.simplesamlphp.<name>.libDir | Path to the SimpleSAMLphp library directory.
|
| services.sourcehut.settings."git.sr.ht".repos | Path to git repositories on disk
|
| hardware.nvidia-container-toolkit.mounts.*.hostPath | Host path.
|
| services.grafana.settings.smtp.cert_file | File path to a cert file.
|
| services.etesync-dav.sslCertificateKey | Path to server SSL certificate key
|
| services.thanos.compact.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.thanos.receive.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.tsidp.environmentFile | Path to an environment file loaded for the tsidp service
|
| services.thanos.sidecar.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.xserver.windowManager.qtile.configFile | Path to the qtile configuration file
|
| services.matrix-synapse.extraConfigFiles | Extra config files to include
|
| services.wastebin.secretFile | Path to file containing sensitive environment variables
|
| services.limesurvey.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.dokuwiki.sites.<name>.templates | List of path(s) to respective template(s) which are copied into the 'tpl' directory.
These templates need to be packaged before use, see example.
|
| services.fwupd.daemonSettings.EspLocation | The EFI system partition (ESP) path used if UDisks is not available
or if this partition is not mounted at /boot/efi, /boot, or /efi
|
| security.pam.mount.additionalSearchPaths | Additional programs to include in the search path of pam_mount
|
| services.forgejo.settings.server.STATIC_ROOT_PATH | Upper level of template and static files path.
|
| services.kasmweb.sslCertificateKey | The SSL certificate's key to be used for kasmweb
|
| services.mpd.credentials.*.passwordFile | Path to file containing the password.
|
| services.restic.backups.<name>.repositoryFile | Path to the file containing the repository location to backup to.
|
| services.mediawiki.httpd.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.maddy.tls.certificates.*.keyPath | Path to the private key used for TLS.
|
| services.xserver.windowManager.mlvwm.configFile | Path to the mlvwm configuration file
|
| services.wordpress.sites.<name>.languages | List of path(s) to respective language(s) which are copied from the 'languages' directory.
|
| services.xserver.windowManager.bspwm.configFile | Path to the bspwm configuration file
|
| services.sourcehut.settings."hg.sr.ht".srhtext | Path to the srht mercurial extension
(defaults to where the hgsrht code is)
|
| security.pam.u2f.enable | Enables U2F PAM (pam-u2f) module
|
| services.dashy.settings | Settings serialized into user-data/conf.yml before build
|
| services.buildkite-agents.<name>.privateSshKeyPath | OpenSSH private key
A run-time path to the key file, which is supposed to be provisioned
outside of Nix store.
|
| services.ghostunnel.servers.<name>.cacert | Path to CA bundle file (PEM/X509)
|
| programs.hyprland.systemd.setPath.enable | Set environment path of systemd to include the current system's bin directory
|
| image.repart.partitions.<name>.contents.<name>.source | Path of the source file.
|
| services.keycloak.sslCertificateKey | The path to a PEM formatted private key to use for TLS/SSL
connections.
|
| services.openssh.sftpServerExecutable | The sftp server executable
|
| services.maddy.tls.certificates.*.certPath | Path to the certificate used for TLS.
|
| services.mediawiki.httpd.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.newt.environmentFile | Path to a file containing sensitive environment variables for Newt
|
| services.reposilite.settings.basePath | Custom base path for this Reposilite instance
|
| services.rathole.credentialsFile | Path to a TOML file to be merged with the settings
|
| services.mattermost.database.socketPath | The database (Postgres or MySQL) socket path.
|
| services.lasuite-docs.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.lasuite-meet.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.grafana.settings.server.serve_from_sub_path | Serve Grafana from subpath specified in the root_url setting
|
| services.chatgpt-retrieval-plugin.openaiApiKeyPath | Path to the secret openai api key used for embeddings.
|
| services.hickory-dns.settings.directory | The directory in which hickory-dns should look for .zone files,
whenever zones aren't specified by absolute path.
|
| programs.ssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.tor.relay.onionServices.<name>.secretKey | Secret key of the onion service
|
| services.taskserver.extensions | Fully qualified path of the Taskserver extension scripts
|
| services.thanos.rule.web.external-prefix | Static prefix for all HTML links and redirect URLs in the UI query web
interface
|
| services.ntfy-sh.environmentFile | Path to a file containing extra ntfy environment variables in the systemd EnvironmentFile
format
|
| services.restic.backups.<name>.createWrapper | Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service
|
| services.thanos.rule.objstore.config | Object store configuration
|
| services.self-deploy.repository | The repository to fetch from
|
| services.reposilite.keyPasswordFile | Path the the file containing the password used to unlock the Java KeyStore file specified in services.reposilite.settings.keyPath
|
| services.gitlab.secrets.secretFile | A file containing the secret used to encrypt variables in
the DB
|
| security.dhparams.stateful | Whether generation of Diffie-Hellman parameters should be stateful or
not
|
| services.dolibarr.nginx.sslCertificate | Path to server SSL certificate.
|
| services.certspotter.sendmailPath | Path to the sendmail binary
|
| services.librenms.nginx.sslCertificate | Path to server SSL certificate.
|
| services.atticd.environmentFile | Path to an EnvironmentFile containing required environment
variables:
- ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64: The base64-encoded RSA PEM PKCS1 of the
RS256 JWT secret
|
| services.grafana.settings.server.cert_key | Path to the certificate key file (if protocol is set to https or h2).
|
| services.agorakit.nginx.sslCertificate | Path to server SSL certificate.
|
| services.desktopManager.gnome.sessionPath | Additional list of packages to be added to the session search path
|
| services.fediwall.nginx.sslCertificate | Path to server SSL certificate.
|
| services.kanboard.nginx.sslCertificate | Path to server SSL certificate.
|
| services.keepalived.vrrpScripts.<name>.script | (Path of) Script command to execute followed by args, i.e. cmd [args]...
|
| services.easytier.instances.<name>.configFile | Path to easytier config file
|
| services.pixelfed.nginx.sslCertificate | Path to server SSL certificate.
|
| services.scion.stateless | Setting this value to false (stateful) can lead to improved caching and
performance
|
| services.mainsail.nginx.sslCertificate | Path to server SSL certificate.
|
| services.taskserver.pki.manual.server.key | Fully qualified path to the server key.
Setting this option will prevent automatic CA creation and handling.
|
| services.restic.backups.<name>.rcloneConfigFile | Path to the file containing rclone configuration
|
| services.mattermost.database.peerAuth | If set, will use peer auth instead of connecting to a Postgres server
|
| services.networking.websockify.sslKey | Path to the SSL key.
|
| services.mastodon.vapidPublicKeyFile | Path to file containing the public key used for Web Push
Voluntary Application Server Identification
|
| services.lasuite-docs.environmentFile | Path to environment file
|
| services.wordpress.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| services.lasuite-meet.environmentFile | Path to environment file
|
| services.xserver.xkb.extraLayouts.<name>.compatFile | The path to the xkb compat file
|
| services.matrix-synapse.settings.tls_private_key_path | PEM encoded private key for TLS
|
| services.limesurvey.virtualHost.sslServerChain | Path to server SSL chain file.
|
| boot.loader.grub.mirroredBoots.*.efiBootloaderId | The id of the bootloader to store in efi nvram
|
| services.invidious.database.passwordFile | Path to file containing the database password.
|
| services.desktopManager.budgie.sessionPath | Additional list of packages to be added to the session search path
|
| services.discourse.sslCertificate | The path to the server SSL certificate
|
| services.netbird.useRoutingFeatures | Enables settings required for NetBird's routing features: Network Resources, Network Routes & Exit Nodes
|
| services.openvscode-server.extraPackages | Additional packages to add to the openvscode-server PATH.
|
| services.routinator.settings.log-file | A string value containing the path to a file to which log messages will be appended if the log configuration value is set to file
|
| services.prometheus.exporters.lnd.lndTlsPath | Path to lnd TLS certificate.
|
| services.suricata.settings.default-log-dir | The default logging directory
|
| services.meilisearch.masterKeyFile | Path to file which contains the master key
|
| services.sharkey.settings.mediaDirectory | Path to the folder where Sharkey stores uploaded media such as images and attachments.
|
| services.zabbixWeb.httpd.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.wordpress.sites.<name>.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.postsrsd.settings.secrets-file | Path to the file containing the secret keys.
