| services.tinc.networks.<name>.extraConfig | Extra lines to add to the tinc service configuration file
|
| services.tinc.networks.<name>.hosts | The name of the host in the network as well as the configuration for that host
|
| services.tinc.networks.<name>.settings | Configuration of the Tinc daemon for this network
|
| services.tinc.networks.<name>.hostSettings.<name>.settings | Configuration for this host
|
| services.ente.api.settings.db.name | The database name
|
| services.nebula.networks.<name>.settings | Nebula configuration
|
| services.postfix.settings.master.<name>.name | The name of the service to run
|
| services.sabnzbd.settings.servers.<name>.name | The name of the server
|
| services.legit.settings.server.name | Server name.
|
| services.rauc.slots.<name>.*.settings | Settings for this slot.
|
| services.hostapd.radios.<name>.networks.<name>.settings | Extra configuration options to put at the end of this BSS's defintion in the
hostapd.conf for the associated interface
|
| services.tinc.networks.<name>.name | The name of the node which is used as an identifier when communicating
with the remote nodes in the mesh
|
| services.cgit.<name>.settings | cgit configuration, see cgitrc(5)
|
| services.uhub.<name>.settings | Configuration of uhub
|
| services.rsync.jobs.<name>.settings | Settings that should be passed to rsync via long options
|
| services.syncthing.settings.devices.<name>.name | The name of the device.
|
| services.uhub.<name>.plugins.*.settings | Settings specific to this plugin.
|
| services.pretix.settings.database.name | Database name.
|
| services.mpd.settings | Configuration for MPD
|
| services.pretalx.settings.database.name | Database name.
|
| services.metricbeat.settings.name | Name of the beat
|
| services.grafana.settings.database.name | The name of the Grafana database.
|
| services.kimai.sites.<name>.settings | Structural Kimai's local.yaml configuration
|
| services.h2o.hosts.<name>.settings | Attrset to be transformed into YAML for host config
|
| services.phpfpm.pools.<name>.settings | PHP-FPM pool directives
|
| services.logrotate.settings.<name>.global | Whether this setting is a global option or not: set to have these
settings apply to all files settings with a higher priority.
|
| services.homebridge.settings.bridge.name | Name of the homebridge
|
| services.sourcehut.settings."sr.ht".site-name | The name of your network of sr.ht-based sites.
|
| services.etebase-server.settings.database.name | The database name.
|
| services.sourcehut.settings."sr.ht".owner-name | Owner's name.
|
| services.easytier.instances.<name>.settings | Settings to generate easytier-‹name›.toml
|
| services.inadyn.settings.custom.<name>.ddns-server | DDNS server name.
|
| services.postfix.settings.master.<name>.command | A program name specifying a Postfix service/daemon process
|
| services.redis.servers.<name>.settings | Redis configuration
|
| services.szurubooru.server.settings.name | Name shown in the website title and on the front page.
|
| services.bitmagnet.settings.postgres.name | Database name to connect to
|
| services.matrix-synapse.settings.database.name | The database engine name
|
| services.inadyn.settings.custom.<name>.include | File to include additional settings for this provider from.
|
| services.inadyn.settings.custom.<name>.ssl | Whether to use HTTPS for this DDNS provider.
|
| services.stash.settings.stash_boxes.*.name | The name of the Stash Box
|
| services.tor.relay.onionServices.<name>.settings | Settings of the onion service
|
| services.inadyn.settings.custom.<name>.hostname | Hostname alias(es).
|
| services.inadyn.settings.custom.<name>.username | Username for this DDNS provider.
|
| services.lemmy.settings.hostname | The domain name of your instance (eg 'lemmy.ml').
|
| services.sympa.settingsFile.<name>.text | Text of the file.
|
| services.mosquitto.bridges.<name>.settings | Additional settings for this bridge.
|
| services.sympa.domains.<name>.settings | The robot.conf configuration file as key value set
|
| services.dokuwiki.sites.<name>.settings | Structural DokuWiki configuration
|
| services.postfix.settings.master.<name>.type | The type of the service
|
| services.zeronsd.servedNetworks.<name>.settings | Settings for zeronsd
|
| services.gancio.settings.hostname | The domain name under which the server is reachable.
|
| services.acme-dns.settings.general.nsname | Zone name server.
|
| services.pid-fan-controller.settings.heatSources.*.name | Name of the heat source.
|
| services.logrotate.settings | logrotate freeform settings: each attribute here will define its own section,
ordered by services.logrotate.settings.<name>.priority,
which can either define files to rotate with their settings
or settings common to all further files settings
|
| services.sabnzbd.settings.servers.<name>.ssl | Whether the server supports TLS
|
| services.inadyn.settings.provider.<name>.include | File to include additional settings for this provider from.
|
| services.opensearch.settings."cluster.name" | The name of the cluster.
|
| services.nipap.settings.nipapd.db_name | Name of database to use on PostgreSQL server.
|
| services.sabnzbd.settings.servers.<name>.host | Hostname of the server
|
| services.sabnzbd.settings.servers.<name>.port | Port of the server
|
| services.anubis.instances.<name>.policy.settings | Additional policy settings merged into the policy file
|
| services.homebridge.settings.platforms.*.name | Name of the platform
|
| services.frp.instances.<name>.settings | Frp configuration, for configuration options
see the example of client
or server on github.
|
| services.inadyn.settings.custom.<name>.ddns-path | DDNS server path
|
| services.inadyn.settings.provider.<name>.hostname | Hostname alias(es).
|
| services.inadyn.settings.provider.<name>.username | Username for this DDNS provider.
|
| services.inadyn.settings.provider.<name>.ssl | Whether to use HTTPS for this DDNS provider.
|
| services.wiki-js.settings.db.db | Name of the database to use.
|
| services.btrbk.instances.<name>.settings | configuration options for btrbk
|
| services.sympa.settingsFile.<name>.source | Path of the source file.
|
| services.wordpress.sites.<name>.settings | Structural Wordpress configuration
|
| services.postfix.settings.master.<name>.args | Arguments to pass to the command
|
| services.suricata.settings.outputs.*.<name>.enabled | Whether to enable .
|
| services.biboumi.settings.db_name | The name of the database to use
|
| services.logrotate.settings.<name>.enable | Whether to enable setting individual kill switch.
|
| services.anubis.instances.<name>.settings.BIND | The address that Anubis listens to
|
| services.tinc.networks.<name>.hostSettings | The name of the host in the network as well as the configuration for that host
|
| services.xonotic.settings.hostname | The name that will appear in the server list. $g_xonoticversion
gets replaced with the current version.
|
| services.vault-agent.instances.<name>.settings | Free-form settings written directly to the config.json file
|
| services.sourcehut.settings."builds.sr.ht::worker".name | Listening address and listening port
of the build runner (with HTTP port if not 80).
|
| services.tor.settings.Nickname | See torrc manual.
|
| services.public-inbox.settings.coderepo.<name>.dir | Path to a git repository
|
| services.openbao.settings.listener.<name>.type | The listener type to enable.
|
| services.tinc.networks.<name>.debugLevel | The amount of debugging information to add to the log. 0 means little
logging while 5 is the most logging. man tincd for
more details.
|
| services.tinc.networks.<name>.chroot | Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security
|
| services.tinc.networks.<name>.package | The tinc_pre package to use.
|
| services.headscale.settings.database.postgres.name | Database name.
|
| services.sympa.settingsFile.<name>.enable | Whether this file should be generated
|
| services.sabnzbd.settings.servers.<name>.enable | Enable this server by default
|
| security.auditd.plugins.<name>.settings | Plugin-specific config file to link to /etc/audit/.conf
|
| services.postfix.settings.master.<name>.wakeup | Automatically wake up the service after the specified number of
seconds
|
| services.cgit.<name>.repos | cgit repository settings, see cgitrc(5)
|
| services.public-inbox.settings.coderepo.<name>.cgitUrl | URL of a cgit instance
|
| services.vmalert.instances.<name>.settings.rule | Path to the files with alerting and/or recording rules.
|
| services.postfix.settings.master.<name>.chroot | Whether the service is chrooted to have only access to the
services.postfix.queueDir and the closure of
store paths specified by the program option.
|
| services.syncthing.settings.folders.<name>.id | The ID of the folder
|
| services.syncthing.settings.devices.<name>.id | The device ID
|
| services.wstunnel.clients.<name>.settings | Command line arguments to pass to wstunnel
|
| services.wstunnel.servers.<name>.settings | Command line arguments to pass to wstunnel
|
| services.anubis.instances.<name>.settings | Freeform configuration via environment variables for Anubis
|
| services.logrotate.settings.<name>.files | Single or list of files for which rules are defined
|
| services.mobilizon.settings.":mobilizon".":instance".name | The fallback instance name if not configured into the admin UI
|
| services.homebridge.settings.accessories.*.name | Name of the accessory
|
| services.anubis.instances.<name>.settings.POLICY_FNAME | The policy file to use
|
| services.tinc.networks.<name>.bindToAddress | The ip address to bind to (both listen on and send packets from).
|
| services.traefik.dynamic.files.<name>.settings | Dynamic configuration for Traefik, written in Nix.
