security.acme.certs.<cert>.group ‐ NixOS ‐ Searchix

Search Nix packages and options from NixOS, Darwin, Home Manager, Nix Packages and NUR

Indexing last ran 13 hours ago, will run again in 10 hours.

NixOS options search

Title	Description
services.reposilite.useACMEHost	Host of an existing Let's Encrypt certificate to use for SSL
security.acme.certs.<name>.group	Group running the ACME client.
security.acme.certs	Attribute set of certificates to get signed and renewed
security.acme.defaults	Default values inheritable by all configured certs
services.prometheus.exporters.node-cert.group	Group under which the node-cert exporter shall be run.
services.molly-brown.certPath	Path to TLS certificate
security.acme.certs.<name>.csr	Path to a certificate signing request to apply when fetching the certificate.
security.acme.certs.<name>.csrKey	Path to the private key to the matching certificate signing request.
security.acme.certs.<name>.keyType	Key type to use for private keys
security.acme.certs.<name>.postRun	Commands to run after new certificates go live
security.acme.certs.<name>.email	Email address for account creation and correspondence from the CA
security.acme.certs.<name>.domain	Domain to fetch certificate for (defaults to the entry name).
security.acme.certs.<name>.validMinDays	Minimum remaining validity before renewal in days.
security.acme.certs.<name>.s3Bucket	S3 bucket name to use for HTTP-01 based challenges
security.acme.certs.<name>.server	ACME Directory Resource URI
security.acme.certs.<name>.profile	The certificate profile to choose if the CA offers multiple profiles.
security.acme.certs.<name>.listenHTTP	Interface and port to listen on to solve HTTP challenges in the form `[INTERFACE]:PORT`
security.acme.certs.<name>.extraLegoFlags	Additional global flags to pass to all lego commands.
security.acme.certs.<name>.webroot	Where the webroot of the HTTP vhost is located. .well-known/acme-challenge/ directory will be created below the webroot if it doesn't exist. `http://example.org/.well-known/acme-challenge/` must also be available (notice unencrypted HTTP).
security.acme.certs.<name>.extraLegoRunFlags	Additional flags to pass to lego run.
security.acme.certs.<name>.ocspMustStaple	Turns on the OCSP Must-Staple TLS extension
security.acme.certs.<name>.enableDebugLogs	Whether to enable debug logging for this certificate.
security.acme.certs.<name>.extraLegoRenewFlags	Additional flags to pass to lego renew.
security.acme.certs.<name>.extraDomainNames	A list of extra domain names, which are included in the one certificate to be issued.
security.acme.certs.<name>.dnsProvider	DNS Challenge provider
security.acme.certs.<name>.dnsResolver	Set the resolver to use for performing recursive DNS queries
security.acme.certs.<name>.directory	Directory where certificate and other state is stored.
security.acme.certs.<name>.renewInterval	Systemd calendar expression when to check for renewal
security.acme.certs.<name>.reloadServices	The list of systemd services to call `systemctl try-reload-or-restart` on.
security.acme.certs.<name>.inheritDefaults	Whether to inherit values set in `security.acme.defaults` or not.
security.acme.certs.<name>.credentialFiles	Environment variables suffixed by "_FILE" to set for the cert's service for your selected dnsProvider
security.acme.certs.<name>.environmentFile	Path to an EnvironmentFile for the cert's service containing any required and optional environment variables for your selected dnsProvider
security.acme.defaults.group	Group running the ACME client.
security.acme.certs.<name>.dnsPropagationCheck	Toggles lego DNS propagation check, which is used alongside DNS-01 challenge to ensure the DNS entries required are available.
security.agnos.group	Group to run Agnos as
security.pam.ussh.group	If set, then the authenticating user must be a member of this group to use this module.
users.users.<name>.group	The user's primary group.
services.etcd.certFile	Cert file to use for clients
power.ups.upsmon.group	Group for the default `nutmon` user
services.ocis.group	The group to run oCIS under
services.coturn.cert	Certificate file in PEM format.
services.node-red.group	Group under which Node-RED runs
services.qui.group	Group to run qui as.
services.znc.group	Group to own the ZNC process.
security.wrappers.<name>.group	The group of the wrapper program.
services.h2o.group	Group running H2O services
services.bee.group	Group the bee binary should execute under.
services.mpd.group	Group account under which MPD runs.
services.vdr.group	Group under which the VDRvdr service runs.
users.extraUsers.<name>.group	The user's primary group.
programs.nncp.group	The group under which NNCP files shall be owned
services.caddy.group	Group under which caddy runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the Caddy service starts.
services.nats.group	Group under which NATS runs.
services.ombi.group	Group under which Ombi runs.
services.plex.group	Group under which Plex runs.
services.ente.api.group	Group under which museum runs
services.maddy.group	Group account under which maddy runs. If left as the default value this group will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the group exists before the maddy service starts.
services.ergo.group	The group as which to run the Ergo node.
services.kubo.group	Group under which the Kubo daemon runs
services.loki.group	Group under which the Loki service runs.
services.unit.group	Group account under which unit runs.
services.nscd.group	User group under which nscd runs.
services.tcsd.group	Group account under which tcsd runs.
services.bird-lg.group	Group to run the service.
services.guix.group	The group of the Guix build user pool.
services.exim.group	Group to use when no root privileges are required.
services.nifi.group	Group account where Apache NiFi runs.
services.db-rest.group	Group under which db-rest runs.
services.hitch.group	The group to run as
services.patroni.group	The group for the service
hardware.i2c.group	Grant access to i2c devices (/dev/i2c-*) to users in this group.
services.ntfy-sh.group	Primary group of ntfy-sh user.
services.cyrus-imap.group	Cyrus IMAP group name
services.ytdl-sub.group	Group under which ytdl-sub runs.
services.gitea.group	Group under which gitea runs.
services.davis.group	Group davis runs as.
services.komga.group	Group under which Komga runs.
services.dspam.group	Group for the dspam daemon.
services.amule.group	Group under which amule runs
services.seatd.group	Group to own the seatd socket
services.nexus.group	Group which runs Nexus3.
services.slskd.group	Group under which slskd runs.
services.omnom.group	The Omnom service group.
services.mlmmj.group	mailinglist local group
services.stash.group	Group under which Stash runs.
services.sonarr.group	Group account under which Sonarr runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the Sonarr service starts.
services.memos.group	The group to run Memos as. If changing the default value, you are responsible of creating the corresponding group with `users.groups`.
services.prosody.ssl.cert	Path to the certificate file.
services.murmur.group	The name of an existing group to use to run the service
services.hound.group	Group the hound daemon should execute under.
services.bosun.group	Group account under which bosun runs.
services.legit.group	Group account under which legit runs.
services.nginx.group	Group account under which nginx runs.
services.movim.group	Group running Movim service
services.rqbit.group	Group account under which rqbit runs.
services.uwsgi.group	Group account under which uWSGI runs.
services.snipe-it.group	Group snipe-it runs as.
services.github-runners.<name>.group	Group under which to run the service
services.felix.group	Group account under which Apache Felix runs.
services.httpd.group	Group under which httpd children processes run.
services.cgit.<name>.group	Group to run the cgit service as.
services.coder.group	Group under which the coder service runs. If left as the default value this group will automatically be created on system activation, otherwise it needs to be configured manually.
services.outline.group	Group under which the service should run
services.webhook.group	Webhook will be run under this group
programs.cdemu.group	Group that users must be in to use `cdemu`.
services.ollama.group	Group under which to run ollama
services.prosody.group	Group account under which prosody runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the prosody service starts.
services.documize.cert	The cert.pem file used for https.
hardware.cpu.amd.sev.group	Group to assign to the SEV device.
services.code-server.group	The group to run code-server under
services.quorum.group	The group as which to run quorum.
services.atticd.group	The group under which attic runs.
services.bazarr.group	Group under which bazarr runs.
services.lidarr.group	Group under which Lidarr runs.
services.immich.group	The group immich should run as.
services.artalk.group	Artalk group name.
services.deluge.group	Group under which deluge runs.
services.kismet.group	The group to run Kismet as.
services.galene.group	Group under which galene runs.
services.opkssh.group	System group for opkssh
services.nzbget.group	Group under which NZBGet runs
services.pretix.group	Group under which pretix should run.
services.radarr.group	Group under which Radarr runs.
services.monica.group	Group monica runs as.
services.webdav.group	Group under which WebDAV runs.
services.zammad.group	Name of the Zammad group.
hardware.cpu.x86.msr.group	Group to set for devices of the `msr` kernel subsystem.
services.pgmanage.tls.cert	TLS certificate
services.flarum.group	System group to run Flarum
services.akkoma.group	Group account under which Akkoma runs.
services.cross-seed.group	Group to run cross-seed as.
programs.ccache.group	Group owner of CCache directory
services.sftpgo.group	Group name under which SFTPGo runs.
services.mysql.group	Group account under which MySQL runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the MySQL service starts.
services.flannel.etcd.certFile	Etcd cert file
services.gollum.group	Specifies the owner group of the wiki directory
services.baikal.group	Group account under which the web-application run.
services.gitlab.group	Group to run gitlab and all related services.
services.tomcat.group	Group account under which Apache Tomcat runs.