Secrets are passed using LoadCredential= on the systemd unit,
so this options is read-only
|
| image.repart.partitions.<name>.nixStorePrefix | The prefix to use for store paths
|
| services.karakeep.environmentFile | An optional path to an environment file that will be used in the web and workers
services
|
| services.beszel.agent.environmentFile | File path containing environment variables for configuring the beszel-agent service in the format of an EnvironmentFile
|
| services.homer.settings | Settings serialized into config.yml before build
|
| security.pam.yubico.challengeResponsePath | If not null, set the path used by yubico pam module where the challenge expected response is stored
|
| services.thanos.query.web.external-prefix | Static prefix for all HTML links and redirect URLs in the UI query web
interface
|
| services.networking.websockify.sslCert | Path to the SSL certificate.
|
| services.mediawiki.httpd.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.taskserver.pki.manual.server.crl | Fully qualified path to the server certificate revocation list.
Setting this option will prevent automatic CA creation and handling.
|
| services.mastodon.vapidPrivateKeyFile | Path to file containing the private key used for Web Push
Voluntary Application Server Identification
|
| services.neo4j.directories.data | Path of the data directory
|
| services.thanos.store.objstore.config | Object store configuration
|
| services.taskserver.pki.manual.server.cert | Fully qualified path to the server certificate.
Setting this option will prevent automatic CA creation and handling.
|
| services.plausible.server.secretKeybaseFile | Path to the secret used by the phoenix-framework
|
| services.opensnitch.settings.Rules.Path | Path to the directory where firewall rules can be found and will
get stored by the NixOS module.
|
| services.thanos.query-frontend.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.wordpress.sites.<name>.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.xserver.xkb.extraLayouts.<name>.symbolsFile | The path to the xkb symbols file
|
| services.kanidm.provision.adminPasswordFile | Path to a file containing the admin password for kanidm
|
| environment.profileRelativeEnvVars | Attribute set of environment variable
|
| services.chatgpt-retrieval-plugin.bearerTokenPath | Path to the secret bearer token used for the http api authentication.
|
| services.sourcehut.settings."todo.sr.ht::mail".sock | Path for the lmtp daemon's unix socket
|
| services.librenms.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.agorakit.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.kanboard.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.drupal.sites.<name>.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.dependency-track.ldap.bindPasswordFile | The path to a file containing the LDAP bind password.
|
| services.fediwall.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.dolibarr.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.mainsail.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.radicle.httpd.nginx.sslCertificate | Path to server SSL certificate.
|
| services.pixelfed.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.n8n.environment.N8N_USER_FOLDER | Provide the path where n8n will create the .n8n folder
|
| services.vsftpd.userDbPath | Only applies if enableVirtualUsers is true
|
| services.mediawiki.extensions | Attribute set of paths whose content is copied to the extensions
subdirectory of the MediaWiki installation and enabled in configuration
|
| services.pretalx.settings.filesystem.data | Base path for all other storage paths.
|
| services.davis.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| security.acme.certs.<name>.environmentFile | Path to an EnvironmentFile for the cert's service containing any required and
optional environment variables for your selected dnsProvider
|
| services.discourse.sslCertificateKey | The path to the server SSL certificate key
|
| hardware.graphics.extraPackages | Additional packages to add to the default graphics driver lookup path
|
| services.pufferpanel.extraPackages | Packages to add to the PATH environment variable
|
| services.openvpn.servers.<name>.authUserPass | This option can be used to store the username / password credentials
with the "auth-user-pass" authentication method
|
| services.postfix-tlspol.settings.server.address | Path or address/port where postfix-tlspol binds its socket to.
|
| services.thanos.compact.tracing.config | Tracing configuration
|
| services.slskd.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.thanos.sidecar.tracing.config | Tracing configuration
|
| services.movim.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.thanos.receive.tracing.config | Tracing configuration
|
| virtualisation.diskImage | Path to the disk image containing the root filesystem
|
| services.gitlab-runner.services.<name>.registrationConfigFile | Absolute path to a file with environment variables
used for gitlab-runner registration with runner registration
tokens
|
| services.matrix-synapse.settings.tls_certificate_path | PEM encoded X509 certificate for TLS
|
| services.simplesamlphp.<name>.configDir | Path to the SimpleSAMLphp config directory.
|
| services.bitmagnet.settings.postgres.host | Address, hostname or Unix socket path of the database server
|
| security.tpm2.tctiEnvironment.deviceConf | Configuration part of the device TCTI, e.g. the path to the TPM device
|
| services.anuko-time-tracker.nginx.sslCertificate | Path to server SSL certificate.
|
| services.apache-kafka.configFiles.log4jProperties | Kafka log4j property configuration file path
|
| services.prometheus.exporters.mqtt.mqttTopic | Topic path to subscribe to.
|
| services.sabnzbd.settings.misc.https_key | Path to the TLS key for the web UI
|
| services.limesurvey.httpd.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.step-ca.settings | Settings that go into ca.json
|
| services.snipe-it.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.nginx.virtualHosts.<name>.sslCertificate | Path to server SSL certificate.
|
| services.gitlab.secrets.activeRecordSaltFile | A file containing the salt for active record encryption in the DB
|
| services.grafana.settings.server.cert_file | Path to the certificate file (if protocol is set to https or h2).
|
| services.pretalx.settings.filesystem.logs | Path to the log directory, that pretalx logs message to.
|
| services.misskey.reverseProxy.webserver.nginx.root | The path of the web root directory.
|
| services.limesurvey.httpd.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.radicle.httpd.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.wordpress.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| virtualisation.bootLoaderDevice | The path (inside th VM) to the device to boot from when legacy booting.
|
| services.xserver.windowManager.bspwm.sxhkd.configFile | Path to the sxhkd configuration file
|
| services.gitlab-runner.services.<name>.authenticationTokenConfigFile | Absolute path to a file containing environment variables used for
gitlab-runner registrations with runner authentication tokens
|
| services.sourcehut.settings."pages.sr.ht".gemini-certs | An absolute file path (which should be outside the Nix-store)
to Gemini certificates.
|
| boot.binfmt.registrations.<name>.openBinary | Whether to pass the binary to the interpreter as an open
file descriptor, instead of a path.
|
| nixpkgs.flake.setFlakeRegistry | Whether to pin nixpkgs in the system-wide flake registry (/etc/nix/registry.json) to the
store path of the sources of nixpkgs used to build the NixOS system
|
| services.bookstack.nginx.sslCertificate | Path to server SSL certificate.
|
| services.nextcloud.config.adminpassFile | The full path to a file that contains the admin's password
|
| services.slskd.environmentFile | Path to the environment file sourced on startup
|
| services.unbound.localControlSocketPath | When not set to null this option defines the path
at which the unbound remote control socket should be created at
|
| services.openbao.settings.listener.<name>.address | The TCP address or UNIX socket path to listen on.
|
| services.prometheus.exporters.sql.configFile | Path to configuration file.
|
| services.openssh.authorizedKeysCommand | Specifies a program to be used to look up the user's public
keys
|
| services.zfs.autoReplication.identityFilePath | Path to SSH key used to login to host.
|
| services.prometheus.scrapeConfigs.*.serverset_sd_configs.*.paths | Paths can point to a single service, or the root of a tree of services.
|
| services.akkoma.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.fluidd.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.anuko-time-tracker.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.firezone.headless-client.tokenFile | A file containing the firezone client token
|
| services.gancio.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.matomo.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.monica.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.monero.environmentFile | Path to an EnvironmentFile for the monero service as defined in systemd.exec(5)
|
| services.nginx.virtualHosts.<name>.sslCertificateKey | Path to server SSL certificate key.
|
| services.openvscode-server.extensionsDir | Set the root path for extensions.
|
| services.wstunnel.clients.<name>.upgradePathPrefix | Use a specific HTTP path prefix that will show up in the upgrade
request to the wstunnel server
|
| services.keepalived.enableScriptSecurity | Don't run scripts configured to be run as root if any part of the path is writable by a non-root user.
|
| services.biboumi.credentialsFile | Path to a configuration file to be merged with the settings
|
| services.audiobookshelf.dataDir | Path to Audiobookshelf config and metadata inside of /var/lib.
|
| services.matrix-continuwuity.admin.enable | Add conduwuit command to PATH for administration
|
| services.prometheus.exporters.json.configFile | Path to configuration file.
|
| services.prometheus.exporters.ipmi.configFile | Path to configuration file.
|
| services.xserver.xkb.extraLayouts.<name>.keycodesFile | The path to the xkb keycodes file
|
| services.pipewire.wireplumber.extraScripts | Additional scripts for WirePlumber to be used by configuration files
|
| services.fcgiwrap.instances.<name>.socket.address | Socket address
|
| services.homebridge.environmentFile | Path to an environment-file which may contain secrets.
|
| services.bookstack.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| services.cyrus-imap.imapdSettings.lmtpsocket | Unix socket that lmtpd listens on, used by deliver(8)
|
| services.dawarich.secretKeyBaseFile | Path to file containing the secret key base
|
| services.thanos.downsample.tracing.config-file | Path to YAML file that contains tracing configuration
|
| services.limesurvey.httpd.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.zeronsd.servedNetworks.<name>.settings.token | Path to a file containing the API Token for ZeroTier Central.
