Whether to enable Google OS Login

Attrset of dconf profiles

User's access level for changing data.

• view: view only permission.
• add: view and add permissions.
• edit: view, add, and edit permissions.
• sandstorm: permissions from the X-Sandstorm-Permissions request header.

List of permissions that are granted with this password

The permissions of the wrapper program

Keyboard profile to apply at boot time

Profile name, defaults to 'system' (NixOS).

Custom configuration profiles for schroot.

The certificate profile to choose if the CA offers multiple profiles.

The permissions of the wrapper program

Permissions to the UNIX socket, if configured.

The certificate profile to choose if the CA offers multiple profiles.

Ensures that the specified users exist and have at least the ensured permissions

Paths to the Nix profile

Name of the default cryptographic profile chosen from the profile_dir directory.

A file in the format described in fstab(5), used to mount filesystems inside the chroot

Permissions granted for the services.syncoid.user user for local target datasets

Profile access endpoint.

Profile GC root policies.

Whether to enable wshowkeys (displays keypresses on screen on supported Wayland compositors)

The profile file contents

Permissions granted for the services.syncoid.user user for local source datasets

A list of files to copy into the chroot from the host system.

The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM

Profile hook scripts.

Permissions granted for the services.syncoid.user user for local target datasets

Profiles for TuneD

The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM

Retention period for the GC roots in this profile.

Per output profile configuration.

The named AWS profile used to authenticate.

Directory that contains all cryptographic profiles known to FAPI.

Names of the Disnix profiles to expose in the system's PATH

Keep the latest N GC roots in this profile.

Whether to create the home directory and ensure ownership as well as permissions to match the user.

the path passed to qbittorrent via --profile.

The content of /etc/asusd/profile.ron

Permissions to ensure for the user, specified as attribute set

System databases (as described in /etc/nsswitch.conf on GNU/Linux systems) to copy into the chroot from the host.

Text of the file.

Sets the pointer acceleration profile to the given profile

The maximum charge level to help reduce battery wear:

• high_capacity charges to 100% (driver default)
• balanced charges to 90%
• stationary charges to 80% (maximum lifespan)

Note: Regardless of the configured charging profile, the operating system will always report the battery as being charged to 100%.

A list of profiles used to setup the global environment.

Makes user-profiles globally available under nextcloud.tld/u/user.name

Permissions granted for the services.syncoid.user user for local source datasets

Whether to create the home directory and ensure ownership as well as permissions to match the user.

Set group-write permissions on a USB device

Autorandr profiles specification.

Attribute set of environment variable

Sets the pointer acceleration profile to the given profile

Path of the source file.

Whether to enable this angrr policy.

Specifies the directory where Memos will store its data.

Map of PPD profiles to native TuneD profiles.

The power-profiles-daemon package to use.

The work directory for CFSSL.

The directory where MPD stores its state, tag cache, playlists etc

Whether to enable power-profiles-daemon, a DBus daemon that allows changing system behavior based upon user-selected power profiles.

Directory for storing Caddy access logs.

Extends the systemd unit with permissions to allow for the use of the eXpress Data Path (XDP).

Serial port for the Z-Wave controller

The data directory for MySQL.

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

The NATS data directory

Only allow members of the wheel group to execute sudo by setting the executable's permissions accordingly

A list of profiles to enable

The directory to store all user data, such as flow and credential files and all library data

The Sonarr home directory used to store all data

Whether to keep the last booted system generation

The data directory for caddy.

Whether to keep the current system generation

The directory where Galene stores its internal state

Path to TLS certificate

This option effectively allows adding setuid/setgid bits, capabilities, changing file ownership and permissions of a program without directly modifying it

The prosody home directory used to store all data

The directory where owncast stores its data files

A file containing SQL statements to be executed on the first startup

Output DPI configuration.

Wallet file

Output resolution.

Output framerate.

Location for any persistent data Traefik creates, such as the ACME certificate store.

Niceness.

Output video display controller.

CPU scheduler priority.

Path the service has access to

IO scheduler priority.

Named AWS profile used to connect to the API.

CPU scheduler class.

Change permissions for the socket

Output gamma configuration.

IO scheduler class.

The data directory for goeland where the database will reside if using the unseen filter

The gitolite home directory used to store all repositories

Credentials and permissions for accessing the mpd server.

Vertical scaling factor/pixels.

Horizontal scaling factor/pixels.

Whether to enable the output.

Output rotate configuration.

This tells the USBGuard daemon which file to load as policy rule set

A path of a profile file to include

The physical device name to listen on

Process matchers.

The group to use for settings permissions

Configuration for Nomad

This directory is used for uploads of pictures

Whether output should be marked as primary

The directory where Duplicati stores its data files.

Declaratively define NetworkManager profiles

File containing the SMTP password

Location of a file containing the SMTP password

Whether to allow users in the 'wireshark' group to capture USB traffic

Output scaling method.

Whether to enable the Profile Sync daemon.

Output position

Where to store the backups

Whether to configure permissions to allow integration with Postfix.

Preswitch hook executed before mode switch.

Output scale configuration

The read permissions to include for this token

Predetect hook executed before autorandr attempts to run xrandr.

Directory where aMule moves completed downloads

Path where the socket should be created when protocol=socket

File containing the Flask secret key

Location of the Django secret key

The read permissions to include for this token

Attribute set of environment variable used in the global environment

The directory or NFS/SMB network share where MPD reads music from

The data directory for PostgreSQL

List of groups allowed to operate with the config

List of users allowed to operate with the config. "root" is always implicitly included

The directory where config.txt and serversettings.json is saved

Host of the postgresql server

Postswitch hook executed after mode switch.