services.rspamd.group	Group to use when no root privileges are required.
services.pihole-ftl.group	Group to run the service as.
services.firefly-iii.group	Group under which firefly-iii runs
services.pyload.group	Group under which pyLoad runs, and which owns the download directory.
services.pocket-id.group	Group account under which Pocket ID runs.
services.gitDaemon.group	Group under which Git daemon would be running.
services.rss-bridge.group	The group under which the web application runs.
services.zeyple.group	Group to use to run Zeyple. If left as the default value this group will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the user exists.
services.dolibarr.group	Group account under which dolibarr runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the dolibarr application starts.
services.pixelfed.group	Group account under which pixelfed runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the pixelfed application starts.
services.ttyd.certFile	SSL certificate file path.
services.kubernetes.pki.certs	List of certificate specs to feed to cert generator.
services.syncoid.group	The group for the service.
services.jupyter.group	Name of the group used to run the jupyter service
services.traefik.group	Primary group under which Traefik runs
services.gocd-agent.group	If the default user "gocd-agent" is configured then this is the primary group of that user.
services.public-inbox.imap.cert	Path to TLS certificate to use for connections to public-inbox-imapd(1).
services.public-inbox.nntp.cert	Path to TLS certificate to use for connections to public-inbox-nntpd(1).
services.roon-bridge.group	Group to run the Roon Bridge as.
services.roon-server.group	Group to run the Roon Server as.
services.seafile.group	Group under which seafile runs.
services.icecast.group	Group privileges for the server.
services.corteza.group	The group to run Corteza under.
services.jackett.group	Group under which Jackett runs.
services.homebox.group	Group under which Homebox runs.
services.forgejo.group	Group under which Forgejo runs.
services.owncast.group	Group under which owncast runs.
services.sabnzbd.group	Group to run the service as
services.readarr.group	Group under which Readarr runs.
services.pretalx.group	Group under which pretalx should run.
services.netdata.group	Group under which netdata runs.
services.pdfding.group	Group under which PdfDing runs
services.redmine.group	Group under which Redmine is ran.
services.polaris.group	Group under which Polaris is run.
services.stunnel.group	The group under which stunnel runs.
services.monetdb.group	Group under which MonetDB runs.
services.unbound.group	Group under which unbound runs.
services.zitadel.group	The group to run ZITADEL under.
services.zerobin.group	The group 0bin should run as
services.certspotter.startAtEnd	Whether to skip certificates issued before the first launch of Cert Spotter
services.haproxy.group	Group account under which haproxy runs.
services.couchdb.group	Group account under which couchdb runs.
services.pleroma.group	Group account under which pleroma runs.
security.duosec.groups	If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated pattern lists
services.usbmuxd.group	The group usbmuxd should use to run after startup.
hardware.cpu.amd.sevGuest.group	Group to assign to the SEV guest device.
programs.ydotool.group	Group which users must be in to use `ydotool`.
services.postfix.group	What to call the Postfix group (must be used only for postfix).
services.podgrab.group	Group under which Podgrab runs, and which owns the download directory.
services.synergy.server.tls.cert	The TLS certificate to use for encryption.
services.syncthing.cert	Path to the `cert.pem` file, which will be copied into Syncthing's configDir.
services.gocd-server.group	If the default user "gocd-server" is configured then this is the primary group of that user.
services.jenkins.group	If the default user "jenkins" is configured then this is the primary group of that user.
services.calibre-web.group	Group account under which Calibre-Web runs.
services.rsync.jobs.<name>.group	The name of an existing user group under which the rsync process should run.
services.redis.servers.<name>.group	Group account under which this instance of redis-server runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the redis service starts.
services.matrix-tuwunel.group	The group `tuwunel` is run as
services.opencloud.group	The group to run OpenCloud under
services.syncthing.group	The group to run Syncthing under
services.dovecot2.group	Dovecot group name.
services.lavalink.group	The group of the service.
services.opendkim.group	Group for the daemon.
services.postsrsd.group	Group for the daemon
services.lxd-image-server.group	Group assigned to the user and the webroot directory.
services.dawarich.group	Group under which dawarich runs.
services.crowdsec.group	The group to run crowdsec as
services.jellyfin.group	Group under which jellyfin runs.
services.agorakit.group	Group agorakit runs as.
services.ejabberd.group	Group under which ejabberd is ran
services.librenms.group	Name of the LibreNMS group.
services.influxdb.group	Group under which influxdb runs
services.kanboard.group	Group under which Kanboard runs.
services.ersatztv.group	Group under which ErsatzTV runs.
services.rtorrent.group	Group under which rtorrent runs.
services.olivetin.group	The group under which OliveTin runs.
services.peertube.group	Group under which Peertube runs.
services.stalwart.group	Group ownership of service
services.tautulli.group	Group under which Tautulli runs.
services.mastodon.group	Group under which mastodon runs.
services.sniproxy.group	Group under which sniproxy runs.
services.whisparr.group	Group under which Whisparr runs.
services.actual.group	Group account under which Actual runs
services.openldap.group	Group account under which slapd runs.
services.opentsdb.group	Group account under which OpenTSDB runs.
services.oxidized.group	Group under which the oxidized service runs.
services.nebula.networks.<name>.cert	Path to the host certificate.
services.gitolite.group	Primary group of the Gitolite user account.
services.portunus.group	Group account under which Portunus runs its webserver.
services.pingvin-share.group	Group under which Pingvin Share runs.
services.gammu-smsd.device.group	Owner group of the device
services.webdav-server-rs.group	Group to run under when setuid is not enabled.
services.klipper.group	Group account under which Klipper runs
boot.initrd.systemd.users.<name>.group	Group the user belongs to in initrd.
services.phpfpm.pools.<name>.group	Group account under which this pool runs.
services.nginx.gitweb.group	Group that the CGI process will belong to. (Set to `config.services.gitolite.group` if you are using gitolite.)
services.bitcoind.<name>.group	The group as which to run bitcoind.
services.temporal.group	The group temporal runs as
services.quickwit.group	The group quickwit runs as
services.mjpg-streamer.group	mjpg-streamer group name.
services.inadyn.group	Group account under which inadyn runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the inadyn service starts.
services.calibre-server.group	The group under which calibre-server runs.
services.privatebin.group	Group under which privatebin runs
services.octoprint.group	Group for the daemon.
services.jenkinsSlave.group	If the default slave agent user "jenkins" is configured then this is the primary group of that user.
services.bookstack.group	Group bookstack runs as
services.commafeed.group	Group under which CommaFeed runs.
services.glitchtip.group	The group under which GlitchTip runs.
hardware.bumblebee.group	Group for bumblebee socket
services.blendfarm.group	Group under which blendfarm runs.
services.kapacitor.group	Group under which Kapacitor runs
services.librechat.group	The group to run the service as.
services.pinchflat.group	Group under which Pinchflat runs.
services.navidrome.group	Group under which Navidrome runs.
services.recyclarr.group	Group under which recyclarr runs.
services.sickbeard.group	Group to run the service as
services.pgbouncer.group	The group pgbouncer is run as.
services.headscale.group	Group under which headscale runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the headscale service starts.
services.charybdis.group	Charybdis IRC daemon group.
services.cassandra.group	Run Apache Cassandra under this group.
hardware.ubertooth.group	Group for Ubertooth's udev rules.
services.bitmagnet.group	Group of user running bitmagnet
services.stargazer.group	Group account under which stargazer runs.
services.rethinkdb.group	Group which rethinkdb user belongs to.
services.moonraker.group	Group account under which Moonraker runs.
services.rutorrent.group	Group which runs the ruTorrent service.
services.mediatomb.group	Group account under which the service runs.
services.galene.certFile	Path to the server's certificate
services.portunus.ldap.group	Group account under which Portunus runs its LDAP server.
services.varnish.listen.*.group	Group name who owns the socket file.
services.movim.h2o.acme.useHost	An existing Let’s Encrypt certificate to use for this virtual host
services.certspotter.enable	Whether to enable Cert Spotter, a Certificate Transparency log monitor.
services.prosody.virtualHosts.<name>.ssl.cert	Path to the certificate file.
programs.k40-whisperer.group	Group assigned to the device when connected.
services.tandoor-recipes.group	Group under which Tandoor runs.
services.infinoted.group	What to call the primary group of the dedicated user under which infinoted is run
services.certspotter.extraFlags	Extra command-line arguments to pass to Cert Spotter
users.groups.<name>.members	The user names of the group members, added to the `/etc/group` file.
services.doh-server.useACMEHost	A host of an existing Let's Encrypt certificate to use. Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using security.acme.certs.
services.buildbot-master.group	Primary group of buildbot user.
services.peertube-runner.group	Group under which peertube-runner runs.
services.suwayomi-server.group	Group under which Suwayomi-Server runs.
services.plantuml-server.group	Group which runs PlantUML server.
services.h2o.hosts.<name>.acme.useHost	An existing Let’s Encrypt certificate to use for this virtual host
services.llama-swap.tls.certFile	Path to the TLS certificate file
services.buildbot-worker.group	Primary group of buildbot Worker user.