|
| services.lighthouse.beacon.execution.jwtPath | Path for the jwt secret required to connect to the execution layer.
|
| services.gitea-actions-runner.instances.<name>.tokenFile | Path to an environment file, containing the TOKEN environment
variable, that holds a token to register at the configured
Gitea/Forgejo instance.
|
| services.apache-kafka.configFiles.serverProperties | Kafka server.properties configuration file path
|
| services.grafana.settings.users.home_page | Path to a custom home page
|
| services.bacula-sd.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.grafana.settings.database.host | Only applicable to MySQL or Postgres
|
| services.bacula-fd.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.calibre-web.options.enableBookConversion | Configure path to the Calibre's ebook-convert in the DB.
|
| services.umurmur.settings.certificate | Path to your SSL certificate
|
| services.snapserver.settings.http.doc_root | Path to serve from the HTTP servers root.
|
| services.prometheus.exporters.bird.birdSocket | Path to BIRD2 (or BIRD1 v4) socket.
|
| services.plausible.database.postgres.socket | Path to the UNIX domain-socket to communicate with postgres.
|
| services.munin-node.extraPlugins | Additional Munin plugins to activate
|
| services.movim.h2o.tls.identity.*.certificate-file | Path to certificate file
|
| services.thanos.sidecar.objstore.config | Object store configuration
|
| services.umurmur.settings.private_key | Path to your SSL key
|
| services.thanos.compact.objstore.config | Object store configuration
|
| services.thanos.receive.objstore.config | Object store configuration
|
| services.jirafeau.nginxConfig.sslCertificate | Path to server SSL certificate.
|
| security.agnos.settings.accounts.*.certificates.*.key_output_file | Output path for the certificate private key
|
| services.sourcehut.settings."sr.ht".network-key | An absolute file path (which should be outside the Nix-store)
to a secret key to encrypt internal messages with
|
| services.desktopManager.pantheon.sessionPath | Additional list of packages to be added to the session search path
|
| services.librespeed.frontend.servers.*.ulURL | URL path to upload test on this server
|
| services.librespeed.frontend.servers.*.dlURL | URL path to download test on this server
|
| services.klipper.firmwares.<name>.klipperFlashPackage | Path to the built klipper-flash package.
|
| services.bacula-dir.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.opensnitch.settings.Ebpf.ModulesPath | Configure eBPF modules path
|
| services.pretalx.settings.filesystem.static | Path to the directory that contains static files.
|
| services.xserver.xkb.extraLayouts.<name>.geometryFile | The path to the xkb geometry file
|
| services.discourse.mail.incoming.apiKeyFile | A file containing the Discourse API key used to add
posts and messages from mail
|
| services.discourse.database.passwordFile | File containing the Discourse database user password
|
| services.sourcehut.settings."lists.sr.ht::worker".sock | Path for the lmtp daemon's unix socket
|
| hardware.graphics.extraPackages32 | Additional packages to add to 32-bit graphics driver lookup path on 64-bit systems
|
| services.anuko-time-tracker.settings.email.smtpPasswordFile | Path to file containing the MTA authentication password.
|
| services.blendfarm.basicSecurityPasswordFile | Path to the password file the client needs to connect to the server
|
| services.filebrowser.settings.database | The path to FileBrowser's Bolt database.
|
| services.sabnzbd.settings.misc.https_cert | Path to the TLS certificate for the web UI
|
| services.rkvm.server.settings.certificate | TLS certificate path.
This should be generated with rkvm-certificate-gen.
|
| services.limesurvey.encryptionKeyFile | 32-byte key used to encrypt variables in the database
|
| services.unpoller.unifi.controllers.*.pass | Path of a file containing the password for the unifi service user
|
| services.nextcloud.notify_push.socketPath | Socket path to use for notify_push
|
| services.rkvm.client.settings.certificate | TLS ceritficate path.
This should be generated with rkvm-certificate-gen.
|
| services.rustus.info_storage | Info storages are used to store information about file uploads
|
| services.openssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.suwayomi-server.settings.server.localSourcePath | Path to the local source folder.
|
| services.zabbixWeb.nginx.virtualHost.sslCertificate | Path to server SSL certificate.
|
| services.kanidm.provision.idmAdminPasswordFile | Path to a file containing the idm admin password for kanidm
|
| services.librespeed.frontend.servers.*.getIpURL | URL path to IP lookup on this server
|
| services.prometheus.exporters.pve.server.keyFile | Path to a SSL private key file for the server
|
| services.onlyoffice.postgresPasswordFile | Path to a file that contains the password OnlyOffice should use to connect to Postgresql
|
| services.mosquitto.listeners.*.authPlugins.*.plugin | Plugin path to load, should be a .so file.
|
| services.pocket-id.environmentFile | Path to an environment file to be loaded
|
| services.pangolin.environmentFile | Path to a file containing sensitive environment variables for Pangolin
|
| services.jirafeau.nginxConfig.sslCertificateKey | Path to server SSL certificate key.
|
| services.sourcehut.settings.objects.s3-secret-key | An absolute file path (which should be outside the Nix-store)
to the secret key of the S3-compatible object storage service.
|
| services.authelia.instances.<name>.secrets.jwtSecretFile | Path to your JWT secret used during identity verificaton.
|
| programs.gnupg.agent.pinentryPackage | Which pinentry package to use
|
| security.acme.defaults.environmentFile | Path to an EnvironmentFile for the cert's service containing any required and
optional environment variables for your selected dnsProvider
|
| services.h2o.hosts.<name>.tls.identity.*.certificate-file | Path to certificate file
|
| services.prometheus.exporters.ipmi.webConfigFile | Path to configuration file that can enable TLS or authentication.
|
| services.reposilite.database.passwordFile | Path to the file containing the password for the database connection
|
| services.prometheus.exporters.pve.server.certFile | Path to a SSL certificate file for the server
|
| services.ocsinventory-agent.settings.ca | Path to CA certificates file in PEM format, for server
SSL certificate validation.
|
| services.nextcloud.notify_push.dbpassFile | The full path to a file that contains the database password.
|
| services.prometheus.exporters.knot.knotSocketPath | Socket path of knotd(8).
|
| virtualisation.incus.clientPackage | The incus client package to use
|
| services.hercules-ci-agent.settings.secretsJsonPath | Path to a JSON file containing secrets for effects
|
| services.thanos.rule.web.prefix-header | Name of HTTP request header used for dynamic prefixing of UI links and
redirects
|
| services.limesurvey.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.dependency-track.database.passwordFile | The path to a file containing the database password.
|
| services.librespeed.frontend.servers.*.pingURL | URL path to latency/jitter test on this server
|
| services.interception-tools.udevmonConfig | String of udevmon YAML configuration, or path to a udevmon YAML
configuration file.
|
| services.sftpgo.settings.ftpd.bindings.*.address | Network listen address
|
| services.mailpit.instances.<name>.database | Specify the local database filename to store persistent data
|
| services.szurubooru.server.settings.data_dir | Path to the static files.
|
| services.vault-agent.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.vmalert.instances.<name>.settings.rule | Path to the files with alerting and/or recording rules.
|
| services.zabbixWeb.nginx.virtualHost.sslCertificateKey | Path to server SSL certificate key.
|
| services.ghostunnel.servers.<name>.keystore | Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
|
| documentation.man.man-db.manualPages | The manual pages to generate caches for if documentation.man.generateCaches
is enabled
|
| services.pretix.settings.memcached.location | The host:port combination or the path to the UNIX socket of a memcached instance
|
| services.limesurvey.encryptionNonceFile | 24-byte used to encrypt variables in the database
|
| services.public-inbox.settings.publicinbox.css | The local path name of a CSS file for the PSGI web interface.
|
| services.thanos.query-frontend.tracing.config | Tracing configuration
|
| services.thanos.downsample.objstore.config-file | Path to YAML file that contains object store configuration
|
| services.mediawiki.httpd.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.neo4j.directories.plugins | Path of the database plugin directory
|
| services.lighttpd.collectd.collectionCgi | Path to collection.cgi script from (collectd sources)/contrib/collection.cgi
This option allows to use a customized version
|
| services.discourse.mail.outgoing.passwordFile | A file containing the password of the SMTP server account
|
| services.xserver.desktopManager.gnome.sessionPath | Additional list of packages to be added to the session search path
|
| boot.kernelPatches | A list of additional patches to apply to the kernel
|
| services.opensnitch.settings.Server.Address | Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
mandatory) or TCP socket (192.168.1.100:50051).