This will be serialized to JSON (which is considered valid YAML) at build, and passed as part of the static file.
|
| services.vmalert.instances.<name>.settings | vmalert configuration, passed via command line flags
|
| services.keyd.keyboards.<name>.settings | Configuration, except ids section, that is written to /etc/keyd/.conf
|
| services.syncthing.settings.folders.<name>.label | The label of the folder.
|
| services.actual.settings.hostname | The address to listen on
|
| services.printing.cups-pdf.instances.<name>.settings.Out | output directory;
${HOME} will be expanded to the user's home directory,
${USER} will be expanded to the user name.
|
| services.sabnzbd.settings.servers.<name>.timeout | Time, in seconds, to wait for a response before
attempting error recovery.
|
| services.syncthing.settings.folders.<name>.type | Controls how the folder is handled by Syncthing
|
| services.anubis.instances.<name>.settings.SERVE_ROBOTS_TXT | Whether to serve a default robots.txt that denies access to common AI bots by name and all other
bots by wildcard.
|
| services.hostapd.radios.<name>.settings | Extra configuration options to put at the end of global initialization, before defining BSSs
|
| services.postfix.settings.master.<name>.maxproc | The maximum number of processes to spawn for this service
|
| services.misskey.settings.db.db | The database name.
|
| services.grafana.settings.smtp.from_name | Name to be used as client identity for EHLO in SMTP dialog.
|
| services.evremap.settings.phys | The physical device name to listen on
|
| services.wordpress.sites.<name>.extraConfig | Any additional text to be appended to the wp-config.php
configuration file
|
| services.postfix.settings.master.<name>.private | Whether the service's sockets and storage directory is restricted to
be only available via the mail system
|
| services.tinc.networks.<name>.rsaPrivateKeyFile | Path of the private RSA keyfile.
|
| services.easytier.instances.<name>.settings.hostname | Hostname shown in peer list and web console.
|
| services.inadyn.settings.custom.<name>.password | Password for this DDNS provider
|
| services.logrotate.settings.<name>.priority | Order of this logrotate block in relation to the others
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs | List of inputs for this camera.
|
| services.grafana.provision.alerting.rules.settings.groups.*.name | Name of the rule group
|
| services.openbao.settings.listener.<name>.address | The TCP address or UNIX socket path to listen on.
|
| services.sabnzbd.settings.servers.<name>.displayname | Human-friendly description of the server
|
| services.angrr.settings.profile-policies.<name>.enable | Whether to enable this angrr policy.
|
| services.prometheus.exporters.fritz.settings.devices.*.name | Name to use for the device.
|
| services.authelia.instances.<name>.settings.theme | The theme to display.
|
| services.radicle.ci.broker.settings.adapters.<name>.env | Environment variables to add when running the adapter.
|
| services.angrr.settings.profile-policies.<name>.keep-since | Retention period for the GC roots in this profile.
|
| services.consul-template.instances.<name>.settings | Free-form settings written directly to the config.json file
|
| services.tinc.networks.<name>.listenAddress | The ip address to listen on for incoming connections.
|
| services.prometheus.exporters.script.settings.scripts.*.name | Name of the script.
|
| services.sabnzbd.secretFiles | Path to a list of ini file containing confidential settings such as credentials
|
| services.zeronsd.servedNetworks.<name>.settings.token | Path to a file containing the API Token for ZeroTier Central.
|
| services.tor.relay.onionServices.<name>.settings.RendPostPeriod | See torrc manual.
|
| services.wstunnel.clients.<name>.settings.http-headers | Custom headers to send in the upgrade request
|
| services.syncthing.settings.folders.<name>.path | The path to the folder which should be shared
|
| services.sabnzbd.settings.servers.<name>.priority | Priority of this servers
|
| services.sabnzbd.settings.servers.<name>.required | In case of connection failures, wait for the
server to come back online instead of skipping
it.
|
| services.maubot.settings.homeservers.<name>.url | Client-server API URL
|
| services.easytier.instances.<name>.settings.dhcp | Automatically determine the IPv4 address of this peer based on
existing peers on network.
|
| services.tinc.networks.<name>.hostSettings.<name>.rsaPublicKey | Legacy RSA public key of the host in PEM format, including start and
end markers
|
| services.sabnzbd.settings.servers.<name>.optional | In case of connection failures, temporarily
disable this server. (See sabnzbd's documentation
for usage guides).
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs.*.path | Stream URL
|
| services.authelia.instances.<name>.settings | Your Authelia config.yml as a Nix attribute set
|
| services.anubis.instances.<name>.settings.TARGET | The reverse proxy target that Anubis is protecting
|
| services.printing.cups-pdf.instances.<name>.settings | Settings for a cups-pdf instance, see the descriptions in the template config file in the cups-pdf package
|
| services.tlsrpt.reportd.settings.dbname | Path to the sqlite database.
|
| services.mautrix-meta.instances.<name>.settings | config.yaml configuration as a Nix attribute set
|
| services.lasuite-meet.settings.DB_NAME | Name of the database
|
| services.lasuite-docs.settings.DB_NAME | Name of the database
|
| services.postfix.settings.master.<name>.privileged | |
| services.zeronsd.servedNetworks.<name>.settings.domain | Domain under which ZeroTier records will be available.
|
| services.archisteamfarm.bots.<name>.settings | Additional settings that are documented here.
|
| services.authelia.instances.<name>.settings.log.level | Level of verbosity for logs.
|
| services.logrotate.settings.<name>.frequency | How often to rotate the logs
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets | The subnets which this tinc daemon will serve
|
| services.easytier.instances.<name>.settings.peers | Peers to connect initially
|
| services.headscale.settings.dns.extra_records.*.name | DNS record name.
|
| services.bonsaid.settings.*.event_name | Name of the event which should trigger this transition when received by bonsaid
|
| services.openssh.settings.UseDns | Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for
the remote IP address maps back to the very same IP address
|
| services.angrr.settings.profile-policies.<name>.keep-latest-n | Keep the latest N GC roots in this profile.
|
| services.gitea-actions-runner.instances.<name>.settings | Configuration for act_runner daemon
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs.*.roles | List of roles for this stream
|
| services.sslh.settings.protocols | List of protocols sslh will probe for and redirect
|
| services.easytier.instances.<name>.settings.network_name | EasyTier network name.
|
| services.easytier.instances.<name>.settings.ipv4 | IPv4 cidr address of this peer in the virtual network
|
| services.printing.cups-pdf.instances.<name>.settings.Spool | spool directory
|
| services.wstunnel.servers.<name>.settings.restrict-to.*.port | The port.
|
| services.wstunnel.servers.<name>.settings.restrict-to.*.host | The hostname.
|
| services.syncthing.settings.folders.<name>.enable | Whether to share this folder
|
| services.invoiceplane.sites.<name>.settings | Structural InvoicePlane configuration
|
| services.hatsu.settings.HATSU_DOMAIN | The domain name of your instance (eg 'hatsu.local').
|
| services.inadyn.settings.provider.<name>.password | Password for this DDNS provider
|
| services.authelia.instances.<name>.settings.log.format | Format the logs are written as.
|
| services.vault-agent.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.pds.settings.PDS_HOSTNAME | Instance hostname (base domain name)
|
| services.tinc.networks.<name>.interfaceType | The type of virtual interface used for the network connection.
|
| services.biboumi.settings.hostname | The hostname served by the XMPP gateway
|
| services.anubis.instances.<name>.settings.METRICS_BIND | The address Anubis' metrics server listens to
|
| services.simplesamlphp.<name>.settings | Configuration options used by SimpleSAMLphp
|
| services.maubot.settings.server.hostname | The IP to listen on
|
| services.grafana.provision.alerting.muteTimings.settings.muteTimes.*.name | Name of the mute time interval, must be unique
|
| services.warpgate.settings.sso_providers.*.name | Internal identifier of SSO provider.
|
| services.vault-agent.instances.<name>.settings.template | Template section of vault-agent
|
| services.evremap.settings.device_name | The name of the device that should be remapped
|
| services.radicle.ci.broker.settings.adapters.<name>.command | Adapter command to run.
|
| services.gitea.settings.server.DOMAIN | Domain name of your server.
|
| services.pgbackrest.stanzas.<name>.settings | An attribute set of options as described in:
https://pgbackrest.org/configuration.html
All options can be used
|
| services.anubis.instances.<name>.settings.BIND_NETWORK | The network family that Anubis should bind to
|
| services.printing.cups-pdf.instances.<name>.settings.AnonDirName | path for anonymously created PDF files
|
| services.botamusique.settings.bot.username | Name the bot should appear with.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| services.authelia.instances.<name>.settingsFiles | Here you can provide authelia with configuration files or directories
|
| services.hockeypuck.settings | Configuration file for hockeypuck, here you can override
certain settings (loglevel and
openpgp.db.dsn) by just setting those values
|
| services.zeronsd.servedNetworks.<name>.settings.wildcard | Whether to serve a wildcard record for ZeroTier Nodes.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| services.grafana.provision.dashboards.settings.providers.*.name | A unique provider name.