services.tailscaleAuth.group	Group which runs tailscale-nginx-auth
system.nssDatabases.group	List of group entries to configure in /etc/nsswitch.conf
security.tpm2.fapi.ekCertLess	A switch to disable Endorsement Key (EK) certificate verification
services.firefly-iii-data-importer.group	Group under which firefly-iii-data-importer runs
services.samba.usershares.group	Name of the group members of which will be allowed to create usershares
services.taskserver.group	Group for Taskserver.
services.yggdrasil.group	Group to grant access to the Yggdrasil control socket
services.borgbackup.jobs.<name>.group	The group borg is run as
services.headphones.group	Group to run the service as
services.homebridge.group	Group to run homebridge as.
services.govee2mqtt.group	Group under which Govee2MQTT should run.
services.photoprism.group	Group under which photoprism runs.
services.szurubooru.group	Group under which Szurubooru runs.
services.microsocks.group	Group microsocks runs as.
services.linkwarden.group	The group Linkwarden should run as.
services.lubelogger.group	Group under which LubeLogger runs.
services.reposilite.group	The group to run Reposilite under.
services.syncplay.certDir	TLS certificates directory to use for encryption
services.openvscode-server.group	The group to run openvscode-server under
users.groups.<name>.gid	The group GID
services.mattermost.group	Group which runs the Mattermost service.
services.scollector.group	Group account under which scollector runs.
services.healthchecks.group	Group account under which healthchecks runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the group exists before the healthchecks service starts.
services.shairport-sync.group	Group account name under which to run shairport-sync
services.nullmailer.group	Group to use to run nullmailer-send.
services.gns3-server.ssl.certFile	Path to the SSL certificate file
services.journald.gateway.cert	The path to a file or `AF_UNIX` stream socket to read the server certificate from
services.sourcehut.hg.group	Group for hg.sr.ht
services.borgbackup.repos.<name>.group	The group `borg serve` is run as
services.mailman.ldap.groupSearch.type	Type of group to perform a group search against.
services.komodo-periphery.group	Group under which the Periphery agent runs.
services.cloudflare-ddns.group	Group under which the service runs.
services.sourcehut.man.group	Group for man.sr.ht
services.sourcehut.git.group	Group for git.sr.ht
services.sourcehut.hub.group	Group for hub.sr.ht
services.opensearch.group	The group OpenSearch runs as
users.groups.<name>.name	The name of the group
services.silverbullet.group	The group to run Silverbullet under
services.sourcehut.todo.group	Group for todo.sr.ht
services.sourcehut.meta.group	Group for meta.sr.ht
services.ghostunnel.servers.<name>.cert	Path to certificate (PEM with certificate chain)
services.dolibarr.h2o.acme.useHost	An existing Let’s Encrypt certificate to use for this virtual host
services.hbase-standalone.group	Group account under which HBase runs.
services.netbird.tunnels.<name>.user.group	A system group name for this client instance.
services.netbird.clients.<name>.user.group	A system group name for this client instance.
services.filebrowser.group	Group under which FileBrowser runs.
services.meshtasticd.group	Group meshtasticd runs as.
services.qbittorrent.group	Group under which qbittorrent runs.
services.writefreely.group	Group under which Writefreely is ran.
services.taskserver.pki.manual.ca.cert	Fully qualified path to the CA certificate. Setting this option will prevent automatic CA creation and handling.
environment.etc.<name>.group	Group name of file owner
services.sourcehut.paste.group	Group for paste.sr.ht
services.sourcehut.lists.group	Group for lists.sr.ht
services.sourcehut.pages.group	Group for pages.sr.ht
services.stargazer.certOrg	The name of the organization responsible for the X.509 certificate's /O name.
services.keepalived.vrrpScripts.<name>.group	Name of group to run the script under
services.vdirsyncer.jobs.<name>.group	group to run vdirsyncer as
hardware.cpu.intel.sgx.provision.group	Group to assign to the SGX provisioning device.
services.sillytavern.group	Group account under which the web-application run.
services.wyoming.satellite.group	Group to run wyoming-satellite under.
services.maddy.tls.certificates.*.certPath	Path to the certificate used for TLS.
services.vault-agent.instances.<name>.group	Group under which this instance runs.
services.cockroachdb.certsDir	The path to the certificate directory.
services.thanos.rule.grpc-server-tls-cert	TLS Certificate for gRPC server, leave blank to disable TLS
services.sourcehut.builds.group	Group for builds.sr.ht
services.thanos.query.grpc-client-tls-cert	TLS Certificates to use to identify this client to the server
services.davis.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.movim.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.slskd.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.snipe-it.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.suricata.settings.run-as.group	Run Suricata with a specific group-id.
services.gitlab.registry.certFile	Path to GitLab container registry certificate.
services.librespeed.useACMEHost	Use a certificate generated by the NixOS ACME module for the given host
services.thanos.query.grpc-server-tls-cert	TLS Certificate for gRPC server, leave blank to disable TLS
services.thanos.store.grpc-server-tls-cert	TLS Certificate for gRPC server, leave blank to disable TLS
services.taskserver.pki.manual.server.cert	Fully qualified path to the server certificate. Setting this option will prevent automatic CA creation and handling.
services.mail.sendmailSetuidWrapper.group	The group of the wrapper program.
services.kubernetes.apiserver.etcd.certFile	Etcd cert file.
security.tpm2.tssGroup	Group of the tpm kernel resource manager (tpmrm) device-group, set if applyUdevRules is set.
services.akkoma.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.gancio.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.fluidd.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.matomo.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.monica.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.anubis.defaultOptions.group	The group under which Anubis is run
services.athens.storage.mongo.certPath	Path to the certificate file for the mongo database.
systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group	The group of the file
services.anubis.instances.<name>.group	The group under which Anubis is run
services.blockbook-frontend.<name>.group	The group as which to run blockbook-frontend-‹name›.
services.foundationdb.group	Group account under which FoundationDB runs.
services.matterbridge.group	Group which runs the matterbridge service.
services.transmission.group	Group account under which Transmission runs.
security.sudo.extraRules.*.runAs	Under which user/group the specified command is allowed to run
services.portunus.ldap.tls	Whether to enable LDAPS protocol
services.prometheus.exporters.chrony.group	Group under which the chrony exporter shall be run
services.authelia.instances.<name>.group	The name of the group for this authelia instance.
security.sudo-rs.extraRules.*.runAs	Under which user/group the specified command is allowed to run
services.privoxy.certsLifetime	If `inspectHttps` is enabled, the time generated HTTPS certificates will be stored in a temporary directory for reuse
services.prometheus.exporters.frr.group	Group under which the frr exporter shall be run
services.mailman.ldap.groupSearch.ou	Organizational unit to look up a group.
services.xserver.desktopManager.phosh.group	The group to run the Phosh service.
services.wstunnel.servers.<name>.useACMEHost	Use a certificate generated by the NixOS ACME module for the given host
services.komodo-periphery.ssl.certFile	Path to SSL certificate file.
services.prometheus.exporters.node-cert.enable	Whether to enable the prometheus node-cert exporter.
services.hostapd.radios.<name>.networks.<name>.group	Members of this group can access the control socket for this interface.
services.thanos.sidecar.grpc-server-tls-cert	TLS Certificate for gRPC server, leave blank to disable TLS
services.thanos.receive.grpc-server-tls-cert	TLS Certificate for gRPC server, leave blank to disable TLS
users.groups	Additional groups to be created automatically by the system.
services.caddy.virtualHosts.<name>.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.nginx.tailscaleAuth.group	Alias of `services.tailscaleAuth.group`.
services.librenms.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.kanboard.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.agorakit.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.dolibarr.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.fediwall.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.pixelfed.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.mainsail.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.prometheus.exporters.node-cert.extraFlags	Extra commandline options to pass to the node-cert exporter.
services.consul-template.instances.<name>.group	Group under which this instance runs.
services.matrix-continuwuity.group	The group `continuwuity` is run as.
services.wasabibackend.group	The group as which to run the wasabibackend node.
services.moodle.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.nagios.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group	The group of the file
services.radicle.httpd.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.nextcloud-spreed-signaling.group	Group under which to run the Spreed signaling server.
services.mailman.ldap.groupSearch.query	Query to find a group associated to a user in the LDAP database.
programs.ssh.knownHosts.<name>.certAuthority	This public key is an SSH certificate authority, rather than an individual host's key.
services.httpd.virtualHosts.<name>.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.anuko-time-tracker.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.nginx.virtualHosts.<name>.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.fcgiwrap.instances.<name>.socket.group	Group to be set as owner of the UNIX socket.
services.stargazer.certLifetime	How long certs generated by Stargazer should live for
services.taskchampion-sync-server.group	Unix Group to run the server under
services.cockroachdb.group	User account under which CockroachDB runs
services.certspotter.hooks	Scripts to run upon the detection of a new certificate
services.bookstack.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
security.ipa.certificate	IPA server CA certificate
services.prometheus.exporters.postfix.group	Group under which the postfix exporter shall be run
services.prometheus.exporters.sql.group	Group under which the sql exporter shall be run.
services.prometheus.exporters.nut.group	Group under which the nut exporter shall be run.
services.prometheus.exporters.kea.group	Group under which the kea exporter shall be run.
services.prometheus.exporters.pve.group	Group under which the pve exporter shall be run.
services.prometheus.exporters.zfs.group	Group under which the zfs exporter shall be run.