|
| services.prometheus.exporters.lnd.lndMacaroonDir | Path to lnd macaroons.
|
| services.openvscode-server.connectionTokenFile | Path to a file that contains the connection token.
|
| services.tlsrpt.collectd.settings.socketname | Path at which the UNIX socket will be created.
|
| services.yggdrasil.settings.PrivateKeyPath | Path to the private key file on the host system
|
| services.xserver.desktopManager.budgie.sessionPath | Additional list of packages to be added to the session search path
|
| services.librenms.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.bacula-sd.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.dolibarr.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.kanboard.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.agorakit.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.bacula-fd.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.fediwall.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.sftpgo.settings.sftpd.bindings.*.address | Network listen address
|
| services.pixelfed.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.prometheus.exporters.knot.knotLibraryPath | Path to the library of knot-dns.
|
| services.sftpgo.settings.httpd.bindings.*.address | Network listen address
|
| services.prometheus.exporters.postfix.showqPath | Path where Postfix places its showq socket.
|
| services.mainsail.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.warpgate.settings.http.certificate | Path to HTTPS listener certificate.
|
| services.hercules-ci-agent.settings.binaryCachesPath | Path to a JSON file containing binary cache secret keys
|
| services.thanos.query.web.prefix-header | Name of HTTP request header used for dynamic prefixing of UI links and
redirects
|
| services.bacula-dir.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.librechat.credentialsFile | Path to a file that contains environment variables
|
| services.displayManager.dms-greeter.configHome | Path to a user's home directory from which to copy DankMaterialShell
configuration files
|
| services.waagent.settings.ResourceDisk.MountPoint | This option specifies the path at which the resource disk is mounted
|
| virtualisation.podman.extraPackages | Extra dependencies for podman to be placed on $PATH in the wrapper.
|
| services.reposilite.settings.keyPath | Path to the .jsk KeyStore or paths to the PKCS#8 certificate and private key, separated by a space (see example)
|
| services.gitlab.secrets.activeRecordPrimaryKeyFile | A file containing the secret used to encrypt some rails data
in the DB
|
| services.healthchecks.settings.SECRET_KEY_FILE | Path to a file containing the secret key.
|
| hardware.nvidia-container-toolkit.mounts.*.containerPath | Container path.
|
| services.btrbk.instances.<name>.snapshotOnly | Whether to run in snapshot only mode
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".http.ip | Listener IP address or Unix socket path
|
| services.rosenpass.settings.public_key | Path to a file containing the public key of the local Rosenpass peer
|
| services.rosenpass.settings.secret_key | Path to a file containing the secret key of the local Rosenpass peer
|
| services.prometheus.exporters.dnsmasq.leasesPath | Path to the dnsmasq.leases file.
|
| services.maddy.ensureCredentials.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the user.
|
| services.printing.cups-pdf.instances.<name>.settings.AnonDirName | path for anonymously created PDF files
|
| services.opensnitch.settings.Audit.AudispSocketPath | Configure audit socket path
|
| services.wasabibackend.customConfigFile | Defines the path to a custom configuration file that is copied to the user's directory
|
| virtualisation.xen.store.settings.pidFile | Path to the Xen Store Daemon PID file.
|
| virtualisation.docker.extraPackages | Extra packages to add to PATH for the docker daemon process.
|
| services.wastebin.settings.WASTEBIN_DATABASE_PATH | Path to the sqlite3 database file
|
| services.vault.extraSettingsPaths | Configuration files to load besides the immutable one defined by the NixOS module
|
| services.wordpress.sites.<name>.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.authelia.instances.<name>.secrets.oidcHmacSecretFile | Path to your HMAC secret used to sign OIDC JWTs.
|
| services.routinator.settings.repository-dir | The path where the collected RPKI data is stored.
|
| services.radicle.httpd.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.kubernetes.apiserver.kubeletClientCaFile | Path to a cert file for connecting to kubelet.
|
| services.warpgate.settings.mysql.certificate | Path to MySQL listener certificate.
|
| services.armagetronad.servers.<name>.package | The armagetronad-dedicated package to use
|
| services.bitwarden-directory-connector-cli.ldap.rootPath | Root path for LDAP.
|
| services.prometheus.exporters.shelly.metrics-file | Path to the JSON file with the metric definitions
|
| services.nextcloud.notify_push.dbhost | Database host (+port) or socket path
|
| services.nginx.sso.configuration | nginx-sso configuration
(documentation)
as a Nix attribute set
|
| virtualisation.bootPartition | The path (inside the VM) to the device containing the EFI System Partition (ESP)
|
| services.fedimintd.<name>.nginx.config.sslCertificate | Path to server SSL certificate.
|
| services.anuko-time-tracker.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.nginx.virtualHosts.<name>.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.rosenpass.settings.peers.*.public_key | Path to a file containing the public key of the remote Rosenpass peer.
|
| services.prometheus.exporters.varnish.healthPath | Path under which to expose healthcheck
|
| services.akkoma.config.":pleroma"."Pleroma.Upload".base_url | Base path which uploads will be stored at
|
| services.prometheus.exporters.nut.passwordPath | A run-time path to the nutUser password file, which should be
provisioned outside of Nix store.
|
| services.prometheus.exporters.zfs.telemetryPath | Path under which to expose metrics.
|
| services.thanos.downsample.tracing.config | Tracing configuration
|
| services.limesurvey.httpd.virtualHost.documentRoot | The path of Apache's document root directory
|
| nixpkgs.pkgs | If set, the pkgs argument to all NixOS modules is the value of
this option, extended with nixpkgs.overlays, if
that is also set
|
| services.neo4j.ssl.policies.<name>.baseDirectory | The mandatory base directory for cryptographic objects of this
policy
|
| services.bookstack.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.dolibarr.h2o.tls.identity.*.certificate-file | Path to certificate file
|
| services.ocsinventory-agent.settings.local | If specified, the OCS Inventory Agent will run in offline mode
and the resulting inventory file will be stored in the specified path.
|
| virtualisation.podman.networkSocket.tls.cert | Path to certificate describing the server.
|
| services.sourcehut.settings.mail.pgp-privkey | An absolute file path (which should be outside the Nix-store)
to an OpenPGP private key
|
| services.fedimintd.<name>.nginx.config.sslCertificateKey | Path to server SSL certificate key.
|
| boot.loader.generic-extlinux-compatible.populateCmd | Contains the builder command used to populate an image,
honoring all options except the -c <path-to-default-configuration>
argument
|
| services.prometheus.exporters.unbound.unbound.ca | Path to the Unbound server certificate authority
|
| services.prometheus.exporters.ping.telemetryPath | Path under which to expose metrics.
|
| services.prometheus.exporters.blackbox.configFile | Path to configuration file.
|
| services.prometheus.exporters.mail.telemetryPath | Path under which to expose metrics.
|
| services.prometheus.exporters.php-fpm.telemetryPath | Path under which to expose metrics.
|
| services.prometheus.exporters.fastly.configFile | Path to a fastly-exporter configuration file
|
| services.wstunnel.servers.<name>.settings.restrict-to | Restrictions on the connections that the server will accept
|
| services.writefreely.admin.initialPasswordFile | Path to a file containing the initial password for the admin user
|
| services.prometheus.exporters.unbound.unbound.key | Path to the Unbound control socket key.
|
| services.sftpgo.settings.webdavd.bindings.*.address | Network listen address
|
| virtualisation.xen.store.settings.quota.maxPath | Path limit for the quota system.
|
| services.sourcehut.settings."builds.sr.ht::worker".buildlogs | Path to write build logs.
|
| services.paperless.environmentFile | Path to a file containing extra paperless config options in the systemd EnvironmentFile
format
|
| services.tailscale.useRoutingFeatures | Enables settings required for Tailscale's routing features like subnet routers and exit nodes
|
| services.prometheus.exporters.varnish.varnishStatPath | Path to varnishstat.
|
| services.xserver.desktopManager.pantheon.sessionPath | Additional list of packages to be added to the session search path
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-secret-key | An absolute file path (which should be outside the Nix-store)
to a secret key for Stripe
|
| services.cloudflared.tunnels.<name>.originRequest.caPool | Path to the certificate authority (CA) for the certificate of your origin
|
| services.cadvisor.storageDriverPasswordFile | File that contains the cadvisor storage driver password.
storageDriverPasswordFile takes precedence over storageDriverPassword
Warning: when storageDriverPassword is non-empty this defaults to a file in the
world-readable Nix store that contains the value of storageDriverPassword
|
| services.prometheus.exporters.nginx.telemetryPath | Path under which to expose metrics.
|
| services.nextcloud.config.objectstore.s3.secretFile | The full path to a file that contains the access secret.