|
| services.tinc.networks.<name>.ed25519PrivateKeyFile | Path of the private ed25519 keyfile.
|
| services.angrr.settings.temporary-root-policies.<name>.enable | Whether to enable this angrr policy.
|
| services.tinc.networks.<name>.hostSettings.<name>.addresses | The external address where the host can be reached
|
| services.wstunnel.servers.<name>.settings.restrict-to | Restrictions on the connections that the server will accept
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets.*.weight | Indicates the priority over identical Subnets owned by different nodes
|
| services.syncthing.settings.folders.<name>.devices | The devices this folder should be shared with
|
| services.hickory-dns.settings.zones.*.zone | Zone name, like "example.com", "localhost", or "0.0.127.in-addr.arpa".
|
| services.angrr.settings.temporary-root-policies.<name>.period | Retention period for the GC roots matched by this policy.
|
| services.angrr.settings.temporary-root-policies.<name>.path-regex | Regex pattern to match the GC root path.
|
| services.angrr.settings.profile-policies.<name>.keep-booted-system | Whether to keep the last booted system generation
|
| services.grafana.provision.alerting.muteTimings.settings.deleteMuteTimes.*.name | Name of the mute time interval, must be unique
|
| services.vmalert.instances.<name>.settings."notifier.url" | Prometheus Alertmanager URL
|
| services.printing.cups-pdf.instances.<name>.settings.GhostScript | location of GhostScript binary
|
| services.keycloak.settings.hostname | The hostname part of the public URL used as base for
all frontend requests
|
| services.zeronsd.servedNetworks.<name>.settings.log_level | Log Level.
|
| services.angrr.settings.temporary-root-policies.<name>.filter | External filter program to further filter GC roots matched by this policy.
|
| services.tinc.networks.<name>.hostSettings.<name>.addresses.*.port | The port where the host can be reached
|
| services.acme-dns.settings.general.domain | Domain name to serve the requests off of.
|
| services.gancio.settings.db.database | Name of the PostgreSQL database
|
| services.angrr.settings.temporary-root-policies.<name>.ignore-prefixes | List of path prefixes to ignore
|
| services.dependency-track.settings."alpine.oidc.username.claim" | Defines the name of the claim that contains the username in the provider's userinfo endpoint
|
| services.authelia.instances.<name>.settings.server.address | The address to listen on.
|
| services.sabnzbd.settings.servers.<name>.connections | Number of parallel connections permitted by
the server.
|
| services.angrr.settings.profile-policies.<name>.keep-current-system | Whether to keep the current system generation
|
| services.armagetronad.servers.<name>.settings | Armagetron Advanced server rules configuration
|
| services.syncthing.settings.devices.<name>.autoAcceptFolders | Automatically create or share folders that this device advertises at the default path
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| services.sabnzbd.settings.servers.<name>.ssl_verify | Level of TLS verification
|
| services.grafana.provision.alerting.contactPoints.settings.contactPoints.*.name | Name of the contact point
|
| services.canaille.settings.SERVER_NAME | The domain name on which canaille will be served.
|
| services.forgejo.settings.server.DOMAIN | Domain name of your server.
|
| services.angrr.settings.temporary-root-policies.<name>.ignore-prefixes-in-home | Path prefixes to ignore under home directory
|
| services.tor.settings.ServerDNSAllowNonRFC953Hostnames | See torrc manual.
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets.*.prefixLength | The prefix length of the subnet
|
| services.anubis.instances.<name>.settings.DIFFICULTY | The difficulty required for clients to solve the challenge
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceSingleHopMode | See torrc manual.
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets.*.address | The subnet of this host
|
| services.consul-template.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.printing.cups-pdf.instances.<name>.settings.Anonuser | User for anonymous PDF creation
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceMaxStreams | See torrc manual.
|
| services.vmalert.instances.<name>.settings."datasource.url" | Datasource compatible with Prometheus HTTP API.
|
| services.hddfancontrol.settings.<drive-bay-name>.extraArgs | Extra commandline arguments for hddfancontrol
|
| services.radicle.ci.adapters.native.instances.<name>.settings | Configuration of radicle-native-ci
|
| services.grafana.provision.alerting.templates.settings.templates.*.name | Name of the template, must be unique
|
| services.angrr.settings.profile-policies.<name>.profile-paths | Paths to the Nix profile
|
| services.anubis.instances.<name>.settings.WEBMASTER_EMAIL | If set, shows a contact email address when rendering error pages
|
| services.anubis.instances.<name>.settings.METRICS_BIND_NETWORK | The network family that the metrics server should bind to
|
| services.consul-template.instances.<name>.settings.template | Template section of consul-template
|
| services.syncthing.settings.folders.<name>.versioning.type | The type of versioning
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| services.authelia.instances.<name>.settings.log.file_path | File path where the logs will be written
|
| services.minidlna.settings.friendly_name | Name that the server presents to clients.
|
| services.pretix.settings.pretix.instance_name | The name of this installation.
|
| services.matrix-tuwunel.settings.global.server_name | The server_name is the name of this server
|
| services.matrix-conduit.settings.global.server_name | The server_name is the name of this server
|
| services.postfix.settings.master.<name>.wakeupUnusedComponent | If set to false the component will only be woken
up if it is used
|
| services.radicle.ci.adapters.native.instances.<name>.settings.log | File where radicle-native-ci should write the run log.
|
| services.matrix-synapse.settings.server_name | The domain name of the server, with optional explicit port
|
| services.tinc.networks.<name>.hostSettings.<name>.addresses.*.address | The external IP address or hostname where the host can be reached.
|
| services.suricata.settings.app-layer.protocols.<name>.enabled | The option "enabled" takes 3 values - "yes", "no", "detection-only".
"yes" enables both detection and the parser, "no" disables both, and
"detection-only" enables protocol detection only (parser disabled).
|
| services.syncthing.settings.folders.<name>.versioning | How to keep changed/deleted files with Syncthing
|
| services.easytier.instances.<name>.settings.instance_name | Identify different instances on same host
|
| services.dendrite.settings.global.server_name | The domain name of the server, with optional explicit port
|
| services.sabnzbd.settings.servers.<name>.expire_date | If Notifications are enabled and an expiry date is
set, warn 5 days before expiry
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| services.bluesky-pds.settings.PDS_HOSTNAME | Instance hostname (base domain name)
|
| services.angrr.settings.temporary-root-policies.<name>.filter.program | Path to the external filter program.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| services.umami.settings.TRACKER_SCRIPT_NAME | Allows you to assign a custom name to the tracker script different from the default script.js.
|
| services.hddfancontrol.settings.<drive-bay-name>.disks | Drive(s) to get temperature from
Can also use command substitution to automatically grab all matching drives; such as all scsi (sas) drives
|
| services.easytier.instances.<name>.settings.listeners | Listener addresses to accept connections from other peers
|
| services.radicle.ci.adapters.native.instances.<name>.settings.state | Directory where per-run directories are stored.
|
| services.reposilite.settings.hostname | The hostname to bind to
|
| services.grafana.provision.datasources.settings.datasources.*.name | Name of the datasource
|
| services.dsnet.settings.ExternalHostname | The hostname that clients should use to connect to this server
|
| services.angrr.settings.temporary-root-policies.<name>.priority | Priority of this policy
|
| services.suricata.settings.unix-command.filename | Filename for unix-command socket.
|
| services.grafana.provision.alerting.templates.settings.deleteTemplates.*.name | Name of the template, must be unique
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceExportCircuitID | See torrc manual.
|
| services.postfix.settings.main.myhostname | The internet hostname of this mail system
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceAllowUnknownPorts | See torrc manual.