services.prometheus.exporters.lnd.group	Group under which the lnd exporter shall be run.
virtualisation.podman.networkSocket.tls.cert	Path to certificate describing the server.
services.certspotter.package	The certspotter package to use.
services.prometheus.exporters.flow.group	Group under which the flow exporter shall be run.
services.prometheus.exporters.mail.group	Group under which the mail exporter shall be run.
services.prometheus.exporters.snmp.group	Group under which the snmp exporter shall be run.
services.prometheus.exporters.bind.group	Group under which the bind exporter shall be run.
services.prometheus.exporters.bird.group	Group under which the bird exporter shall be run.
services.prometheus.exporters.mqtt.group	Group under which the mqtt exporter shall be run.
services.prometheus.exporters.ebpf.group	Group under which the ebpf exporter shall be run.
services.prometheus.exporters.ipmi.group	Group under which the ipmi exporter shall be run.
services.prometheus.exporters.knot.group	Group under which the knot exporter shall be run.
services.prometheus.exporters.nats.group	Group under which the nats exporter shall be run.
services.prometheus.exporters.node.group	Group under which the node exporter shall be run.
services.prometheus.exporters.ping.group	Group under which the ping exporter shall be run.
services.prometheus.exporters.json.group	Group under which the json exporter shall be run.
services.sourcehut.settings."todo.sr.ht::mail".sock-group	The lmtp daemon will make the unix socket group-read/write for users in this group.
services.fcgiwrap.instances.<name>.process.group	Group as which this instance of fcgiwrap will be run.
services.prometheus.exporters.php-fpm.group	Group under which the php-fpm exporter shall be run.
security.doas.extraRules.*.groups	The groups / GIDs this rule should apply for.
security.sudo.extraRules.*.groups	The groups / GIDs this rule should apply for.
services.jirafeau.nginxConfig.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.prometheus.exporters.idrac.group	Group under which the idrac exporter shall be run.
services.prometheus.exporters.dmarc.group	Group under which the dmarc exporter shall be run.
services.prometheus.exporters.redis.group	Group under which the redis exporter shall be run.
services.prometheus.exporters.fritz.group	Group under which the fritz exporter shall be run.
services.prometheus.exporters.v2ray.group	Group under which the v2ray exporter shall be run.
services.prometheus.exporters.kafka.group	Group under which the kafka exporter shall be run.
services.prometheus.exporters.jitsi.group	Group under which the jitsi exporter shall be run.
services.prometheus.exporters.nginx.group	Group under which the nginx exporter shall be run.
security.sudo-rs.extraRules.*.groups	The groups / GIDs this rule should apply for.
services.audiobookshelf.group	Group under which Audiobookshelf runs.
services.zabbixWeb.httpd.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.zabbixWeb.nginx.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.libretranslate.group	Group account under which libretranslate runs.
services.thanos.query-frontend.grpc-server-tls-cert	TLS Certificate for gRPC server, leave blank to disable TLS
services.sourcehut.settings."pages.sr.ht".gemini-certs	An absolute file path (which should be outside the Nix-store) to Gemini certificates.
services.librenms.distributedPoller.group	Group(s) of this poller.
services.drupal.sites.<name>.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
networking.wireless.userControlled.group	Members of this group can control wpa_supplicant.
security.pki.certificates	A list of trusted root certificates in PEM format.
services.prometheus.exporters.dnssec.group	Group under which the dnssec exporter shall be run.
services.prometheus.exporters.mysqld.group	Group under which the mysqld exporter shall be run.
services.prometheus.exporters.script.group	Group under which the script exporter shall be run.
services.prometheus.exporters.fastly.group	Group under which the fastly exporter shall be run.
services.prometheus.exporters.deluge.group	Group under which the deluge exporter shall be run.
services.prometheus.exporters.shelly.group	Group under which the shelly exporter shall be run.
services.prometheus.exporters.rspamd.group	Group under which the rspamd exporter shall be run.
services.prometheus.exporters.tibber.group	Group under which the tibber exporter shall be run.
services.prometheus.exporters.restic.group	Group under which the restic exporter shall be run.
services.prometheus.exporters.statsd.group	Group under which the statsd exporter shall be run.
services.prometheus.exporters.domain.group	Group under which the domain exporter shall be run.
services.prometheus.exporters.pihole.group	Group under which the pihole exporter shall be run.
services.dnsdist.dnscrypt.certLifetime	The lifetime (in minutes) of the resolver certificate
boot.initrd.systemd.groups.<name>.gid	ID of the group in initrd.
services.prometheus.exporters.nvidia-gpu.group	Group under which the nvidia-gpu exporter shall be run.
services.sourcehut.settings."lists.sr.ht::worker".sock-group	The lmtp daemon will make the unix socket group-read/write for users in this group.
services.blockbook-frontend.<name>.certFile	To enable SSL, specify path to the name of certificate files without extension
services.prometheus.exporters.rtl_433.group	Group under which the rtl_433 exporter shall be run.
<imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.cert	Path to certificate (PEM with certificate chain)
services.prometheus.exporters.libvirt.group	Group under which the libvirt exporter shall be run.
services.prometheus.exporters.bitcoin.group	Group under which the bitcoin exporter shall be run.
services.prometheus.exporters.dovecot.group	Group under which the dovecot exporter shall be run.
services.prometheus.exporters.sabnzbd.group	Group under which the sabnzbd exporter shall be run.
services.prometheus.exporters.varnish.group	Group under which the varnish exporter shall be run.
services.prometheus.exporters.klipper.group	Group under which the klipper exporter shall be run.
services.prometheus.exporters.unbound.group	Group under which the unbound exporter shall be run.
services.prometheus.exporters.mongodb.group	Group under which the mongodb exporter shall be run.
services.prometheus.exporters.dnsmasq.group	Group under which the dnsmasq exporter shall be run.
services.prometheus.exporters.ecoflow.group	Group under which the ecoflow exporter shall be run.
services.prometheus.exporters.apcupsd.group	Group under which the apcupsd exporter shall be run.
services.prometheus.exporters.process.group	Group under which the process exporter shall be run.
services.prometheus.exporters.systemd.group	Group under which the systemd exporter shall be run.
services.openssh.knownHosts.<name>.certAuthority	This public key is an SSH certificate authority, rather than an individual host's key.
services.resilio.sharedFolders	Shared folder list
services.fedimintd.<name>.nginx.config.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.prometheus.exporters.py-air-control.group	Group under which the py-air-control exporter shall be run.
services.prometheus.exporters.mailman3.group	Group under which the mailman3 exporter shall be run.
security.pki.certificateFiles	A list of files containing trusted root certificates in PEM format
services.prometheus.exporters.mikrotik.group	Group under which the mikrotik exporter shall be run.
services.prometheus.exporters.opnsense.group	Group under which the opnsense exporter shall be run.
services.prometheus.exporters.postgres.group	Group under which the postgres exporter shall be run.
services.prometheus.exporters.nginxlog.group	Group under which the nginxlog exporter shall be run.
services.prometheus.exporters.unpoller.group	Group under which the unpoller exporter shall be run.
services.prometheus.exporters.graphite.group	Group under which the graphite exporter shall be run.
services.prometheus.exporters.fritzbox.group	Group under which the fritzbox exporter shall be run.
services.prometheus.exporters.smartctl.group	Group under which the smartctl exporter shall be run.
services.prometheus.exporters.blackbox.group	Group under which the blackbox exporter shall be run.
services.prometheus.exporters.influxdb.group	Group under which the influxdb exporter shall be run.
services.prometheus.exporters.keylight.group	Group under which the keylight exporter shall be run.
services.prometheus.exporters.collectd.group	Group under which the collectd exporter shall be run.
services.certspotter.sendmailPath	Path to the `sendmail` binary
services.limesurvey.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.changedetection-io.group	Group account under which changedetection-io runs.
services.mediawiki.httpd.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.github-runners.<name>.user	User under which to run the service
services.prometheus.exporters.node-cert.port	Port to listen on.
services.certspotter.watchlist	Domain names to watch
security.doas.extraRules.*.runAs	Which user or group the specified command is allowed to run as
services.prometheus.exporters.node-cert.user	User owning the certs.
services.grafana.settings.smtp.cert_file	File path to a cert file.
services.prometheus.exporters.imap-mailstat.group	Group under which the imap-mailstat exporter shall be run.
services.wordpress.sites.<name>.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
networking.supplicant.<name>.userControlled.group	Members of this group can control wpa_supplicant.
services.prometheus.exporters.borgmatic.group	Group under which the borgmatic exporter shall be run.
services.prometheus.exporters.surfboard.group	Group under which the surfboard exporter shall be run.
services.prometheus.exporters.rasdaemon.group	Group under which the rasdaemon exporter shall be run.
services.prometheus.exporters.nextcloud.group	Group under which the nextcloud exporter shall be run.
services.prometheus.exporters.smokeping.group	Group under which the smokeping exporter shall be run.
services.prometheus.exporters.tailscale.group	Group under which the tailscale exporter shall be run.
services.prometheus.exporters.pgbouncer.group	Group under which the pgbouncer exporter shall be run.
services.prometheus.exporters.wireguard.group	Group under which the wireguard exporter shall be run.