|
| services.prometheus.exporters.unpoller.loki.pass | Path of a file containing the password for Loki
|
| services.prometheus.exporters.nextcloud.url | URL to the Nextcloud serverinfo page
|
| services.jirafeau.nginxConfig.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.xserver.desktopManager.cinnamon.sessionPath | Additional list of packages to be added to the session search path
|
| services.matrix-synapse.settings.database.args.database | Name of the database when using the psycopg2 backend,
path to the database location when using sqlite3.
|
| services.sourcehut.settings."sr.ht".service-key | An absolute file path (which should be outside the Nix-store)
to a key used for encrypting session cookies
|
| services.authelia.instances.<name>.secrets.sessionSecretFile | Path to your session secret
|
| security.pam.ussh.authorizedPrincipalsFile | Path to a list of principals; if the user presents a certificate with
one of these principals, then they will be authorized
|
| services.kanidm.provision.systems.oauth2.<name>.basicSecretFile | The basic secret to use for this service
|
| services.bacula-sd.device.<name>.archiveDevice | The specified name-string gives the system file name of the storage
device managed by this storage daemon
|
| documentation.man.mandoc.settings.output.style | Path to the file used for an external style-sheet
|
| services.gotosocial.environmentFile | File path containing environment variables for configuring the GoToSocial service
in the format of an EnvironmentFile as described by systemd.exec(5)
|
| networking.firewall.checkReversePath | Performs a reverse path filter test on a packet
|
| services.thanos.downsample.objstore.config | Object store configuration
|
| services.prometheus.exporters.postfix.logfilePath | Path where Postfix writes log entries
|
| services.zabbixWeb.nginx.virtualHost.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| documentation.man.mandoc.manPath | Change the paths included in the MANPATH environment variable,
i. e. the directories where man(1)
looks for section-specific directories of man pages
|
| services.foundationdb.tls.certificate | Path to the TLS certificate file
|
| services.glance.environmentFile | Path to an environment file as defined in systemd.exec(5)
|
| services.syncthing.settings.devices.<name>.autoAcceptFolders | Automatically create or share folders that this device advertises at the default path
|
| services.nextcloud-spreed-signaling.settings.https.key | Path to the private key used for the HTTPS listener
|
| services.logrotate.checkConfig | Whether the config should be checked at build time
|
| services.prometheus.exporters.mysqld.configFile | Path to the services config file
|
| services.etebase-server.settings.global.secret_file | The path to a file containing the secret
used as django's SECRET_KEY.
|
| services.prometheus.exporters.mysqld.telemetryPath | Path under which to expose metrics.
|
| services.prometheus.pushgateway.web.route-prefix | Prefix for the internal routes of web endpoints
|
| services.prometheus.exporters.mikrotik.configFile | Path to a mikrotik exporter configuration file
|
| services.archisteamfarm.ipcPasswordFile | Path to a file containing the password
|
| services.crowdsec-firewall-bouncer.secrets.apiKeyPath | Path to the API key to authenticate with a local CrowdSec API
|
| services.consul-template.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.opentelemetry-collector.configFile | Specify a path to a configuration file that Opentelemetry Collector should use.
|
| services.prometheus.exporters.borgmatic.configFile | The path to the borgmatic config file
|
| virtualisation.podman.networkSocket.tls.cacert | Path to CA certificate to use for client authentication.
|
| services.homepage-dashboard.environmentFile | The path to an environment file that contains environment variables to pass
to the homepage-dashboard service, for the purpose of passing secrets to
the service
|
| programs.singularity.enableExternalLocalStateDir | Whether to use top-level directories as LOCALSTATEDIR
instead of the store path ones
|
| services.bitwarden-directory-connector-cli.secrets.ldap | Path to file that contains LDAP password for user in {option}`ldap.username
|
| services.prometheus.exporters.unbound.unbound.host | Path to the unbound control socket
|
| services.athens.downloadMode | Defines how Athens behaves when a module@version
is not found in storage
|
| security.pam.sshAgentAuth.authorizedKeysFiles | A list of paths to files in OpenSSH's authorized_keys format, containing
the keys that will be trusted by the pam_ssh_agent_auth module
|
| services.authelia.instances.<name>.secrets.oidcIssuerPrivateKeyFile | Path to your private key file used to encrypt OIDC JWTs.
|
| services.mosquitto.listeners.*.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the MQTT user
|
| services.limesurvey.nginx.virtualHost.sslCertificate | Path to server SSL certificate.
|
| services.mautrix-meta.instances.<name>.registrationFile | Path to the yaml registration file of the appservice.
|
| services.pid-fan-controller.settings.fans.*.wildcardPath | Wildcard path of the hwmon pwm file
|
| services.warpgate.settings.postgres.certificate | Path to PostgreSQL listener certificate.
|
| services.linkwarden.environmentFile | Path of a file with extra environment variables to be loaded from disk
|
| services.tarsnap.archives.<name>.keyfile | Set a specific keyfile for this archive
|
| virtualisation.podman.networkSocket.tls.key | Path to the private key corresponding to the server certificate
|
| virtualisation.containerd.configFile | Path to containerd config file
|
| services.cloudflare-ddns.credentialsFile | Path to a file containing the Cloudflare API authentication token
|
| services.rmfakecloud.environmentFile | Path to an environment file loaded for the rmfakecloud service
|
| services.prometheus.exporters.dovecot.telemetryPath | Path under which to expose metrics.
|
| services.lubelogger.environmentFile | Path to a file containing extra LubeLogger config options in the systemd EnvironmentFile format
|
| services.prometheus.exporters.tibber.apiTokenPath | Add here the path to your personal Tibber API Token ('Bearer Token') File
|
| services.prometheus.exporters.postfix.telemetryPath | Path under which to expose metrics.
|
| services.prometheus.exporters.varnish.telemetryPath | Path under which to expose metrics.
|
| services.nextcloud.config.objectstore.s3.usePathStyle | Required for some non-Amazon S3 implementations
|
| services.prometheus.exporters.mongodb.telemetryPath | Metrics expose path
|
| services.prometheus.exporters.unbound.telemetryPath | Path under which to expose metrics.
|
| services.limesurvey.nginx.virtualHost.sslCertificateKey | Path to server SSL certificate key.
|
| services.tarsnap.keyfile | The keyfile which associates this machine with your tarsnap
account
|
| services.prometheus.exporters.pgbouncer.webConfigFile | Path to configuration file that can enable TLS or authentication.
|
| services.dendrite.settings.global.private_key | The path to the signing private key file, used to sign
requests and events.
nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
|
| services.mastodon.elasticsearch.passwordFile | Path to file containing password for optionally authenticating with Elasticsearch.
|
| services.outline.slackAuthentication.secretFile | File path containing the authentication secret.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.key | Path to certificate private key (PEM with private key)
|
| services.matrix-synapse.settings.log_config | The file that holds the logging configuration.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.cert | Path to certificate (PEM with certificate chain)
|
| services.sourcehut.settings.webhooks.private-key | An absolute file path (which should be outside the Nix-store)
to a base64-encoded Ed25519 key for signing webhook payloads
|
| services.angrr.settings.temporary-root-policies.<name>.filter.program | Path to the external filter program.
|
| services.akkoma.config.":pleroma".":media_proxy".base_url | Base path for the media proxy
|
| services.transmission.credentialsFile | Path to a JSON file to be merged with the settings
|
| services.bacula-sd.director.<name>.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.fedimintd.<name>.nginx.config.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.bacula-fd.director.<name>.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.prometheus.exporters.postfix.systemd.journalPath | Path to the systemd journal.
|
| services.akkoma.config.":pleroma".":instance".static_dir | Directory of static files
|
| services.jellyfin.hardwareAcceleration.device | Path to the hardware acceleration device that Jellyfin should use
|
| services.nextcloud-spreed-signaling.settings.turn.apikeyFile | The path to the file containing the value for turn.apikey
|
| services.prometheus.exporters.restic.repositoryFile | Path to the file containing the URI for the repository to monitor.
|
| services.lldap.settings.jwt_secret_file | Path to a file containing the JWT secret.
|
| services.prometheus.exporters.postgres.telemetryPath | Path under which to expose metrics.
|
| services.nextcloud-spreed-signaling.settings.turn.secretFile | The path to the file containing the value for turn.secret
|
| virtualisation.docker.rootless.extraPackages | Extra packages to add to PATH for the docker daemon process.