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceDirGroupReadable | See torrc manual.
|
| services.anubis.instances.<name>.settings.OG_PASSTHROUGH | Whether to enable Open Graph tag passthrough
|
| services.hddfancontrol.settings.<drive-bay-name>.pwmPaths | PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
Can also use command substitution to ensure the correct hwmonX is selected on every boot
|
| services.rosenpass.settings.peers.*.device | Name of the local WireGuard interface to use for this peer.
|
| services.grafana.provision.datasources.settings.deleteDatasources.*.name | Name of the datasource to delete.
|
| services.libeufin.nexus.settings.nexus-ebics.HOST_ID | Name of the EBICS host.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| services.authelia.instances.<name>.settings.log.keep_stdout | Whether to also log to stdout when a file_path is defined.
|
| services.bookstack.settings | Options for Bookstack configuration
|
| services.cgit.<name>.gitHttpBackend.enable | Whether to bypass cgit and use git-http-backend for HTTP clones
|
| services.tlsrpt.collectd.settings.socketname | Path at which the UNIX socket will be created.
|
| services.oncall.settings.db.conn.kwargs.database | Database name.
|
| services.sourcehut.settings."sr.ht".global-domain | Global domain name.
|
| services.kerberos_server.settings.realms.<name>.acl | The privileges granted to a user.
|
| services.hddfancontrol.settings.<drive-bay-name>.logVerbosity | Verbosity of the log level
|
| services.grafana.settings.server.domain | The public facing domain name used to access grafana from a browser
|
| services.suricata.settings.default-log-dir | The default logging directory
|
| services.spacecookie.settings.hostname | The hostname the service is reachable via
|
| services.angrr.settings.temporary-root-policies.<name>.filter.arguments | Extra command-line arguments pass to the external filter program.
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceMaxStreamsCloseCircuit | See torrc manual.
|
| services.syncthing.settings.folders.<name>.copyOwnershipFromParent | On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in)
|
| services.radicle.ci.adapters.native.instances.<name>.settings.base_url | Base URL for build logs (mandatory for access from CI broker page).
|
| services.simplesamlphp.<name>.settings.baseurlpath | URL where SimpleSAMLphp can be reached.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| services.suwayomi-server.settings.server.basicAuthUsername | The username value that you have to provide when authenticating.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| services.nvme-rs.settings.email.smtp_username | SMTP username
|
| services.resolved.settings.Resolve.Domains | List of search domains used to complete unqualified name lookups.
|
| services.authelia.instances.<name>.settings.telemetry.metrics.enabled | Enable Metrics.
|
| services.github-runners.<name>.user | User under which to run the service
|
| services.healthchecks.settings.DB_NAME | Database name.
|
| services.kerberos_server.settings.realms.<name>.acl.*.target | The principals that 'access' applies to.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| services.suricata.settings.logging.outputs.file.filename | Filename of the logfile.
|
| services.authelia.instances.<name>.settings.telemetry.metrics.address | The address to listen on for metrics
|
| services.syncthing.settings.folders.<name>.ignorePatterns | Syncthing can be configured to ignore certain files in a folder using ignore patterns
|
| services.libeufin.nexus.settings.nexus-ebics.CURRENCY | Name of the fiat currency.
|
| services.cgit.<name>.gitHttpBackend.checkExportOkFiles | Whether git-http-backend should only export repositories that contain a git-daemon-export-ok file
|
| services.headscale.settings.dns.nameservers.global | List of nameservers to pass to Tailscale clients.
|
| services.radicle.ci.broker.settings.triggers.*.adapter | Adapter name.
|
| services.dovecot2.imapsieve.mailbox.*.name | This setting configures the name of a mailbox for which administrator scripts are configured
|
| services.matrix-continuwuity.settings.global.server_name | The server_name is the name of this server
|
| services.h2o.hosts.<name>.tls.recommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| services.anubis.defaultOptions.settings.POLICY_FNAME | The policy file to use
|
| services.public-inbox.settings.publicinbox.css | The local path name of a CSS file for the PSGI web interface.
|
| services.dependency-track.settings."alpine.oidc.teams.claim" | Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
|
| services.matrix-synapse.settings.listeners.*.resources.*.names | List of resources to host on this listener.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| services.btrbk.instances.<name>.settings.stream_compress | Compress the btrfs send stream before transferring it from/to remote locations using a
compression command.
|
| services.suricata.settings.unix-command | Unix command socket that can be used to pass commands to Suricata
|
| services.kerberos_server.settings.realms.<name>.acl.*.principal | Which principal the rule applies to
|
| services.easytier.instances.<name>.settings.network_secret | EasyTier network credential used for verification and
encryption
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceNumIntroductionPoints | See torrc manual.
|
| services.anubis.defaultOptions.settings.SERVE_ROBOTS_TXT | Whether to serve a default robots.txt that denies access to common AI bots by name and all other
bots by wildcard.
|
| services.nextcloud.settings.mail_smtpname | This depends on mail_smtpauth
|
| services.kerberos_server.settings.realms.<name>.acl.*.access | The changes the principal is allowed to make.
The "all" permission does not imply the "get-keys" permission
|
| services.dependency-track.settings."alpine.database.username" | Specifies the username to use when authenticating to the database.
|
| services.mobilizon.settings.":mobilizon".":instance".hostname | Your instance's hostname
|
| users.users.<name>.linger | Whether to enable or disable lingering for this user
|
| services.prometheus.exporters.process.settings.process_names | All settings expressed as an Nix attrset
|
| services.libeufin.nexus.settings.nexus-ebics.BANK_DIALECT | Name of the following combination: EBICS version and ISO20022
recommendations that Nexus would honor in the communication with the
bank
|
| services.easytier.instances.<name>.extraSettings | Extra settings to add to easytier-‹name›.toml.
|
| services.journald.upload.settings.Upload.ServerKeyFile | SSL key in PEM format
|
| services.transmission.settings.script-torrent-done-filename | Executable to be run at torrent completion.
|
| services.matrix-synapse.settings.database.args.database | Name of the database when using the psycopg2 backend,
path to the database location when using sqlite3.
|
| services.tlsrpt.reportd.settings.organization_name | Name of the organization sending out the reports.
|
| services.grafana.settings.database.server_cert_name | The common name field of the certificate used by the mysql or postgres server
|
| services.suricata.settings.outputs | Configure the type of alert (and other) logging you would like
|
| users.extraUsers.<name>.linger | Whether to enable or disable lingering for this user
|
| services.keycloak.settings.hostname-backchannel-dynamic | Enables dynamic resolving of backchannel URLs,
including hostname, scheme, port and context path
|
| services.matrix-appservice-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.prometheus.exporters.fritz.settings.devices.*.username | Username to authenticate with the target device.
|
| services.prometheus.exporters.fritz.settings.devices.*.hostname | Hostname under which the target device is reachable.
|
| services.discourse.siteSettings | Discourse site settings
|
| services.grafana.settings.smtp.ehlo_identity | Name to be used as client identity for EHLO in SMTP dialog.
|
| services.matrix-synapse.settings.log_config | The file that holds the logging configuration.
|
| services.warpgate.settings.external_host | Configure the domain name of this Warpgate instance
|
| services.hostapd.radios.<name>.networks.<name>.authentication.mode | Selects the authentication mode for this AP.
- "none": Don't configure any authentication
|
| services.nextcloud.settings."profile.enabled" | Makes user-profiles globally available under nextcloud.tld/u/user.name
|
| services.easytier.instances.<name>.configFile | Path to easytier config file
|
| services.jupyter.user | Name of the user used to run the jupyter service
|
| services.warpgate.settings.sso_providers.*.label | SSO provider name displayed on login page.
|
| services.opendkim.keyPath | The path that opendkim should put its generated private keys into
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".username | User used to connect to the database
|
| services.prometheus.exporters.nginxlog.settings.namespaces | Namespaces to collect the metrics for
|
| services.sanoid.datasets.<name>.recursive | Whether to recursively snapshot dataset children
|
| services.crowdsec-firewall-bouncer.settings.api_key | API key to authenticate with a local crowdsec API
|
| services.nipap.settings.auth.default_backend | Name of auth backend to use by default.
|
| services.matrix-appservice-irc.settings.homeserver.domain | The 'domain' part for user IDs on this home server
|
| services.grafana.provision.alerting.rules.settings.groups.*.folder | Name of the folder the rule group will be stored in
|
| services.nginx.virtualHosts.<name>.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.nginx.virtualHosts.<name>.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.printing.cups-pdf.instances.<name>.confFileText | This will contain the contents of cups-pdf.conf for this instance, derived from settings
|
| services.authelia.instances.<name>.settings.default_2fa_method | Default 2FA method for new users and fallback for preferred but disabled methods.
|
| services.factorio.saveName | The name of the savegame that will be used by the server
|
| services.biboumi.settings.realname_from_jid | Whether the realname and username of each biboumi
user will be extracted from their JID
|
| services.journald.upload.settings.Upload.ServerCertificateFile | SSL CA certificate in PEM format
|
| services.matrix-synapse.log | Default configuration for the loggers used by matrix-synapse and its workers
|
| security.pam.rssh.settings.auth_key_file | Path to file with trusted public keys in OpenSSH's authorized_keys format
|
| services.fedimintd.<name>.nginx.config.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.pgbouncer.settings.pgbouncer.listen_addr | Specifies a list (comma-separated) of addresses where to listen for TCP connections
|
| services.easytier.instances.<name>.configServer | Configure the instance from config server
|
| documentation.man.mandoc.settings.output.man | A template for linked manuals (usually via the Xr macro) in HTML
output
|
| services.movim.h2o.tls.recommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".database | Name of the database
|
| boot.uki.name | Name of the UKI
|
| services.frp.instances.<name>.environmentFiles | List of paths files that follows systemd environmentfile structure
|
| services.h2o.defaultTLSRecommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| services.veilid.settings.core.network.routing_table.bootstrap | Host name of existing well-known Veilid bootstrap servers for the network to connect to.
|
| services.dolibarr.h2o.tls.recommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| documentation.man.mandoc.settings.output.paper | This option is for generating PostScript and PDF output
|
| users.users.<name>.name | The name of the user account
|
| virtualisation.xen.store.settings.perms.enableWatch | Whether to enable the watch permission system
|
| services.btrbk.extraPackages | Extra packages for btrbk, like compression utilities for stream_compress.