services.prometheus.exporters.junos-czerwonk.group	Group under which the junos-czerwonk exporter shall be run.
services.certmgr.enable	Whether to enable certmgr.
hardware.sane.enable	Enable support for SANE scanners. Users in the "scanner" group will gain access to the scanner, or the "lp" group if it's also a printer.
users.extraGroups.<name>.members	The user names of the group members, added to the `/etc/group` file.
services.prometheus.exporters.node-cert.paths	List of paths to search for SSL certificates.
services.limesurvey.nginx.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.limesurvey.httpd.virtualHost.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.certmgr.validMin	The interval before a certificate expires to start attempting to renew it.
services.outline.user	User under which the service should run
services.kubernetes.kubeconfig.certFile	Default kubeconfig client certificate file used to connect to kube-apiserver.
services.prometheus.exporters.buildkite-agent.group	Group under which the buildkite-agent exporter shall be run.
services.prometheus.exporters.storagebox.group	Group under which the storagebox exporter shall be run.
services.prometheus.exporters.scaphandre.group	Group under which the scaphandre exporter shall be run.
services.certmgr.specs	Certificate specs as described by: https://github.com/cloudflare/certmgr#certificate-specs These will be added to the Nix store, so they will be world readable.
services.misskey.reverseProxy.webserver.caddy.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert	Section for a certificate candidate to use for authentication
services.prometheus.exporters.exportarr-lidarr.group	Group under which the exportarr-lidarr exporter shall be run.
services.prometheus.exporters.exportarr-sonarr.group	Group under which the exportarr-sonarr exporter shall be run.
services.prometheus.exporters.exportarr-bazarr.group	Group under which the exportarr-bazarr exporter shall be run.
services.prometheus.exporters.exportarr-radarr.group	Group under which the exportarr-radarr exporter shall be run.
services.certspotter.emailRecipients	A list of email addresses to send certificate updates to.
services.prometheus.exporters.pve.server.certFile	Path to a SSL certificate file for the server
services.etcd.peerCertFile	Cert file to use for peer to peer communication
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.slot	Optional slot number of the token that stores the certificate.
services.bcg.mqtt.certfile	Certificate file for MQTT server access.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert	Section for a certificate candidate to use for authentication
services.certmgr.package	The certmgr package to use.
services.misskey.reverseProxy.webserver.nginx.useACMEHost	A host of an existing Let's Encrypt certificate to use
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.slot	Optional slot number of the token that stores the certificate.
services.kubernetes.proxy.kubeconfig.certFile	Kubernetes proxy client certificate file used to connect to kube-apiserver.
services.prometheus.exporters.exportarr-readarr.group	Group under which the exportarr-readarr exporter shall be run.
services.prometheus.exporters.artifactory.group	Group under which the artifactory exporter shall be run.
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.module	Optional PKCS#11 module name.
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.file	Absolute path to the certificate to load
services.davfs2.davGroup	The group of the running mount.davfs daemon
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.module	Optional PKCS#11 module name.
services.hologram-server.groupClassAttr	The objectclass attribute to search for groups when enableLdapRoles is true
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.file	Absolute path to the certificate to load
services.firezone.server.provision.accounts.<name>.policies.<name>.group	The group which should be allowed access to the given resource.
services.prometheus.exporters.node-cert.excludePaths	List of paths to exclute from searching for SSL certificates.
services.prometheus.exporters.exportarr-prowlarr.group	Group under which the exportarr-prowlarr exporter shall be run.
services.prometheus.exporters.node-cert.listenAddress	Address to listen on.
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.handle	Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively
services.prometheus.exporters.node-cert.openFirewall	Open port in firewall for incoming connections.
services.certmgr.metricsPort	The port for the Prometheus HTTP endpoint.
services.prometheus.exporters.node-cert.excludeGlobs	List files matching a pattern to include
services.prometheus.exporters.node-cert.includeGlobs	List files matching a pattern to include
services.kubernetes.kubelet.kubeconfig.certFile	Kubelet client certificate file used to connect to kube-apiserver.
services.prometheus.exporters.modemmanager.group	Group under which the modemmanager exporter shall be run.
services.postfix.setgidGroup	How to call postfix setgid group (for postdrop)
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.handle	Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively
services.prometheus.exporters.node-cert.firewallRules	Specify rules for nftables to add to the input chain when `services.prometheus.exporters.node-cert.openFirewall` is true.
services.quassel.dataDir	The directory holding configuration files, the SQlite database and the SSL Cert.
services.bitwarden-directory-connector-cli.sync.groupPath	Group directory, relative to root.
services.certmgr.defaultRemote	The default CA host:port to use.
services.kubernetes.scheduler.kubeconfig.certFile	Kubernetes scheduler client certificate file used to connect to kube-apiserver.
services.certmgr.svcManager	This specifies the service manager to use for restarting or reloading services
hardware.hackrf.enable	Enables hackrf udev rules and ensures 'plugdev' group exists
services.prometheus.exporters.node-cert.firewallFilter	Specify a filter for iptables to use when `services.prometheus.exporters.node-cert.openFirewall` is true
security.agnos.settings.accounts.*.certificates	Certificates for agnos to issue or renew.
services.ghostunnel.servers.<name>.keystore	Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.certs	List of certificates to accept for authentication
services.certmgr.metricsAddress	The address for the Prometheus HTTP endpoint.
services.certmgr.renewInterval	How often to check certificate expirations and how often to update the cert_next_expires metric.
services.hitch.frontend	The port and interface of the listen endpoint in the form [HOST]:PORT[+CERT].
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.certs	List of certificate candidates to use for authentication
services.prometheus.remoteRead.*.tls_config.cert_file	Certificate file for client cert authentication to the server.
services.suricata.settings.vars.port-groups	The port group variables for suricata.
services.pgmanage.loginGroup	This tells pgmanage to only allow users in a certain PostgreSQL group to login to pgmanage
services.hardware.lcd.server.usbGroup	The group to use for settings permissions
services.nsd.zones.<name>.zoneStats	When set to something distinct to null NSD is able to collect statistics per zone
boot.initrd.systemd.groups	Groups to include in initrd.
services.prometheus.remoteWrite.*.tls_config.cert_file	Certificate file for client cert authentication to the server.
services.public-inbox.inboxes.<name>.newsgroup	NNTP group name for the inbox.
hardware.ckb-next.gid	Limit access to the ckb daemon to a particular group.
services.firezone.server.provision.accounts.<name>.groups	All groups to provision
services.icingaweb2.groupBackends	groups.ini contents
services.galene.groupsDir	Web server directory.
services.dendrite.tlsKey	The path to the TLS key. `nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"`
security.agnos.settings.accounts..certificates..domains	Domains the certificate represents
services.kubernetes.controllerManager.kubeconfig.certFile	Kubernetes controller manager client certificate file used to connect to kube-apiserver.
services.prometheus.scrapeConfigs.*.tls_config.cert_file	Certificate file for client cert authentication to the server.
services.dendrite.tlsCert	The path to the TLS certificate. `nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"`
services.jibri.ignoreCert	Whether to enable the flag "--ignore-certificate-errors" for the Chromium browser opened by Jibri
services.kanidm.provision.groups.<name>.present	Whether to ensure that this group is present or absent.
services.bitwarden-directory-connector-cli.sync.groupNameAttribute	Attribute for a name of group.
security.isolate.cgRoot	Control group which subgroups are placed under
services.github-runners.<name>.runnerGroup	Name of the runner group to add this runner to (defaults to the default runner group)
users.extraGroups.<name>.gid	The group GID
security.sudo.execWheelOnly	Only allow members of the `wheel` group to execute sudo by setting the executable's permissions accordingly
services.kanidm.provision.groups.<name>.members	List of kanidm entities (persons, groups, ...) which are part of this group.
security.sudo-rs.execWheelOnly	Only allow members of the `wheel` group to execute sudo by setting the executable's permissions accordingly
programs.wireshark.enable	Whether to add Wireshark to the global environment and create a 'wireshark' group
security.sudo.keepTerminfo	Whether to preserve the `TERMINFO` and `TERMINFO_DIRS` environment variables, for `root` and the `wheel` group.
users.extraGroups.<name>.name	The name of the group
users.mutableUsers	If set to `true`, you are free to add new users and groups to the system with the ordinary `useradd` and `groupadd` commands
services.ircdHybrid.certificate	IRCD server SSL certificate
services.agate.certificatesDir	Root of the certificate directory.
services.minio.certificatesDir	The directory where TLS certificates are stored.
programs.wireshark.usbmon.enable	Whether to allow users in the 'wireshark' group to capture USB traffic
programs.wireshark.dumpcap.enable	Whether to allow users in the 'wireshark' group to capture network traffic
services.oauth2-proxy.tls.certificate	Path to certificate file.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacerts	List of CA certificates to accept for authentication
services.quassel.certificateFile	Path to the certificate used for SSL connections with clients.
services.suricata.settings.vars.address-groups	The address group variables for suricata, if not defined the default value of suricata (see example) will be used
users.users.<name>.subGidRanges.*.count	Count of subordinate group ids
services.below.cgroupFilterOut	A regexp matching the full paths of cgroups whose data shouldn't be collected
users.users.<name>.subGidRanges	Subordinate group ids that user is allowed to use
security.sudo.defaultOptions	Options used for the default rules, granting `root` and the `wheel` group permission to run any command as any user.
services.prometheus.exporters.dovecot.socketPath	Path under which the stats socket is placed
services.onlyoffice.securityNonceFile	File holding nginx configuration that sets the nonce used to create secret links
security.sudo-rs.defaultOptions	Options used for the default rules, granting `root` and the `wheel` group permission to run any command as any user.
services.maddy.tls.certificates.*.keyPath	Path to the private key used for TLS.
users.users.<name>.autoSubUidGidRange	Automatically allocate subordinate user and group ids for this user
services.grafana.settings.database.client_cert_path	The path to the client cert
services.ghostunnel.servers.<name>.cacert	Path to CA bundle file (PEM/X509)
services.maddy.tls.certificates	A list of attribute sets containing paths to TLS certificates and keys
security.loginDefs.settings.GID_MAX	Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
security.loginDefs.settings.GID_MIN	Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
services.grafana.settings.server.cert_key	Path to the certificate key file (if `protocol` is set to `https` or `h2`).
<imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.keystore	Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
services.infinoted.certificateFile	Server certificate to use for TLS
services.namecoind.rpc.certificate	Certificate file for securing RPC connections.
services.bitwarden-directory-connector-cli.sync.groupFilter	LDAP filter for groups.
security.run0.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `run0`.
services.ananicy.extraCgroups	Cgroups to write in 'nixCgroups.cgroups'
security.loginDefs.settings.SYS_GID_MAX	Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
security.loginDefs.settings.SYS_GID_MIN	Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
services.slurm.extraCgroupConfig	Extra configuration for cgroup.conf
security.sudo.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `sudo`.
security.doas.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `doas`.
services.samba-wsdd.workgroup	Set workgroup name (default WORKGROUP).
users.users.<name>.subGidRanges.*.startGid	Start of the range of subordinate group ids that user is allowed to use.
services.unbound.localControlSocketPath	When not set to `null` this option defines the path at which the unbound remote control socket should be created at
security.sudo-rs.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `sudo`.
services.grafana.settings.server.cert_file	Path to the certificate file (if `protocol` is set to `https` or `h2`).
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.groups	Authorization group memberships to require
services.infinoted.certificateChain	Chain of CA-certificates to which our `certificateFile` is relative
services.warpgate.settings.http.sni_certificates.*.certificate	Path to certificate.
programs.light.enable	Whether to install Light backlight control command and udev rules granting access to members of the "video" group.
services.diod.userdb	This option disables password/group lookups
users.extraUsers.<name>.subGidRanges.*.count	Count of subordinate group ids
services.oauth2-proxy.google.groups	Restrict logins to members of these Google groups.
services.bitwarden-directory-connector-cli.sync.groupObjectClass	A class that groups will have.
services.bacula-sd.tls.certificate	The full path to the PEM encoded TLS certificate
services.bacula-fd.tls.certificate	The full path to the PEM encoded TLS certificate
services.bacula-dir.tls.certificate	The full path to the PEM encoded TLS certificate
users.extraUsers.<name>.subGidRanges	Subordinate group ids that user is allowed to use
services.prosody.modules.groups	Shared roster support
services.kubernetes.pki.genCfsslAPICerts	Whether to automatically generate cfssl API webserver TLS cert and key, if they don't exist.
services.kmonad.keyboards.<name>.extraGroups	Extra permission groups to attach to the KMonad instance for this keyboard
services.firezone.server.provision.accounts.<name>.groups.<name>.name	The name of this group
hardware.brillo.enable	Whether to enable brillo in userspace
users.extraUsers.<name>.autoSubUidGidRange	Automatically allocate subordinate user and group ids for this user
services.kubernetes.pki.cfsslAPIExtraSANs	Extra x509 Subject Alternative Names to be added to the cfssl API webserver TLS cert.
services.umurmur.settings.certificate	Path to your SSL certificate
services.movim.h2o.tls.identity.*.certificate-file	Path to certificate file
services.sabnzbd.settings.misc.https_cert	Path to the TLS certificate for the web UI
services.jack.jackd.enable	Whether to enable JACK Audio Connection Kit
hardware.i2c.enable	Whether to enable i2c devices support
services.rkvm.server.settings.certificate	TLS certificate path. This should be generated with `rkvm-certificate-gen`.
services.rkvm.client.settings.certificate	TLS ceritficate path. This should be generated with `rkvm-certificate-gen`.
security.pam.services.<name>.requireWheel	Whether to permit root access only to members of group wheel.
hardware.bladeRF.enable	Enables udev rules for BladeRF devices
services.h2o.hosts.<name>.tls.identity.*.certificate-file	Path to certificate file
services.mqtt2influxdb.mqtt.certfile	Certificate file for MQTT
security.please.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands or edit files with `please` and `pleaseedit` respectively.
services.grafana.provision.alerting.rules.settings.groups.*.name	Name of the rule group
services.userdbd.enable	Whether to enable the systemd JSON user/group record lookup service .
security.loginDefs.settings.TTYPERM	The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM
services.ghostunnel.servers.<name>.allowAll	If true, allow all clients, do not check client cert subject.
services.taskserver.organisations.<name>.groups	A list of group names that belong to the organization.
services.dependency-track.oidc.teams.claim	Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
services.kanidm.provision.groups.<name>.overwriteMembers	Whether the member list should be overwritten each time (true) or appended (false)
programs.tcpdump.enable	Whether to configure a setcap wrapper for tcpdump
users.extraUsers.<name>.subGidRanges.*.startGid	Start of the range of subordinate group ids that user is allowed to use.
security.pam.services.<name>.enableAppArmor	Enable support for attaching AppArmor profiles at the user/group level, e.g., as part of a role based access control scheme.
services.warpgate.settings.http.certificate	Path to HTTPS listener certificate.
services.firezone.server.provision.accounts.<name>.groups.<name>.members	The members of this group
services.dovecot2.mailGroup	Default group to store mail for virtual users.
services.saned.enable	Enable saned network daemon for remote connection to scanners. saned would be run from `scanner` user; to allow access to hardware that doesn't have `scanner` group you should add needed groups to this user.
services.kanidm.provision.groups	Provisioning of kanidm groups
services.dnsdist.dnscrypt.providerName	The name that will be given to this DNSCrypt resolver. The provider name must start with `2.dnscrypt-cert.`.
services.warpgate.settings.mysql.certificate	Path to MySQL listener certificate.
security.agnos.settings.accounts..certificates..key_output_file	Output path for the certificate private key
systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user	The user of the file
services.unbound.checkconf	Whether to check the resulting config file with unbound checkconf for syntax errors
hardware.glasgow.enable	Enables Glasgow udev rules and ensures 'plugdev' group exists
services.grafana.provision.alerting.rules.settings.groups.*.folder	Name of the folder the rule group will be stored in
security.loginDefs.settings.TTYGROUP	The terminal permissions: the login tty will be owned by the TTYGROUP group, and the permissions will be set to TTYPERM
systemd.enableCgroupAccounting	Whether to enable cgroup accounting; see cgroups(7).
services.dolibarr.h2o.tls.identity.*.certificate-file	Path to certificate file
programs.minipro.enable	Whether to enable minipro and its udev rules
users.allowNoPasswordLogin	Disable checking that at least the `root` user or a user in the `wheel` group can log in using a password or an SSH key
services.trafficserver.sslMulticert	Configure SSL server certificates to terminate the SSL sessions
security.polkit.adminIdentities	Specifies which users are considered “administrators”, for those actions that require the user to authenticate as an administrator (i.e. have an `auth_admin` value)
services.prometheus.scrapeConfigs..http_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..kuma_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
programs.sedutil.enable	Whether to enable sedutil, to manage self encrypting drives that conform to the Trusted Computing Group OPAL 2.0 SSC specification.
services.nginx.upstreams	Defines a group of servers to use as proxy target.
users.users.<name>.isNormalUser	Indicates whether this is an account for a “real” user
virtualisation.incus.enable	Whether to enable incusd, a daemon that manages containers and virtual machines
programs.gphoto2.enable	Whether to configure system to use gphoto2
services.couchdb.configFile	Configuration file for persisting runtime changes
services.pdfding.enable	Whether to enable PdfDing service
services.smokeping.user	User that runs smokeping and (optionally) thttpd
services.firezone.server.provision.accounts.<name>.groups.<name>.forceMembers	Ensure that only the given members are part of this group at every server start.
services.kubernetes.apiserver.extraSANs	Extra x509 Subject Alternative Names to be added to the kubernetes apiserver tls cert.
services.timekpr.adminUsers	All listed users will become part of the `timekpr` group so they can manage timekpr settings without requiring sudo.
services.portunus.enable	Whether to enable Portunus, a self-contained user/group management and authentication service for LDAP.
services.grafana.settings.server.socket_gid	GID where the socket should be set when `protocol=socket`
services.grafana.provision.alerting.rules.settings.groups.*.interval	Interval that the rule group should be evaluated at
security.googleOsLogin.enable	Whether to enable Google OS Login
services.foundationdb.tls.certificate	Path to the TLS certificate file
hardware.rtl-sdr.enable	Enables rtl-sdr udev rules, ensures 'plugdev' group exists, and blacklists DVB kernel modules
services.nomad.enableDocker	Enable Docker support
services.prometheus.scrapeConfigs..uyuni_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..azure_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
virtualisation.podman.networkSocket.tls.cacert	Path to CA certificate to use for client authentication.