|
| services.discourse.siteSettings | Discourse site settings
|
| services.prometheus.exporters.sabnzbd.servers.*.apiKeyFile | The path to a file containing the API key
|
| services.dependency-track.settings."alpine.data.directory" | Defines the path to the data directory
|
| services.angrr.settings.temporary-root-policies.<name>.priority | Priority of this policy
|
| services.prometheus.exporters.ecoflow.ecoflowEmailFile | Path to the file with your personal ecoflow app login email address
|
| services.neo4j.ssl.policies.<name>.publicCertificate | The name of public X.509 certificate (chain) file in PEM format
for this policy to be found in the baseDirectory,
or the absolute path to the certificate file
|
| services.prometheus.alertmanagerGotify.webhookPath | The URL path to handle requests on.
|
| virtualisation.fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.xserver.windowManager.herbstluftwm.configFile | Path to the herbstluftwm configuration file
|
| services.invoiceplane.sites.<name>.invoiceTemplates | List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
These templates need to be packaged before use, see example.
|
| services.nextcloud-spreed-signaling.backends.<name>.secretFile | The path to the file containing the value for backends.<name>.secret
|
| services.prometheus.exporters.buildkite-agent.tokenPath | The token from your Buildkite "Agents" page
|
| services.prometheus.exporters.rasdaemon.databasePath | Path to the RAS daemon machine check event database.
|
| services.outline.oidcAuthentication.clientSecretFile | File path containing the authentication secret.
|
| services.prometheus.exporters.pgbouncer.pidFile | Path to PgBouncer pid file
|
| services.prometheus.exporters.restic.rcloneConfigFile | Path to the file containing rclone configuration
|
| systemd.services.<name>.confinement.packages | Additional packages or strings with context to add to the closure of
the chroot
|
| services.prometheus.exporters.nginxlog.metricsEndpoint | Path under which to expose metrics.
|
| services.mjolnir.pantalaimon.options.homeserver | The URI of the homeserver that the pantalaimon proxy should
forward requests to, without the matrix API path but including
the http(s) schema.
|
| services.misskey.reverseProxy.webserver.nginx.sslCertificate | Path to server SSL certificate.
|
| services.fluent-bit.configurationFile | Fluent Bit configuration
|
| services.meilisearch.masterKeyEnvironmentFile | Path to file which contains the master key
|
| services.bacula-sd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.bacula-fd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.radicle.ci.adapters.native.instances.<name>.runtimePackages | Packages added to the adapter's PATH.
|
| services.archisteamfarm.bots.<name>.passwordFile | Path to a file containing the password
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.cacert | Path to CA bundle file (PEM/X509)
|
| services.prometheus.exporters.smokeping.telemetryPath | Path under which to expose metrics.
|
| services.prometheus.exporters.pgbouncer.telemetryPath | Path under which to expose metrics.
|
| services.outline.azureAuthentication.clientSecretFile | File path containing the authentication secret.
|
| services.prometheus.exporters.junos-czerwonk.telemetryPath | Path under which to expose metrics.
|
| virtualisation.fileSystems.<name>.device | The device as passed to mount
|
| virtualisation.sharedDirectories.<name>.source | The path of the directory to share, can be a shell variable
|
| services.angrr.settings.temporary-root-policies.<name>.ignore-prefixes | List of path prefixes to ignore
|
| services.nextcloud.config.objectstore.s3.sseCKeyFile | If provided this is the full path to a file that contains the key
to enable [server-side encryption with customer-provided keys][1]
(SSE-C)
|
| services.misskey.reverseProxy.webserver.nginx.sslCertificateKey | Path to server SSL certificate key.
|
| virtualisation.xen.store.settings.xenstored.log.file | Path to the Xen Store log file.
|
| services.authelia.instances.<name>.secrets.storageEncryptionKeyFile | Path to your storage encryption key.
|
| services.prometheus.exporters.ecoflow.ecoflowAccessKeyFile | Path to the file with your personal api access string from the Ecoflow development website https://developer-eu.ecoflow.com
|
| services.prometheus.exporters.ecoflow.ecoflowSecretKeyFile | Path to the file with your personal api secret string from the Ecoflow development website https://developer-eu.ecoflow.com
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.signingKeyPath | Path to the signing key file for authenticated media.
|
| services.outline.googleAuthentication.clientSecretFile | File path containing the authentication secret.
|
| services.limesurvey.nginx.virtualHost.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.kubernetes.apiserver.serviceAccountSigningKeyFile | Path to the file that contains the current private key of the service
account token issuer
|
| services.strongswan-swanctl.swanctl.authorities.<name>.file | Absolute path to the certificate to load
|
| services.outline.oidcAuthentication.usernameClaim | Specify which claims to derive user information from
|
| services.angrr.settings.temporary-root-policies.<name>.ignore-prefixes-in-home | Path prefixes to ignore under home directory
|
| services.opentelemetry-collector.validateConfigFile | Whether to enable Validate configuration file.
|
| services.traefik.environmentFiles | Files to load as an environment file just before Traefik starts
|
| services.magnetico.web.credentialsFile | The path to the file holding the credentials to access the web
interface
|
| services.mosquitto.listeners.*.users.<name>.hashedPasswordFile | Specifies the path to a file containing the
hashed password for the MQTT user
|
| services.prometheus.exporters.scaphandre.telemetryPath | Path under which to expose metrics.
|
| services.outline.slackIntegration.verificationTokenFile | File path containing the verification token.
|
| services.outline.discordAuthentication.clientSecretFile | File path containing the authentication secret.
|
| virtualisation.fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.prometheus.exporters.ecoflow.ecoflowPasswordFile | Path to the file with your personal ecoflow app login email password
|
| virtualisation.fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| security.agnos.settings.accounts.*.certificates.*.fullchain_output_file | Output path for the full chain including the acquired certificate
|
| services.keycloak.settings.hostname-backchannel-dynamic | Enables dynamic resolving of backchannel URLs,
including hostname, scheme, port and context path
|
| services.prometheus.globalConfig.query_log_file | Path to the file prometheus should write its query log to.
|
| virtualisation.xen.store.settings.xenstored.accessLog.file | Path to the Xen Store access log file.
|
| services.tlsrpt.reportd.settings.sendmail_script | Path to a sendmail-compatible executable for delivery reports.
|
| services.misskey.reverseProxy.webserver.nginx.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| environment.profileRelativeSessionVariables | Attribute set of environment variable used in the global
environment
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.keystore | Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
|
| services.prometheus.exporters.snmp.configurationPath | Path to a snmp exporter configuration file
|
| services.pantalaimon-headless.instances.<name>.homeserver | The URI of the homeserver that the pantalaimon proxy should
forward requests to, without the matrix API path but including
the http(s) schema.
|
| services.prometheus.exporters.unbound.unbound.certificate | Path to the Unbound control socket certificate
|
| services.prometheus.alertmanager.webExternalUrl | The URL under which Alertmanager is externally reachable (for example, if Alertmanager is served via a reverse proxy)
|
| services.gitlab.secrets.activeRecordDeterministicKeyFile | A file containing the secret used to encrypt some rails data in a deterministic way
in the DB
|
| services.prometheus.exporters.unpoller.controllers.*.pass | Path of a file containing the password for the unifi service user
|
| services.nextcloud-spreed-signaling.settings.https.certificate | Path to the certificate used for the HTTPS listener
|
| services.nextcloud-spreed-signaling.settings.sessions.hashkeyFile | The path to the file containing the value for sessions.hashkey
|
| services.prometheus.exporters.wireguard.wireguardConfig | Path to the Wireguard Config to
add the peer's name to the stats of a peer
|
| networking.networkmanager.dispatcherScripts.*.source | Path to the hook script.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.nextcloud-spreed-signaling.settings.sessions.blockkeyFile | The path to the file containing the value for sessions.blockkey
|
| services.warpgate.settings.http.sni_certificates.*.key | Path to private key.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.strongswan-swanctl.swanctl.connections.<name>.encap | To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
NAT detection payloads
|
| services.firewalld.settings.IPv6_rpfilter | Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704
|
| services.peertube-runner.instancesToRegister.<name>.registrationTokenFile | Path to a file containing a registration token for the PeerTube instance
|
| services.xserver.displayManager.lightdm.greeters.gtk.indicators | List of allowed indicator modules to use for the lightdm gtk
greeter panel
|
| services.rustus.storage.s3_access_key_file | File path that contains the S3 access key.
|
| services.rustus.storage.s3_secret_key_file | File path that contains the S3 secret key.
|
| virtualisation.virtualbox.host.enableHardening | Enable hardened VirtualBox, which ensures that only the binaries in the
system path get access to the devices exposed by the kernel modules
instead of all users in the vboxusers group.