Note: This option will get deprecated in future releases
|
| services.filesender.settings.log_facilities | Defines where FileSender logging is sent
|
| services.pgbouncer.settings.pgbouncer.max_client_conn | Maximum number of client connections allowed
|
| services.davis.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.davis.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.movim.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.slskd.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.slskd.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.movim.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| systemd.network.networks.<name>.name | The name of the network interface to match against.
|
| users.groups.<name>.name | The name of the group
|
| services.snipe-it.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.snipe-it.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.filebeat.inputs | Inputs specify how Filebeat locates and processes input data
|
| services.akkoma.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.gancio.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fluidd.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fluidd.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.gancio.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.akkoma.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.matomo.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.matomo.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.monica.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.monica.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.libvirtd.autoSnapshot.vms | If specified only the list of VMs will be snapshotted else all existing one
|
| services.nylon.<name>.name | The name of this nylon instance.
|
| services.headscale.settings.tls_letsencrypt_hostname | Domain name to request a TLS certificate for.
|
| services.pufferpanel.environment | Environment variables to set for the service
|
| services.hostapd.radios.<name>.networks.<name>.ssid | SSID to be used in IEEE 802.11 management frames.
|
| services.matrix-synapse.settings.trusted_key_servers.*.server_name | Hostname of the trusted server.
|
| services.dolibarr.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.agorakit.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.librenms.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.kanboard.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fediwall.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.librenms.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.kanboard.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.fediwall.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.agorakit.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.dolibarr.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.mainsail.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.pixelfed.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.pixelfed.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.mainsail.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| users.extraUsers.<name>.name | The name of the user account
|
| services.hostapd.radios.<name>.networks.<name>.group | Members of this group can access the control socket for this interface.
|
| services.radicle.httpd.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.radicle.httpd.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.biboumi.settings.realname_customization | Whether the users will be able to use
the ad-hoc commands that lets them configure
their realname and username.
|
| services.hostapd.radios.<name>.networks.<name>.utf8Ssid | Whether the SSID is to be interpreted using UTF-8 encoding.
|
| services.anuko-time-tracker.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.anuko-time-tracker.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.bookstack.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.bookstack.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| system.name | The name of the system used in the system.build.toplevel derivation
|
| services.bind.zones.<name>.name | Name of the zone.
|
| services.jirafeau.nginxConfig.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.jirafeau.nginxConfig.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.nebula.networks.<name>.ca | Path to the certificate authority certificate.
|
| services.hostapd.radios.<name>.networks.<name>.macDeny | Specifies the MAC addresses to deny if macAcl is set to "deny" or "radius"
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.hostapd.radios.<name>.networks.<name>.logLevel | Levels (minimum value for logged events):
0 = verbose debugging
1 = debugging
2 = informational messages
3 = notification
4 = warning
|
| services.pppd.peers.<name>.name | Name of the PPP peer.
|
| users.extraGroups.<name>.name | The name of the group
|
| services.lact.settings | Settings for LACT
|
| services.tor.settings.EnforceDistinctSubnets | See torrc manual.
|
| services.nebula.networks.<name>.key | Path or reference to the host key.
|
| services.nebula.networks.<name>.tun.device | Name of the tun device
|
| services.mjolnir.settings | Additional settings (see mjolnir default config for available settings)
|
| services.metricbeat.modules | Metricbeat modules are responsible for reading metrics from the various sources
|
| services.hostapd.radios.<name>.networks.<name>.macAllow | Specifies the MAC addresses to allow if macAcl is set to "allow" or "radius"
|
| services.nebula.networks.<name>.cert | Path to the host certificate.
|
| services.hostapd.radios.<name>.networks.<name>.apIsolate | Isolate traffic between stations (clients) and prevent them from
communicating with each other.
|
| boot.uki.settings | The configuration settings for ukify
|
| services.nitter.settings | Add settings here to override NixOS module generated settings
|
| services.filebeat.modules | Filebeat modules provide a quick way to get started
processing common log formats
|
| services.hostapd.radios.<name>.networks.<name>.bssid | Specifies the BSSID for this BSS
|
| services.hostapd.radios.<name>.networks.<name>.macAcl | Station MAC address -based authentication
|
| services.nebula.networks.<name>.isRelay | Whether this node is a relay.
|
| services.hostapd.radios.<name>.networks.<name>.macDenyFile | Specifies a file containing the MAC addresses to deny if macAcl is set to "deny" or "radius"
|
| virtualisation.oci-containers.containers.<name>.podman | Podman-specific settings in OCI containers
|
| services.limesurvey.nginx.virtualHost.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.postgresql.systemCallFilter | Configures the syscall filter for postgresql.service
|
| services.hostapd.radios.<name>.networks.<name>.macAllowFile | Specifies a file containing the MAC addresses to allow if macAcl is set to "allow" or "radius"
|
| services.nebula.networks.<name>.enable | Enable or disable this network.
|
| services.nebula.networks.<name>.relays | List of IPs of relays that this node should allow traffic from.
|
| services.yggdrasil.openMulticastPort | Whether to open the UDP port used for multicast peer discovery
|
| systemd.units.<name>.name | The name of this systemd unit, including its extension
|
| systemd.paths.<name>.name | The name of this systemd unit, including its extension
|
| services.amule.settings | Free form attribute set for aMule settings
|
| services.i2pd.inTunnels.<name>.name | The endpoint name.
|
| systemd.services.<name>.name | The name of this systemd unit, including its extension
|
| services.etcd.name | Etcd unique node name.
|
| services.davfs2.settings | Extra settings appended to the configuration of davfs2
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.i2pd.outTunnels.<name>.name | The endpoint name.
|
| services.nebula.networks.<name>.package | The nebula package to use.
|
| services.nebula.networks.<name>.listen.port | Port number to listen on.
|
| services.nebula.networks.<name>.listen.host | IP address to listen on.
|
| services.znc.confOptions.networks.<name>.port | IRC server port.
|
| services.centrifugo.environmentFiles | Files to load environment variables from
|
| services.odoo.settings | Odoo configuration settings
|
| services.znc.confOptions.networks.<name>.useSSL | Whether to use SSL to connect to the IRC server.
|
| services.ncdns.settings | ncdns settings
|
| services.hostapd.radios.<name>.networks | This defines a BSS, colloquially known as a WiFi network
|
| services.sslh.settings | sslh configuration
|
| services.bitcoind.<name>.rpc.users.<name>.name | Username for JSON-RPC connections.
|
| services.marytts.settings | Settings for MaryTTS
|
| security.pam.services.<name>.name | Name of the PAM service.
|
| services.picom.settings | Picom settings
|
| services.newt.settings | Settings for Newt module, see Newt CLI docs for more information.
|
| services.xray.settings | The configuration object
|
| systemd.timers.<name>.name | The name of this systemd unit, including its extension
|
| systemd.slices.<name>.name | The name of this systemd unit, including its extension
|
| services.firezone.server.provision.accounts | All accounts to provision
|
| services.ntpd-rs.settings | Settings to write to ntp.toml
See https://docs.ntpd-rs.pendulum-project.org/man/ntp.toml.5
for more information about available options.
|
| services.auto-epp.settings | Settings for the auto-epp application
|
| services.netbird.tunnels.<name>.name | Primary name for use (as a suffix) in:
- systemd service name,
- hardened user name and group,
- systemd
*Directory= names,
- desktop application identification,
|
| services.netbird.clients.<name>.name | Primary name for use (as a suffix) in:
- systemd service name,
- hardened user name and group,
- systemd
*Directory= names,
- desktop application identification,
|
| systemd.user.services.<name>.name | The name of this systemd unit, including its extension
|
| services.rspamd.workers.<name>.name | Name of the worker
|
| services.nebula.networks.<name>.tun.disable | When tun is disabled, a lighthouse can be started without a local tun interface (and therefore without root).
|
| services.rimgo.settings | Settings for rimgo, see the official documentation for supported options.
|
| systemd.user.units.<name>.name | The name of this systemd unit, including its extension
|
| systemd.user.paths.<name>.name | The name of this systemd unit, including its extension
|
| services.znc.confOptions.networks.<name>.server | IRC server address.