programs.flashrom.enable	Installs flashrom and configures udev rules for programmers used by flashrom
hardware.openrazer.users	Usernames to be added to the "openrazer" group, so that they can start and interact with the OpenRazer userspace daemon.
services.traefik.supplementaryGroups	Additional groups under which Traefik runs
services.warpgate.settings.postgres.certificate	Path to PostgreSQL listener certificate.
services.aria2.enable	Whether or not to enable the headless Aria2 daemon service
services.mailman.ldap.superUserGroup	Group where a user must be a member of to gain superuser rights.
services.bacula-sd.director.<name>.tls.certificate	The full path to the PEM encoded TLS certificate
services.bacula-fd.director.<name>.tls.certificate	The full path to the PEM encoded TLS certificate
services.hologram-server.roleAttr	Which LDAP group attribute to search for authorized role ARNs
services.grafana.settings.database.ca_cert_path	The path to the CA certificate to use.
services.headscale.settings.tls_cert_path	Path to already created certificate.
networking.networkmanager.enable	Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured
boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user	The user of the file
services.dokuwiki.sites.<name>.acl.*.actor	User or group to restrict
programs.mouse-actions.enable	Whether to install and set up mouse-actions and it's udev rules
users.extraUsers.<name>.isNormalUser	Indicates whether this is an account for a “real” user
services.dependency-track.oidc.teamSynchronization	This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles
services.prometheus.scrapeConfigs..eureka_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..consul_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..triton_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..linode_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..docker_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
hardware.acpilight.enable	Enable acpilight
services.quickwit.dataDir	Data directory for Quickwit
services.temporal.dataDir	Data directory for Temporal
services.privoxy.inspectHttps	Whether to configure Privoxy to inspect HTTPS requests, meaning all encrypted traffic will be filtered as well
networking.wireless.networks.<name>.priority	By default, all networks will get same priority group (0)
virtualisation.podman.dockerSocket.enable	Make the Podman socket available in place of the Docker socket, so Docker tools can find the Podman socket
services.dovecot2.createMailUser	Whether to enable automatically creating the user given in `services.dovecot.user` and the group given in `services.dovecot.group`.
programs.corectrl.enable	Whether to enable CoreCtrl, a tool to overclock amd graphics cards and processors
nix.settings.trusted-users	A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs
services.cloudflared.certificateFile	Account certificate file, necessary to create, delete and manage tunnels
hardware.sheep_net.enable	Enables sheep_net udev rules, ensures 'sheep_net' group exists, and adds sheep-net to boot.kernelModules and boot.extraModulePackages
services.dependency-track.settings."alpine.oidc.teams.claim"	Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
<imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.cacert	Path to CA bundle file (PEM/X509)
services.prometheus.scrapeConfigs..hetzner_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
programs.feedbackd.enable	Whether to enable the feedbackd D-BUS service and udev rules
programs.mosh.withUtempter	Whether to enable libutempter for mosh
programs.tmux.withUtempter	Whether to enable libutempter for tmux
services.kubernetes.apiserver.kubeletClientCaFile	Path to a cert file for connecting to kubelet.
services.mx-puppet-discord.enable	Whether to enable mx-puppet-discord is a discord puppeting bridge for matrix
hardware.kryoflux.enable	Enables kryoflux udev rules, ensures 'floppy' group exists
services.kanidm.provision.persons.<name>.groups	List of groups this person should belong to.
programs.idescriptor.users	Users to be added to the idevice group.
services.terraria.enable	If enabled, starts a Terraria server
services.netbird.clients.<name>.bin.suffix	A system group name for this client instance.
services.netbird.tunnels.<name>.bin.suffix	A system group name for this client instance.
services.hardware.lcd.server.usbPermissions	Set group-write permissions on a USB device
services.prometheus.scrapeConfigs..puppetdb_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..scaleway_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.prometheus.scrapeConfigs..marathon_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
security.pam.services.<name>.allowNullPassword	Whether to allow logging into accounts that have no password set (i.e., have an empty password field in /etc/passwd or /etc/group)
programs.soundmodem.enable	Whether to add Soundmodem to the global environment and configure a wrapper for 'soundmodemconfig' for users in the 'soundmodem' group.
services.netbird.tunnels.<name>.name	Primary name for use (as a suffix) in: systemd service name, hardened user name and group, systemd `*Directory=` names, desktop application identification,
services.netbird.clients.<name>.name	Primary name for use (as a suffix) in: systemd service name, hardened user name and group, systemd `*Directory=` names, desktop application identification,
services.dependency-track.settings."alpine.oidc.team.synchronization"	This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles
programs.benchexec.users	Users that intend to use BenchExec
services.aria2.serviceUMask	The file mode creation mask for Aria2 service
hardware.libjaylink.enable	Whether to enable udev rules for devices supported by libjaylink
hardware.keyboard.uhk.enable	Whether to enable non-root access to the firmware of UHK keyboards
services.borgbackup.jobs.<name>.user	The user `borg` is run as
services.rke2.cisHardening	Enable CIS Hardening for RKE2
services.strongswan-swanctl.swanctl.authorities.<name>.cacert	The certificates may use a relative path from the swanctl `x509ca` directory or an absolute path
networking.openconnect.interfaces.<name>.certificate	Certificate to authenticate with.
services.prometheus.scrapeConfigs..openstack_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.cloudflared.tunnels.<name>.certificateFile	Account certificate file, necessary to create, delete and manage tunnels
services.hologram-server.enableLdapRoles	Whether to assign user roles based on the user's LDAP group memberships
services.prometheus.exporters.unbound.unbound.certificate	Path to the Unbound control socket certificate
services.prometheus.remoteRead.*.tls_config.key_file	Key file for client cert authentication to the server.
services.suricata.settings.vars.address-groups.HOME_NET	HOME_NET variable.
services.beszel.agent.smartmon.enable	Include services.beszel.agent.smartmon.package in the Beszel agent path for disk monitoring and add the agent to the disk group.
services.opensearch.dataDir	Data directory for OpenSearch
services.nextcloud-spreed-signaling.settings.https.certificate	Path to the certificate used for the HTTPS listener
services.borgbackup.repos.<name>.user	The user `borg serve` is run as
services.smartdns.settings	A set that will be generated into configuration file, see the SmartDNS README for details of configuration parameters
services.prometheus.remoteWrite.*.tls_config.key_file	Key file for client cert authentication to the server.
services.warpgate.settings.http.sni_certificates	Certificates for additional domains.
security.agnos.settings.accounts..certificates..fullchain_output_file	Output path for the full chain including the acquired certificate
services.prometheus.scrapeConfigs..kubernetes_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert	Section for a CA certificate to accept for authentication
services.pipewire.systemWide	If true, a system-wide PipeWire service and socket is enabled allowing all users in the "pipewire" group to use it simultaneously
<imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowAll	If true, allow all clients, do not check client cert subject.
services.warpgate.settings.http.sni_certificates.*.key	Path to private key.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.slot	Optional slot number of the token that stores the certificate.
services.neo4j.directories.certificates	Directory for storing certificates to be used by Neo4j for TLS connections
services.parsedmarc.settings.elasticsearch.cert_path	The path to a TLS certificate bundle used to verify the server's certificate.
services.displayManager.lemurs.enable	Whether to enable lemurs, a customizable TUI display/login manager. For Wayland compositors, your user must be in the "seat" group.
virtualisation.virtualbox.host.enableHardening	Enable hardened VirtualBox, which ensures that only the binaries in the system path get access to the devices exposed by the kernel modules instead of all users in the vboxusers group. Disabling this can put your system's security at risk, as local users in the vboxusers group can tamper with the VirtualBox device files.
services.suricata.settings.vars.address-groups.DNP3_SERVER	DNP3_SERVER variable.
services.suricata.settings.vars.address-groups.DNP3_CLIENT	DNP3_CLIENT variable.
services.prometheus.scrapeConfigs.*.tls_config.key_file	Key file for client cert authentication to the server.
services.suricata.settings.vars.address-groups.ENIP_CLIENT	ENIP_CLIENT variable.
services.suricata.settings.vars.address-groups.ENIP_SERVER	ENIP_SERVER variable.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.module	Optional PKCS#11 module name.
services.firezone.gui-client.allowedUsers	All listed users will become part of the `firezone-client` group so they can control the tunnel service
services.nebula-lighthouse-service.user	The user and group to run nebula-lighthouse-service as.
services.prometheus.scrapeConfigs..dockerswarm_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.file	Absolute path to the certificate to load
services.fastnetmon-advanced.hostgroups	Hostgroups to declaratively load into FastNetMon Advanced
services.suricata.settings.vars.address-groups.DC_SERVERS	DC_SERVERS variable.
services.suricata.settings.vars.address-groups.AIM_SERVERS	AIM_SERVERS variable.
services.suricata.settings.vars.address-groups.DNS_SERVERS	DNS_SERVERS variable.
services.suricata.settings.vars.address-groups.SQL_SERVERS	SQL_SERVERS variable.