Disabling this can put your system's security at risk, as local users
in the vboxusers group can tamper with the VirtualBox device files.
|
| services.wyoming.faster-whisper.servers.<name>.model | Name of the voice model to use
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.file | Absolute path to the certificate to load
|
| services.bacula-sd.autochanger.<name>.changerCommand | The name-string specifies an external program to be called that will
automatically change volumes as required by Bacula
|
| virtualisation.oci-containers.containers.<name>.login.passwordFile | Path to file containing password.
|
| virtualisation.oci-containers.containers.<name>.imageFile | Path to an image file to load before running the image
|
| services.journaldriver.applicationCredentials | Path to the service account private key (in JSON-format) used
to forward log entries to Stackdriver Logging on non-GCP
instances
|
| services.amazon-cloudwatch-agent.configurationFile | Amazon CloudWatch Agent configuration file
|
| security.pam.rssh.settings.auth_key_file | Path to file with trusted public keys in OpenSSH's authorized_keys format
|
| services.prometheus.exporters.snmp.environmentFile | EnvironmentFile as defined in systemd.exec(5)
|
| services.amazon-cloudwatch-agent.commonConfigurationFile | Amazon CloudWatch Agent common configuration
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_df | Whether to copy the DF bit to the outer IPv4 header in tunnel mode
|
| services.prometheus.exporters.dovecot.socketPath | Path under which the stats socket is placed
|
| services.github-runners.<name>.tokenFile | The full path to a file which contains either
- a fine-grained personal access token (PAT),
- a classic PAT
- or a runner registration token
Changing this option or the tokenFile’s content triggers a new runner registration
|
| services.prometheus.exporters.fritz.settings.devices.*.password_file | Path to a file which contains the password to authenticate with the target device
|
| services.borgmatic.settings.source_directories | List of source directories and files to backup
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".socket_dir | Path to the postgres socket directory
|
| services.warpgate.settings.http.sni_certificates.*.certificate | Path to certificate.
|
| services.nextcloud-spreed-signaling.settings.clients.internalsecretFile | The path to the file containing the value for clients.internalsecret
|
| virtualisation.oci-containers.containers.<name>.imageStream | Path to a script that streams the desired image on standard output
|
| services.lldap.settings.ldap_user_pass_file | Path to a file containing the default admin password
|
| users.users.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.matrix-synapse.workers.<name>.worker_log_config | The file for log configuration
|
| users.extraUsers.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.tfc_padding | Pads ESP packets with additional data to have a consistent ESP packet
size for improved Traffic Flow Confidentiality
|
| services.borgmatic.configurations.<name>.source_directories | List of source directories and files to backup
|
| services.chhoto-url.settings.custom_landing_directory | The path of a directory which contains a custom landing page.
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.kubeconfig_file | Optional path to a kubeconfig file
|
| services.cyrus-imap.imapdSettings.configdirectory | The pathname of the IMAP configuration directory.
|
| users.mysql.nss | Settings for libnss-mysql
|
| security.apparmor.includes | List of paths to be added to AppArmor's searched paths
when resolving include directives.
|
| documentation.man.mandoc.cachePath | Change the paths where mandoc makewhatis(8)generates the
manual page index caches. documentation.man.generateCaches
should be enabled to allow cache generation
|
| services.plex.extraPlugins | A list of paths to extra plugin bundles to install in Plex's plugin
directory
|
| services.plex.extraScanners | A list of paths to extra scanners to install in Plex's scanners
directory
|
| system.checks | Packages that are added as dependencies of the system's build, usually
for the purpose of validating some part of the configuration
|
| security.apparmor.enableCache | Whether to enable caching of AppArmor policies
in /var/cache/apparmor/
|
| services.librespeed.secrets | Attribute set of filesystem paths
|
| services.strongswan.secrets | A list of paths to IPSec secret files
|
| services.prosody.ssl | Paths to SSL files
|
| services.foundationdb.extraReadWritePaths | An extra set of filesystem paths that FoundationDB can read to
and write from
|
| services.restic.backups.<name>.dynamicFilesFrom | A script that produces a list of files to back up
|
| services.borgbackup.jobs.<name>.dumpCommand | Backup the stdout of this program instead of filesystem paths
|
| image.repart.partitions.<name>.stripNixStorePrefix | Whether to strip /nix/store/ from the store paths
|
| boot.extraSystemdUnitPaths | Additional paths that get appended to the SYSTEMD_UNIT_PATH environment variable
that can contain mutable unit files.
|
| services.ncps.cache.dataPath | The local directory for storing configuration and cached store paths
|
| services.locate.prunePaths | Which paths to exclude from indexing
|
| boot.initrd.systemd.storePaths | Store paths to copy into the initrd as well.
|
| services.gitDaemon.repositories | A whitelist of paths of git repositories, or directories containing repositories
all of which would be published
|
| services.privoxy.settings.filterfile | List of paths to Privoxy filter files
|
| programs.nncp.secrets | A list of paths to NNCP configuration files that should not be
in the Nix store
|
| services.ncps.cache.hostName | The hostname of the cache server. This is used to generate the
private key used for signing store paths (.narinfo)
|
| services.zenohd.plugins | Plugin packages to add to zenohd search paths.
|
| services.nghttpx.tls | TLS certificate and key paths
|
| services.hydra.useSubstitutes | Whether to use binary caches for downloading store paths
|
| services.gancio.plugins | Paths of gancio plugins to activate (linked under $WorkingDirectory/plugins/).
|
| services.privoxy.settings.actionsfile | List of paths to Privoxy action files
|
| services.cachix-watch-store.jobs | Number of threads used for pushing store paths
|
| services.ersatztv.baseUrl | Base URL to support reverse proxies that use paths (e.g. /ersatztv)
|
| networking.search | The list of domain search paths that are considered for resolving
hostnames with fewer dots than configured in the ndots option,
which defaults to 1 if unset.
|
| services.below.cgroupFilterOut | A regexp matching the full paths of cgroups whose data shouldn't be collected
|
| services.nar-serve.domain | When set, enables the feature of serving .
on top of /nix/store/-
|
| services.zenohd.backends | Storage backend packages to add to zenohd search paths.
|
| services.harmonia.signKeyPaths | Paths to the signing keys to use for signing the cache
|
| services.collectd.include | Additional paths to load config from.
|
| programs.tsmClient.package | The tsm-client package to use
|
| services.locate.pruneNames | Directory components which should exclude paths containing them from indexing
|
| services.logstash.plugins | The paths to find other logstash plugins in.
|
| systemd.shutdownRamfs.storePaths | Store paths to copy into the shutdown ramfs as well.
|
| systemd.services.<name>.confinement.fullUnit | Whether to include the full closure of the systemd unit file into the
chroot, instead of just the dependencies for the executables.
While it may be tempting to just enable this option to
make things work quickly, please be aware that this might add paths
to the closure of the chroot that you didn't anticipate
|
| services.akkoma.extraStatic | Attribute set of extra paths to add to the static files directory
|
| services.freefall.devices | Device paths to all internal spinning hard drives.
|
| services.fluentd.plugins | A list of plugin paths to pass into fluentd
|
| services.marytts.voices | Paths to the JAR files that contain additional voices for MaryTTS
|
| services.outline.cdnUrl | If using a Cloudfront/Cloudflare distribution or similar it can be set
using this option
|
| services.hledger-web.journalFiles | Paths to journal files relative to services.hledger-web.stateDir.
|
| services.ncps.cache.storage.local | The local directory for storing configuration and cached store
paths
|
| containers.<name>.tmpfs | Mounts a set of tmpfs file systems into the container
|
| services.public-inbox.http.mounts | Root paths or URLs that public-inbox will be served on
|
| services.mediawiki.skins | Attribute set of paths whose content is copied to the skins
subdirectory of the MediaWiki installation in addition to the default skins.
|
| services.prosody.virtualHosts.<name>.ssl | Paths to SSL files
|
| services.saunafs.master.exports | Paths to exports file (see sfsexports.cfg(5)).
|
| services.nomad.extraSettingsPaths | Additional settings paths used to configure nomad
|
| virtualisation.additionalPaths | A list of paths whose closure should be made available to
the VM
|
| programs.nix-required-mounts.enable | Whether to enable Expose extra paths to the sandbox depending on derivations' requiredSystemFeatures.
|
| services.athens.protocolWorkers | Number of workers concurrently serving protocol paths.
|
| services.dysnomia.extraModulePaths | A list of paths containing additional modules that are added to the search folders
|
| services.public-inbox.inboxes.<name>.watch | Paths for public-inbox-watch(1) to monitor for new mail.
|
| services.zitadel.extraStepsPaths | A list of paths to extra steps files
|
| image.repart.partitions.<name>.storePaths | The store paths to include in the partition.
|
| services.jupyter.kernels.<name>.extraPaths | Extra paths to link in kernel directory
|
| services.anubis.instances | An attribute set of Anubis instances
|
| programs.ssh.agentPKCS11Whitelist | A pattern-list of acceptable paths for PKCS#11 shared libraries
that may be used with the -s option to ssh-add.