|
| services.nebula.networks.<name>.staticHostMap | The static host map defines a set of hosts with fixed IP addresses on the internet (or any network)
|
| services.searx.settings | Searx settings
|
| services.stubby.settings | Content of the Stubby configuration file
|
| services.redlib.settings | See GitHub for available settings.
|
| services.znc.confOptions.networks.<name>.extraConf | Extra config for the network
|
| services.acme-dns.settings | Free-form settings written directly to the acme-dns.cfg file
|
| services.aria2.settings | Generates the aria2.conf file
|
| services.hickory-dns.settings | Settings for hickory-dns
|
| services.hercules-ci-agent.settings | These settings are written to the agent.toml file
|
| services.hylafax.modems.<name>.name | Name of modem device,
will be searched for in /dev.
|
| services.movim.settings | .env settings for Movim
|
| services.lldap.settings | Free-form settings written directly to the lldap_config.toml file
|
| services.screego.settings | Screego settings passed as Nix attribute set, they will be merged with
the defaults
|
| systemd.targets.<name>.name | The name of this systemd unit, including its extension
|
| systemd.sockets.<name>.name | The name of this systemd unit, including its extension
|
| services.wakapi.settings | Settings for Wakapi
|
| services.nebula.networks.<name>.enableReload | Enable automatic config reload on config change
|
| services.g3proxy.settings | Settings of g3proxy.
|
| services.mailman.settings | Settings for mailman.cfg
|
| services.znc.confOptions.networks.<name>.modules | ZNC network modules to load.
|
| services.gokapi.settings | Configuration settings for the generated config json file
|
| services.i2pd.upnp.name | Name i2pd appears in UPnP forwardings list.
|
| systemd.user.slices.<name>.name | The name of this systemd unit, including its extension
|
| systemd.user.timers.<name>.name | The name of this systemd unit, including its extension
|
| services.github-runners.<name>.name | Name of the runner to configure
|
| services.privoxy.settings | This option is mapped to the main Privoxy configuration file
|
| virtualisation.oci-containers.containers.<name>.capabilities | Capabilities to configure for the container
|
| services.hostapd.radios.<name>.networks.<name>.dynamicConfigScripts | All of these scripts will be executed in lexicographical order before hostapd
is started, right after the bss segment was generated and may dynamically
append bss options to the generated configuration file
|
| services.postfix.settings.main.mynetworks | List of trusted remote SMTP clients, that are allowed to relay mail
|
| services.draupnir.settings | Free-form settings written to Draupnir's configuration file
|
| services.pgadmin.settings | Settings for pgadmin4.
Documentation
|
| services.bacula-sd.name | Specifies the Name of the Storage daemon.
|
| image.repart.name | Name of the image
|
| services.sanoid.settings | Free-form settings written directly to the config file
|
| services.umurmur.settings | Settings of uMurmur
|
| services.h2o.settings | Configuration for H2O (see https://h2o.examp1e.net/configure.html)
|
| services.fluent-bit.settings | See configurationFile.
configurationFile takes precedence over settings.
|
| services.misskey.settings.db | Database settings.
|
| services.opengfw.settings.io | IO settings.
|
| services.maubot.settings | YAML settings for maubot
|
| services.openbao.settings | Settings of OpenBao
|
| services.opengfw.settings | Settings passed to OpenGFW. Example config
|
| services.tor.settings | See torrc manual
for documentation.
|
| services.private-gpt.settings | settings-local.yaml for private-gpt
|
| networking.networkmanager.ensureProfiles.profiles | Declaratively define NetworkManager profiles
|
| services.sssd.settings | Contents of sssd.conf.
|
| services.znc.confOptions.networks.<name>.channels | IRC channels to join.
|
| services.n8n.settings | Configuration for n8n, see https://docs.n8n.io/hosting/environment-variables/configuration-methods/
for supported values.
|
| services.pretix.settings | pretix configuration as a Nix attribute set
|
| security.agnos.settings | Settings
|
| services.znc.confOptions.networks.<name>.password | IRC server password, such as for a Slack gateway.
|
| services.eintopf.settings | Settings to configure web service
|
| services.evremap.settings | Settings for evremap
|
| services.knot.settings | Extra configuration as nix values.
|
| services.bcg.name | Name for the device
|
| services.public-inbox.settings | Settings for the public-inbox config file.
|
| services.tlp.settings | Options passed to TLP
|
| services.kimai.sites.<name>.database.name | Database name.
|
| services.k3s.autoDeployCharts.<name>.name | The name of the Helm chart
|
| services.grafana.settings | Grafana settings
|
| services.apache-kafka.settings | Kafka broker configuration
server.properties
|
| services.suricata.settings | Suricata settings
|
| services.i2pd.proto.bob.name | The endpoint name.
|
| services.i2pd.proto.sam.name | The endpoint name.
|
| services.bacula-dir.name | The director name used by the system administrator
|
| services.rke2.autoDeployCharts.<name>.name | The name of the Helm chart
|
| services.bacula-fd.name | The client name that must be used by the Director when connecting
|
| systemd.user.sockets.<name>.name | The name of this systemd unit, including its extension
|
| systemd.user.targets.<name>.name | The name of this systemd unit, including its extension
|
| services.nebula.networks.<name>.isLighthouse | Whether this node is a lighthouse.
|
| services.lemmy.settings | Lemmy configuration
|
| services.aesmd.settings | AESM configuration
|
| services.stash.settings | Stash configuration
|
| services.hostapd.radios.<name>.networks.<name>.ignoreBroadcastSsid | Send empty SSID in beacons and ignore probe request frames that do not
specify full SSID, i.e., require stations to know SSID
|
| services.ntfy-sh.settings | Configuration for ntfy.sh, supported values are here.
|
| services.turn-rs.settings | Turn-rs server config file
|
| services.send.redis.name | Name of the redis server
|
| services.bee.settings | Ethereum Swarm Bee configuration
|
| hardware.alsa.controls.<name>.name | Name of the control, as it appears in alsamixer
|
| services.kmonad.keyboards.<name>.name | Keyboard name.
|
| services.netbird.clients.<name>.user.name | A system user name for this client instance.
|
| services.netbird.tunnels.<name>.user.name | A system user name for this client instance.
|
| services.haven.settings | See https://github.com/bitvora/haven for documentation.
|
| services.zwave-js.settings | Configuration settings for the generated config file
|
| services.thinkfan.settings | Thinkfan settings
|
| services.forgejo.settings | Free-form settings written directly to the app.ini configfile file
|
| services.pdns-recursor.settings | PowerDNS Recursor settings
|
| services.nebula.networks.<name>.firewall.inbound | Firewall rules for inbound traffic.
|
| services.buildkite-agents.<name>.name | The name of the agent as seen in the buildkite dashboard.
|
| services.akkoma.frontends.<name>.name | Akkoma frontend name.
|
| services.ifm.settings | Configuration of the IFM service
|
| services.dolibarr.settings | Dolibarr settings, see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example for details.
|
| services.mediamtx.settings | Settings for MediaMTX
|
| systemd.oomd.settings.OOM | Settings option for systemd-oomd
|
| services.patroni.name | The name of the host
|
| programs.nncp.settings | NNCP configuration, see
http://www.nncpgo.org/Configuration.html
|
| services.envoy.settings | Specify the configuration for Envoy in Nix.
|
| services.qui.settings.port | The port qui listens on.
|
| services.i2pd.proto.http.name | The endpoint name.
|
| services.i2pd.proto.i2cp.name | The endpoint name.
|
| services.drupal.sites.<name>.database.name | Database name.
|
| services.canaille.settings | Settings for Canaille
|
| services.frp.settings | Frp configuration, for configuration options
see the example of client
or server on github.
|
| services.postfix.masterConfig.<name>.name | The name of the service to run
|
| services.inadyn.settings.custom | Settings for custom DNS providers.
|
| services.pretalx.settings | pretalx configuration as a Nix attribute set
|
| services.lokinet.settings | Configuration for Lokinet
|
| services.wiki-js.settings | Settings to configure wiki-js
|
| services.komga.settings | Komga configuration
|
| services.angrr.settings | Global configuration for angrr in TOML format.
|
| services.dunst.settings | Dunst configuration, see dunst(5)
|
| services.qui.settings.host | The host address qui listens on.
|
| services.zrepl.settings | Configuration for zrepl
|
| services.openssh.settings.Macs | Allowed MACs
Defaults to recommended settings from both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| services.actual.settings | Server settings, refer to the documentation for available options
|
| services.isso.settings | Configuration for isso
|
| services.goss.settings | The global options in config file in yaml format
|
| services.kubo.settings | Attrset of daemon configuration
|
| services.nats.settings | Declarative NATS configuration
|
| services.cross-seed.settingsFile | Path to a JSON file containing settings that will be merged with the
settings option
|
| services.logind.settings.Login | Settings option for systemd-logind
|
| services.cachix-agent.name | Agent name, usually same as the hostname
|
| services.snipe-it.mail.from.name | Mail "from" name.