Postgresql database user with read-only permissions used for Nominatim web API service.

Refer to xrandr(1) for the documentation of the transform matrix.

File containing the JWT private key

This directory is used for uploads of pictures

A file containing a connection string for the database

Output name to EDID mapping

Directory for storing certificates to be used by Neo4j for TLS connections

Host of the postgresql server

A file containing a secure random string

The directory where MPD stores playlists

Unix Permissions in octal on the rtorrent directory.

File permissions on the UNIX domain socket.

Whether to run reaction as root

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

The data directory for PostgreSQL

Path of the subvolume or mount point

The name of the device that should be remapped

Permissions on the UNIX socket.

Path of the data directory

The directory used to store all data for healthchecks.

Directories to search for profiles, separated by , or ;.

Bulk PDF import from consume directory

Named AWS profile used to connect to the API.

This directory is used for uploads of attachments and cache

Base directory used for logging.

Host of the postgresql server

Extra permission groups to attach to the KMonad instance for this keyboard

If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad ("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").

(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@" followed by the name of an abstract socket ("@myvarnishd") accept connections on a Unix domain socket

As an alternative to specifying config, you can specify the path to the evaluated NixOS system configuration, typically a symlink to a system profile.

Path to directory of CRLs (Certificate Revocation Lists) in PEM format

File containing an API key to talk to the Immich server

API key to talk to the Immich server

default permissions for all unauthenticated accesses.

Path to directory of X.509 certificates in PEM format for trusted parties

Automatically login user on remote or other kind of externally supplied authentication, otherwise redirect to login form as normal

Port that the /debug/pprof endpoint will listen on.

The mandatory base directory for cryptographic objects of this policy

The ASF home directory used to store all data

Grant capabilities to the uWSGI instance

Path used for the database file.

Whether to enable incusd, a daemon that manages containers and virtual machines

The input method configure in profile file in ini format.

To configure Slack auth, you'll need to create an Application at https://api.slack.com/apps

When configuring the Client ID, add a redirect URL under "OAuth & Permissions" to https://[publicUrl]/auth/slack.callback.

Specifies the path to a file containing the clear text password for the MQTT user

Whether to add the activation script to the system profile

Path to a file containing the Cloudflare API authentication token

The directory or URI where MPD reads music from

Additional groups under which Traefik runs

The directory to store the database files in

The path to a file containing the API key

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Cursor acceleration (how fast speed increases from minSpeed to maxSpeed)

Account certificate file, necessary to create, delete and manage tunnels

Default PPD profile.

This is the name that will be displayed by NetworkManager and GUIs.

Whether to enable API access for mobile apps and third-party clients (Google Reader API and Fever API)

The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.

Specifies the path to a file containing the hashed password for the MQTT user

Grants the user created inherit permissions

Enable CIS Hardening for RKE2

Grants the user, created by the ensureUser attr, createdb permissions

Account certificate file, necessary to create, delete and manage tunnels

Sets the step between the points of the scroll acceleration function

The directory where MPD stores playlists

Sets the step between the points of the (pointer) motion acceleration function

Cursor acceleration (how fast speed increases from minSpeed to maxSpeed)

Grants all permissions in the associated organization.

Grants the user, created by the ensureUser attr, login permissions

File permissions on the UNIX domain socket.

The default permissions (in octal) to create the UNIX socket with.

Mounts to be added to every container under the Nvidia CDI profile.

Whether to enable Libravatar as profile picture source on your instance

Grants the user, created by the ensureUser attr, replication permissions

Grants all permissions in all organizations.

Grants the user, created by the ensureUser attr, superuser permissions

Sets the points of the scroll acceleration function

Sets the points of the (pointer) motion acceleration function

Hide profile banner.

Path to the postgres socket directory

The profile file to load from "/var/lib/OpenRGB" at startup.

Sets the step between the points of the fallback acceleration function

A separate activation script package that's not part of the system profile

The set of packages that appear in /run/current-system/sw

Sets the step between the points of the scroll acceleration function

Grants the user, created by the ensureUser attr, replication permissions

Sets the step between the points of the (pointer) motion acceleration function

Sets the points of the fallback acceleration function

Grants the user, created by the ensureUser attr, createrole permissions

If the conflict.rateLimitIsAggregate option is true, then after each tick one point of conflict-credit is given to just one domain: the one at the front of the queue

When disabled, unprivileged users will not be able to create new namespaces

A set of environment variables used in the global environment

Square profile pictures.

Sets the points of the scroll acceleration function

Make profile sidebar stick to top.

Sets the points of the (pointer) motion acceleration function

The default permissions (in octal) to create the UNIX socket with.

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Sets the step between the points of the fallback acceleration function

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Whether to enable the AppArmor Mandatory Access Control system

Process profile assignments.

Sets the points of the fallback acceleration function

Free-form settings mapped to the qBittorrent.conf file in the profile

Whether to enable killing of processes which have an AppArmor profile enabled (in security.apparmor.policies) but are not confined (because AppArmor can only confine new processes)

Whether the service discovery should list all instances for all projects

Set to true to disable the use of Gravatar for user profile images.

UUID of the connection profile

UUIDs are assigned once on connection creation and should never change as long as the connection still applies to the same network.

Additional scripts for WirePlumber to be used by configuration files