|
| services.duplicity.include | List of paths to include into the backups
|
| services.duplicity.exclude | List of paths to exclude from backups
|
| services.cachix-watch-store.signingKeyFile | Optional file containing a self-managed signing key to sign uploaded store paths.
|
| services.ncps.upstream.publicKeys | A list of public keys of upstream caches in the format
host[-[0-9]*]:public-key
|
| services.borgbackup.jobs.<name>.user | The user borg is run as
|
| services.netdata.extraPluginPaths | Extra paths to add to the netdata global "plugins directory"
option
|
| services.restic.backups.<name>.command | Command to pass to --stdin-from-command
|
| services.borgmatic.settings.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| services.cross-seed.settings.dataDirs | Paths to be searched for matching data
|
| services.borgbackup.jobs.<name>.group | The group borg is run as
|
| services.ytdl-sub.instances.<name>.readWritePaths | List of paths that ytdl-sub can write to.
|
| hardware.deviceTree.dtboBuildExtraIncludePaths | Additional include paths that will be passed to the preprocessor when creating the final .dts to compile into .dtbo
|
| services.postfix.masterConfig.<name>.chroot | Whether the service is chrooted to have only access to the
services.postfix.queueDir and the closure of
store paths specified by the program option.
|
| boot.initrd.systemd.suppressedStorePaths | Store paths specified in the storePaths option that
should not be copied.
|
| services.bcachefs.autoScrub.fileSystems | List of paths to bcachefs filesystems to regularly call bcachefs scrub on
|
| services.duplicity.excludeFileList | File containing newline-separated list of paths to exclude into the
backups
|
| services.duplicity.includeFileList | File containing newline-separated list of paths to include into the
backups
|
| services.zitadel.extraSettingsPaths | A list of paths to extra settings files
|
| services.ncps.cache.upstream.publicKeys | A list of public keys of upstream caches in the format
host[-[0-9]*]:public-key
|
| services.dysnomia.extraContainerPaths | A list of paths containing additional container configurations that are added to the search folders
|
| system.extraDependencies | A list of paths that should be included in the system
closure but generally not visible to users
|
| services.kanata.keyboards.<name>.devices | Paths to keyboard devices
|
| services.komodo-periphery.includeDiskMounts | Only include these mount paths in disk reporting.
|
| services.komodo-periphery.excludeDiskMounts | Exclude these mount paths from disk reporting.
|
| services.mattermost.plugins | Plugins to add to the configuration
|
| services.jupyterhub.kernels.<name>.extraPaths | Extra paths to link in kernel directory
|
| services.beszel.agent.smartmon.deviceAllow | List of device paths to allow access to for SMART monitoring
|
| programs.nix-required-mounts.allowedPatterns | The hook config, describing which paths to mount for which system features
|
| services.airsonic.transcoders | List of paths to transcoder executables that should be accessible
from Airsonic
|
| services.btrfs.autoScrub.fileSystems | List of paths to btrfs filesystems to regularly call btrfs scrub on
|
| services.marytts.userDictionaries | Paths to the user dictionary files for MaryTTS.
|
| services.postfix.settings.master.<name>.chroot | Whether the service is chrooted to have only access to the
services.postfix.queueDir and the closure of
store paths specified by the program option.
|
| services.subsonic.transcoders | List of paths to transcoder executables that should be accessible
from Subsonic
|
| services.borgbackup.jobs.<name>.exclude | Exclude paths matching any of the given patterns
|
| services.maddy.tls.certificates | A list of attribute sets containing paths to TLS certificates and
keys
|
| services.dbus.packages | Packages whose D-Bus configuration files should be included in
the configuration of the D-Bus system-wide or session-wide
message bus
|
| environment.wordlist.lists | A set with the key names being the environment variable you'd like to
set and the values being a list of paths to text documents containing
lists of words
|
| services.sharkey.environmentFiles | List of paths to files containing environment variables for Sharkey to use at runtime
|
| services.pocket-id.credentials | Environment variables which are loaded from the contents of the specified file paths
|
| services.linkwarden.secretFiles | Attribute set containing paths to files to add to the environment of linkwarden
|
| services.hylafax.commonModemConfig | Attribute set of default values for
modem config files etc/config.*
|
| networking.nftables.checkRuleset | Run nft check on the ruleset to spot syntax errors during build
|
| services.centrifugo.credentials | Environment variables with absolute paths to credentials files to load
on service startup.
|
| systemd.services.<name>.confinement.enable | If set, all the required runtime store paths for this service are
bind-mounted into a tmpfs-based
chroot(2).
|
| services.prometheus.exporters.kea.targets | Paths or URLs to the Kea control socket.
|
| services.plex.accelerationDevices | A list of device paths to hardware acceleration devices that Plex should
have access to
|
| services.tarsnap.archives.<name>.directories | List of filesystem paths to archive.
|
| services.dawarich.configureNginx | Configure nginx as a reverse proxy for dawarich
|
| programs.singularity.systemBinPaths | (Extra) system-wide /**/bin paths
for Apptainer/Singularity to find command-line utilities in.
"/run/wrappers/bin" is included by default to make
utilities with SUID bit set available to Apptainer/Singularity
|
| documentation.nixos.extraModuleSources | Which extra NixOS module paths the generated NixOS's documentation should strip
from options.
|
| services.borgmatic.configurations.<name>.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| networking.nftables.checkRulesetRedirects | Set of paths that should be intercepted and rewritten while checking the ruleset
using pkgs.buildPackages.libredirect.
|
| services.librechat.credentials | Environment variables which are loaded from the contents of files at a file paths, mainly used for secrets
|
| services.slskd.settings.shares.directories | Paths to shared directories
|
| services.grafana.settings.server.cdn_url | Specify a full HTTP URL address to the root of your Grafana CDN assets
|
| services.munin-node.extraAutoPlugins | Additional Munin plugins to autoconfigure, using
munin-node-configure --suggest
|
| system.forbiddenDependenciesRegexes | POSIX Extended Regular Expressions that match store paths that
should not appear in the system closure, with the exception of system.extraDependencies, which is not checked.
|
| services.borgbackup.jobs.<name>.patterns | Include/exclude paths matching the given patterns
|
| security.allowUserNamespaces | Whether to allow creation of user namespaces
|
| boot.loader.generic-extlinux-compatible.mirroredBoots | Mirror the boot configuration to multiple paths.
|
| services.openssh.authorizedKeysFiles | Specify the rules for which files to read on the host
|
| services.immich.accelerationDevices | A list of device paths to hardware acceleration devices that immich should
have access to
|
| services.prometheus.exporters.node-cert.excludePaths | List of paths to exclute from searching for SSL certificates.
|
| services.frp.instances.<name>.environmentFiles | List of paths files that follows systemd environmentfile structure
|
| programs.nix-required-mounts.presets.nvidia-gpu.enable | Whether to enable Declare the support for derivations that require an Nvidia GPU to be
available, e.g. derivations with requiredSystemFeatures = [ "cuda" ]
|
| services.mastodon.configureNginx | Configure nginx as a reverse proxy for mastodon
|
| services.prometheus.exporters.smartctl.devices | Paths to the disks that will be monitored
|
| services.prometheus.exporters.snmp.enableConfigCheck | Whether to run a correctness check for the configuration file
|
| services.tee-supplicant.trustedApplications | A list of full paths to trusted applications that will be loaded at
runtime by tee-supplicant.
|
| programs.nix-required-mounts.allowedPatterns.<name>.unsafeFollowSymlinks | Whether to enable Instructs the hook to mount the symlink targets as well, when any of
the paths contain symlinks
|
| services.prometheus.exporters.blackbox.enableConfigCheck | Whether to run a correctness check for the configuration file
|
| security.apparmor.killUnconfinedConfinables | Whether to enable killing of processes which have an AppArmor profile enabled
(in security.apparmor.policies)
but are not confined (because AppArmor can only confine new processes)
|
| services.wyoming.openwakeword.customModelsDirectories | Paths to directories with custom wake word models (*.tflite model files).
|
| systemd.services.<name>.confinement.mode | The value full-apivfs (the default) sets up
private /dev, /proc,
/sys, /tmp and /var/tmp file systems
in a separate user name space
|
| security.virtualisation.flushL1DataCache | Whether the hypervisor should flush the L1 data cache before
entering guests
|
| services.maubot.settings.plugin_directories | Plugin directory paths
|
| virtualisation.oci-containers.containers.<name>.volumes | List of volumes to attach to this container
|
| services.postfix.settings.main.smtpd_tls_chain_files | List of paths to the server private keys and certificates.
The order of items matters and a private key must always be followed by the corresponding certificate.
https://www.postfix.org/postconf.5.html#smtpd_tls_chain_files
|