|
| services.howdy.settings | Howdy configuration file
|
| services.gonic.settings | Configuration for Gonic, see https://github.com/sentriz/gonic#configuration-options for supported values.
|
| services.clatd.settings | Configuration of clatd
|
| services.plikd.settings | Configuration for plikd, see https://github.com/root-gg/plik/blob/master/server/plikd.cfg
for supported values.
|
| services.omnom.settings | Configuration options for the /etc/omnom/config.yml file.
|
| services.slskd.settings | Application configuration for slskd
|
| services.nipap.settings | Configuration options to set in /etc/nipap/nipap.conf.
|
| services.kanboard.settings | Customize the default settings, refer to https://github.com/kanboard/kanboard/blob/main/config.default.php
for details on supported values.
|
| services.dendrite.settings | Configuration for dendrite, see:
https://github.com/matrix-org/dendrite/blob/main/dendrite-sample.yaml
for available options with which to populate settings.
|
| services.pixelfed.settings | .env settings for Pixelfed
|
| services.tor.settings.ORPort | See torrc manual.
|
| services.cockpit.settings | Settings for cockpit that will be saved in /etc/cockpit/cockpit.conf
|
| services.nfs.settings | General configuration for NFS daemons and tools
|
| services.v4l2-relayd.instances.<name>.name | The name of the instance.
|
| services.umami.settings.BASE_PATH | Allows you to host Umami under a subdirectory
|
| services.harmonia.settings | Settings to merge with the default configuration
|
| services.pds.settings.PDS_PORT | Port to listen on
|
| services.karma.settings | Karma dashboard configuration as nix attributes
|
| services.hatsu.settings | Configuration for Hatsu, see
|
| services.gitea.settings | Gitea configuration
|
| services.tuned.settings | Configuration for TuneD
|
| services.xmrig.settings | XMRig configuration
|
| services.pds.settings | Environment variables to set for the service
|
| services.nvme-rs.settings | Configuration for nvme-rs in TOML format
|
| services.aria2.settings.dir | Directory to store downloaded files.
|
| services.tor.settings.DirPort | See torrc manual.
|
| services.tor.settings.DNSPort | See torrc manual.
|
| services.tor.settings.PidFile | See torrc manual.
|
| services.nebula.networks.<name>.firewall.outbound | Firewall rules for outbound traffic.
|
| services.kmscon.fonts.*.name | Font name, as used by fontconfig.
|
| services.gatus.settings | Configuration for Gatus
|
| services.ulogd.settings | Configuration for ulogd
|
| services.pgscv.settings | Configuration for pgSCV, in YAML format
|
| services.tempo.settings | Specify the configuration for Tempo in Nix
|
| services.mpd.settings.port | This setting is the TCP port that is desired for the daemon to get assigned
to.
|
| services.sabnzbd.settings.ntfosd | NotifyOSD settings
|
| services.inadyn.settings | See inadyn.conf (5)
|
| services.mbpfan.settings | INI configuration for Mbpfan.
|
| services.crab-hole.settings | Crab-holes config
|
| services.nebula.networks.<name>.lighthouse.dns.port | UDP port number for lighthouse DNS server.
|
| services.opengfw.settings.replay | PCAP replay settings.
|
| services.tor.settings.IPv6Exit | See torrc manual.
|
| services.tor.settings.ExtORPort | See torrc manual.
|
| services.tor.settings.GeoIPFile | See torrc manual.
|
| services.wiki-js.settings.port | TCP port the process should listen to.
|
| services.legit.settings | The primary legit configuration
|
| services.umami.settings | Additional configuration (environment variables) for Umami, see
https://umami.is/docs/environment-variables for supported values.
|
| programs.rust-motd.settings | Settings on what to generate
|
| services.cloud-init.settings | Structured cloud-init configuration.
|
| services.kismet.settings | Options for Kismet
|
| services.vector.settings | Specify the configuration for Vector in Nix.
|
| services.wiki-js.settings.bindIP | IPs the service should listen to.
|
| services.sunshine.settings | Settings to be rendered into the configuration file
|
| services.rimgo.settings.PORT | The port to use.
|
| services.umami.settings.PORT | The port to listen on.
|
| services.kanidm.server.settings | Settings for Kanidm, see
the documentation
and example configuration
for possible values.
|
| services.oink.settings.apiKey | API key to use when modifying DNS records.
|
| services.paperless.settings | Extra paperless config options
|
| services.rauc.settings | Rauc configuration that will be converted to INI
|
| services.varnish.listen.*.name | Name is referenced in logs
|
| services.atticd.settings | Structured configurations of atticd
|
| services.garage.settings | Garage configuration, see https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/ for reference.
|
| services.tor.settings.NATDPort | See torrc manual.
|
| services.alice-lg.settings | alice-lg configuration, for configuration options see the example on github
|
| services.stash.settings.port | The port that Stash should listen on.
|
| services.kea.dhcp4.settings | Kea DHCP4 configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html.
|
| services.kea.dhcp6.settings | Kea DHCP6 configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html.
|
| services.cryptpad.settings | Cryptpad configuration settings
|
| services.netbird.tunnels.<name>.service.name | A systemd service name to use (without .service suffix).
|
| services.netbird.clients.<name>.service.name | A systemd service name to use (without .service suffix).
|
| services.hebbot.settings | Configuration for Hebbot, see, for examples:
|
| services.kavita.settings | Kavita configuration options, as configured in appsettings.json.
|
| services.acme-dns.settings.api.ip | IP to bind the HTTP API on.
|
| services.gancio.settings | Configuration for Gancio, see https://gancio.org/install/config for supported values.
|
| services.dgraph.settings | Contents of the dgraph config
|
| services.rsyncd.settings | Configuration for rsyncd
|
| services.nebula.networks.<name>.lighthouses | List of IPs of lighthouse hosts this node should report to and query from
|
| services.prosody.muc.*.name | The name to return in service discovery responses for the MUC service itself
|
| services.acme-dns.settings.api.tls | TLS backend to use.
|
| services.tsidp.settings.port | Port to listen on (default: 443).
|
| services.tor.settings.DirCache | See torrc manual.
|
| services.tor.settings.GeoIPv6File | See torrc manual.
|
| services.stash.settings.host | The ip address that Stash should bind to.
|
| services.authelia.instances.<name>.name | Name is used as a suffix for the service name, user, and group
|
| services.renovate.settings | Renovate's global configuration
|
| services.paisa.settings.dbFile | Filename of the Paisa database.
|
| services.nvme-rs.settings.email | Email notification configuration
|
| services.zammad.redis.name | Name of the redis server
|
| services.godns.settings | Configuration for GoDNS
|
| services.sympa.settings | The sympa.conf configuration file as key value set
|
| services.dex.settings | The available options can be found in
the example configuration
|
| services.blocky.settings | Blocky configuration
|
| services.erigon.settings | Configuration for Erigon
Refer to https://github.com/ledgerwatch/erigon#usage for details on supported values.
|
| services.greetd.settings | greetd configuration (documentation)
as a Nix attribute set.
|
| services.gobgpd.settings | GoBGP configuration
|
| services.soft-serve.settings | The contents of the configuration file for soft-serve
|
| services.qdrant.settings | Configuration for Qdrant
Refer to https://github.com/qdrant/qdrant/blob/master/config/config.yaml for details on supported values.
|
| services.gerrit.settings | Gerrit configuration
|
| services.zeyple.settings | Zeyple configuration. refer to
https://github.com/infertux/zeyple/blob/master/zeyple/zeyple.conf.example
for details on supported values.
|
| services.part-db.settings | Options for part-db configuration
|
| services.xray.settingsFile | The absolute path to the configuration file
|
| services.dovecot2.mailboxes.<name>.name | The name of the mailbox.
|
| services.lemmy.settings.port | Port where lemmy should listen for incoming requests.
|
| services.wiki-js.settings.db.host | Hostname or socket-path to connect to.
|
| services.phpfpm.settings | PHP-FPM global directives
|
| services.snipe-it.mail.replyTo.name | Mail "reply-to" name.
|
| services.tor.settings.HidServAuth | See torrc manual.
|
| services.evcc.settings | evcc configuration as a Nix attribute set
|
| systemd.network.networks.<name>.DHCP | Whether to enable DHCP on the interfaces matched.
|
| services.mympd.settings.ssl | Whether to enable listening on the SSL port
|
| services.neard.settings | Neard INI-style configuration file as a Nix attribute set
|
| services.postfix.settings.main | The main.cf configuration file as key value set
|
| services.pds.settings.PDS_DID_PLC_URL | URL of DID PLC directory
|
| services.omnom.settings.db.type | Database type.
|
| services.opengfw.rules.*.name | Name of the rule.
|
| services.opengfw.settings.workers | Worker settings.
|
| services.schleuder.settings | Settings for schleuder.yml
|
| services.mopidy.settings | The configuration that Mopidy should use
|
| services.strfry.settings | Configuration options to set for the Strfry service
|
| services.mchprs.settings | Configuration for MCHPRS via Config.toml
|
| services.zenohd.settings | Config options for zenoh.json5 configuration file
|
| services.listmonk.settings | Static settings set in the config.toml, see https://github.com/knadh/listmonk/blob/master/config.toml.sample for details
|
| services.nebula.networks.<name>.lighthouse.dns.host | IP address on which nebula lighthouse should serve DNS.