services.authelia.instances.<name>.name	Name is used as a suffix for the service name, user, and group
services.suricata.settings.vars.address-groups.SMTP_SERVERS	SMTP_SERVERS variable.
services.suricata.settings.vars.address-groups.HTTP_SERVERS	HTTP_SERVERS variable.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.handle	Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively
services.multipath.devices.*.failback	Tell multipathd how to manage path group failback
services.grafana.settings.database.server_cert_name	The common name field of the certificate used by the `mysql` or `postgres` server
services.strongswan-swanctl.swanctl.connections.<name>.send_cert	Send certificate payloads when using certificate authentication. With the default of `ifasked` the daemon sends certificate payloads only if certificate requests have been received. `never` disables sending of certificate payloads altogether, `always` causes certificate payloads to be sent unconditionally whenever certificate authentication is used
services.suricata.settings.vars.address-groups.MODBUS_CLIENT	MODBUS_CLIENT variable
services.suricata.settings.vars.address-groups.MODBUS_SERVER	MODBUS_SERVER variable.
services.prometheus.scrapeConfigs..digitalocean_sd_configs..tls_config.cert_file	Certificate file for client cert authentication to the server.
services.suricata.settings.vars.address-groups.EXTERNAL_NET	EXTERNAL_NET variable.
services.glusterfs.killMode	The systemd KillMode to use for glusterd. glusterd spawns other daemons like gsyncd
services.bitwarden-directory-connector-cli.sync.groups	Whether to sync ldap groups into BitWarden.
services.suricata.settings.vars.address-groups.TELNET_SERVERS	TELNET_SERVERS variable.
services.nominatim.database.superUser	Postgresql database superuser used to create Nominatim database and import data
programs.firefox.policies	Group policies to install
services.dnsdist.dnscrypt.providerKey	The filepath to the provider secret key
services.lifecycled.cloudwatchGroup	Write logs to a specific Cloudwatch Logs group.
services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert_policy	List of certificate policy OIDs the peer's certificate must have
programs.thunderbird.policies	Group policies to install
services.roundcube.database.username	Username for the postgresql connection
services.aria2.downloadDirPermission	The permission for `settings.dir`
services.grafana.provision.alerting.rules.settings.groups	List of rule groups to import or update.
services.openssh.authorizedKeysCommand	Specifies a program to be used to look up the user's public keys
services.pulseaudio.systemWide	If false, a PulseAudio server is launched automatically for each user that tries to use the sound system
services.kubo.settings.Addresses.API	Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on
services.multipath.devices.*.rr_min_io	Number of I/O requests to route to a path before switching to the next in the same path group
services.sourcehut.settings."hg.sr.ht".changegroup-script	A changegroup script which is installed in every mercurial repo
services.varnish.listen.*.address	If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad ("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]"). (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@" followed by the name of an abstract socket ("@myvarnishd") accept connections on a Unix domain socket
services.strongswan-swanctl.swanctl.connections.<name>.send_certreq	Send certificate request payloads to offer trusted root CA certificates to the peer
services.strongswan-swanctl.swanctl.authorities.<name>.cert_uri_base	Defines the base URI for the Hash and URL feature supported by IKEv2
services.transmission.enable	Whether to enable the headless Transmission BitTorrent daemon
virtualisation.docker.enable	This option enables docker, a daemon that manages linux containers
virtualisation.lxd.enable	This option enables lxd, a daemon that manages containers
services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_groups	List of groups to allow access to this vhost, or null to allow all.
virtualisation.kvmgt.enable	Whether to enable KVMGT (iGVT-g) VGPU support
services.matrix-synapse.settings.tls_certificate_path	PEM encoded X509 certificate for TLS
services.matrix-continuwuity.settings.global.unix_socket_path	Listen on a UNIX socket at the specified path
services.anuko-time-tracker.settings.defaultLanguage	Defines Anuko Time Tracker default language
services.journald.upload.settings.Upload.ServerKeyFile	SSL key in PEM format
services.postfixadmin.database.username	Username for the postgresql connection
networking.wireless.userControlled	Allow users of the `wpa_supplicant` group to control wpa_supplicant through wpa_gui or wpa_cli
virtualisation.libvirtd.enable	This option enables libvirtd, a daemon that manages virtual machines
services.archisteamfarm.ipcPasswordFile	Path to a file containing the password
services.multipath.devices.*.rr_min_io_rq	Number of I/O requests to route to a path before switching to the next in the same path group
services.firezone.server.provision.accounts.<name>.relayGroups	All relay groups to provision
services.firezone.server.provision.accounts.<name>.relayGroups.<name>.name	The name of this relay group
virtualisation.virtualbox.host.enable	Whether to enable VirtualBox. In order to pass USB devices from the host to the guests, the user needs to be in the `vboxusers` group.
services.netbird.tunnels.<name>.hardened	Hardened service: runs as a dedicated user with minimal set of permissions (see caveats), restricts daemon configuration socket access to dedicated user group (you can grant access to it with `users.users."<user>".extraGroups = [ netbird-‹name› ]`), Even though the local system resources access is restricted: `CAP_NET_RAW`, `CAP_NET_ADMIN` and `CAP_BPF` still give unlimited network manipulation possibilites, older kernels don't have `CAP_BPF` and use `CAP_SYS_ADMIN` instead, Known security features that are not (yet) integrated into the module: 2024-02-14: `rosenpass` is an experimental feature configurable solely through `--enable-rosenpass` flag on the `netbird up` command, see the docs
services.netbird.clients.<name>.hardened	Hardened service: runs as a dedicated user with minimal set of permissions (see caveats), restricts daemon configuration socket access to dedicated user group (you can grant access to it with `users.users."<user>".extraGroups = [ netbird-‹name› ]`), Even though the local system resources access is restricted: `CAP_NET_RAW`, `CAP_NET_ADMIN` and `CAP_BPF` still give unlimited network manipulation possibilites, older kernels don't have `CAP_BPF` and use `CAP_SYS_ADMIN` instead, Known security features that are not (yet) integrated into the module: 2024-02-14: `rosenpass` is an experimental feature configurable solely through `--enable-rosenpass` flag on the `netbird up` command, see the docs
services.prometheus.scrapeConfigs..http_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..kuma_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.keepalived.vrrpInstances.<name>.unicastPeers	Do not send VRRP adverts over VRRP multicast group
services.netbird.clients	Attribute set of NetBird client daemons, by default each one will: be manageable using dedicated tooling: `netbird-<name>` script, `NetBird - netbird-<name>` graphical interface when appropriate (see `ui.enable`), run as a `netbird-<name>.service`, listen for incoming remote connections on the port `51820` (`openFirewall` by default), manage the `netbird-<name>` wireguard interface, use the /var/lib/netbird-/config.json configuration file, override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json, (`hardened`) be locally manageable by `netbird-<name>` system group, With following caveats: multiple daemons will interfere with each other's DNS resolution of `netbird.cloud`, but should remain fully operational otherwise
services.firezone.server.provision.accounts.<name>.gatewayGroups	All gateway groups (sites) to provision
services.firezone.server.provision.accounts.<name>.gatewayGroups.<name>.name	The name of this gateway group
services.archisteamfarm.bots.<name>.passwordFile	Path to a file containing the password
services.bitwarden-directory-connector-cli.sync.removeDisabled	Remove users from bitwarden groups if no longer in the ldap group.
services.bitwarden-directory-connector-cli.sync.memberAttribute	Attribute that lists members in a LDAP group.
services.prometheus.scrapeConfigs..azure_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..uyuni_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..triton_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..linode_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..eureka_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..consul_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..docker_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..hetzner_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.librenms.distributedPoller.distributedBilling	Enable distributed billing on this poller
services.prometheus.scrapeConfigs..triton_sd_configs..groups	A list of groups for which targets are retrieved, only supported when targeting the `container` role
services.prometheus.scrapeConfigs..static_configs..targets	The targets specified by the target group.
services.prometheus.scrapeConfigs..puppetdb_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..scaleway_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..marathon_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.multipath.devices.*.path_grouping_policy	The default path grouping policy to apply to unspecified multipaths
services.prometheus.scrapeConfigs..openstack_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.transmission.downloadDirPermissions	If not `null`, is used as the permissions set by `system.activationScripts.transmission-daemon` on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir
services.prometheus.scrapeConfigs..kubernetes_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.matrix-tuwunel.settings.global.unix_socket_path	Listen on a UNIX socket at the specified path
services.prometheus.scrapeConfigs..dockerswarm_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.prometheus.scrapeConfigs..uyuni_sd_configs..separator	The string by which Uyuni group names are joined into the groups label Defaults to `,` in prometheus when set to `null`.
services.prometheus.scrapeConfigs..digitalocean_sd_configs..tls_config.key_file	Key file for client cert authentication to the server.
services.kanidm.unixSettings.pam_allowed_login_groups	Kanidm groups that are allowed to login using PAM.
services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_time	Time to schedule CHILD_SA rekeying
services.kanidm.unix.settings.kanidm.pam_allowed_login_groups	Kanidm groups that are allowed to login using PAM.
services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_bytes	Number of bytes processed before initiating CHILD_SA rekeying
services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_packets	Number of packets processed before initiating CHILD_SA rekeying