'localhost' is a good default to ensure the service does not listen on public interfaces;
use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.
|
| services.nostr-rs-relay.settings | See https://git.sr.ht/~gheartsfield/nostr-rs-relay/#configuration for documentation.
|
| services.stash.settings.cache | Path to cache
|
| services.nebula.networks.<name>.lighthouse.dns.enable | Whether this lighthouse node should serve DNS.
|
| services.ananicy.settings | See https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
|
| services.radicle.settings | See https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275
|
| services.crowdsec.name | Name of the machine when registering it at the central or local api.
|
| services.qui.settings | qui configuration options
|
| services.invidious.settings | The settings Invidious should use
|
| services.nominatim.settings | Nominatim configuration settings
|
| services.ente.api.settings.db.port | The database port
|
| services.ente.api.settings.db.host | The database host
|
| services.ente.api.settings.db.user | The database user
|
| services.paisa.settings.dataDir | Path to paisa data directory.
|
| services.tor.settings.ExitRelay | See torrc manual.
|
| services.tor.settings.SOCKSPort | See torrc manual.
|
| services.tor.settings.TransPort | See torrc manual.
|
| services.tor.settings.PerConnBWRate | See torrc manual.
|
| services.reaction.settings | Configuration for reaction
|
| services.clight.settings | Additional configuration to extend clight.conf
|
| services.netbox.settings | Configuration options to set in configuration.py
|
| services.sftpgo.settings | The primary sftpgo configuration
|
| services.porn-vault.settings | Configuration for Porn-Vault
|
| services.pghero.settings | PgHero configuration
|
| services.kea.dhcp-ddns.settings | Kea DHCP-DDNS configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html.
|
| systemd.network.networks.<name>.dns | A list of dns servers to be added to the network section of the
unit
|
| systemd.network.networks.<name>.vrf | A list of vrf interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.ntp | A list of ntp servers to be added to the network section of the
unit
|
| services.aesmd.settings.proxy | HTTP network proxy.
|
| services.aria2.settings.conf-path | Configuration file path.
|
| services.pocket-id.settings | Environment variables to be passed
|
| services.zwave-js-ui.settings | Extra environment variables passed to the zwave-js-ui process
|
| services.i2pd.proto.httpProxy.name | The endpoint name.
|
| services.freeciv.settings | Parameters of freeciv-server.
|
| services.actual.settings.port | The port to listen on
|
| services.kavita.settings.Port | Port to bind to.
|
| services.openssh.settings | Configuration for sshd_config(5).
|
| services.chhoto-url.settings | Configuration of Chhoto URL
|
| services.doh-server.settings | Configuration of doh-server in toml
|
| services.pihole-ftl.settings | Configuration options for pihole.toml
|
| services.samba.settings | Configuration file for the Samba suite in ini format
|
| services.acme-dns.settings.api.port | Listen port for the HTTP API.
|
| services.nfs.idmapd.settings | libnfsidmap configuration
|
| systemd.mounts.*.name | The name of this systemd unit, including its extension
|
| services.slskd.settings.web.port | The HTTP listen port.
|
| services.nvme-rs.settings.email.to | Recipient email address
|
| services.slskd.settings.rooms | Chat rooms to join on startup.
|
| services.tor.settings.AuthDirPinKeys | See torrc manual.
|
| services.dsnet.settings.IP | The IPv4 address that the server will use on the network
|
| services.sftpgo.settings.smtp | SMTP configuration section.
|
| services.litellm.settings | Configuration for LiteLLM
|
| services.dwm-status.settings | Config options for dwm-status, see https://github.com/Gerschtli/dwm-status#configuration
for available options.
|
| services.taler.settings | Global configuration options for the taler config file
|
| services.mealie.settings | Configuration of the Mealie service
|
| services.veilid.settings | Build veilid-server.conf with nix expression
|
| services.go2rtc.settings | go2rtc configuration as a Nix attribute set
|
| services.go-csp-collector.settings | Settings for go-csp-collector
|
| services.artalk.settings.port | Artalk server listen port
|
| services.artalk.settings.host | Artalk server listen host
|
| services.biboumi.settings | See biboumi 9.0
for documentation.
|
| services.tsidp.settings.hostName | The hostname to use for the tsnet node.
|
| services.tor.settings.DirPolicy | See torrc manual.
|
| services.rkvm.server.settings | Structured server daemon configuration
|
| services.rkvm.client.settings | Structured client daemon configuration
|
| services.waagent.settings | The waagent.conf configuration, see https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux for documentation.
|
| services.zipline.settings | Configuration of Zipline
|
| systemd.network.networks.<name>.bond | A list of bond interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.vlan | A list of vlan interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.xfrm | A list of xfrm interfaces to be added to the network section of the
unit
|
| services.dsnet.settings.IP6 | The IPv6 address that the server will use on the network
Leave this empty to let dsnet choose an address.
|
| services.nezha-agent.settings.gpu | Enable GPU monitoring.
|
| services.postfix.settings.master | The master.cf configuration file as an attribute set of service
defitions
|
| services.molly-brown.settings | molly-brown configuration
|
| services.llama-swap.settings | llama-swap configuration
|
| services.chhoto-url.settings.port | The port to listen on.
|
| hardware.sane.brscan5.netDevices.<name>.name | The friendly name you give to the network device
|
| hardware.sane.brscan4.netDevices.<name>.name | The friendly name you give to the network device
|
| services.mysql.ensureUsers.*.name | Name of the user to ensure.
|
| services.grafana-to-ntfy.settings.bauthPass | The path to the password you will use in the Grafana webhook settings.
|
| services.openssh.settings.Ciphers | Allowed ciphers
Defaults to recommended settings from both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| services.gatus.settings.web.port | The TCP port to serve the Gatus service at.
|
| services.wiki-js.settings.logLevel | Define how much detail is supposed to be logged at runtime.
|
| services.displayManager.ly.settings | Extra settings merged in and overwriting defaults in config.ini.
|
| services.tt-rss.database.name | Name of the existing database.
|
| services.cross-seed.settings.port | Port the cross-seed daemon listens on.
|
| services.mympd.settings | Manages the configuration files declaratively
|
| services.glance.settings | Configuration written to a yaml file that is read by glance
|
| services.artalk.settings | The artalk configuration
|
| services.tor.settings.HidServAuth.*.auth | Authentication cookie.
|
| services.nezha-agent.settings.tls | Enable SSL/TLS encryption.
|
| services.tor.settings.PerConnBWBurst | See torrc manual.
|
| services.omnom.settings.smtp.host | SMTP server hostname.
|
| services.kea.ctrl-agent.settings | Kea Control Agent configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html.
|
| services.spacecookie.settings | Settings for spacecookie
|
| services.automx2.settings | Bootstrap json to populate database
|
| services.omnom.settings.smtp.tls | Whether to enable Whether TLS encryption should be used..
|
| services.uptime-kuma.settings | Additional configuration for Uptime Kuma, see
https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
for supported values.
|
| services.homed.settings.Home | Options for systemd-homed
|
| services.autobrr.settings | Autobrr configuration options
|
| services.klipper.settings | Configuration for Klipper
|
| services.readeck.settings | Additional configuration for Readeck, see
https://readeck.org/en/docs/configuration
for supported values.
|
| services.redmine.settings | Redmine configuration (configuration.yml)
|
| services.mchprs.settings.port | Port for the server
|
| services.misskey.settings | Configuration for Misskey, see
example.yml
for all supported options.
|
| services.mchprs.settings.motd | Message of the day
|
| services.zitadel.settings | Contents of the runtime configuration file
|
| services.vikunja.settings | Vikunja configuration
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saeAddToMacAllow | If set, all sae password entries that have a non-wildcard MAC associated to
them will additionally be used to populate the MAC allow list
|
| services.zfs.zed.settings | ZFS Event Daemon /etc/zfs/zed.d/zed.rc content
See
zed(8)
for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables
|
| services.packagekit.settings | Additional settings passed straight through to PackageKit.conf
|
| services.omnom.settings.smtp.port | SMTP server port address.
|
| services.knot.settingsFile | As alternative to settings, you can provide whole configuration
directly in the almost-YAML format of Knot DNS
|
| services.i2pd.proto.socksProxy.name | The endpoint name.
|
| programs.schroot.settings | Schroot configuration settings
|
| services.mysql.galeraCluster.name | The logical name of the Galera cluster
|
| services.nzbget.settings | NZBGet configuration, passed via command line using switch -o
|
| services.gitea.settings.log.LEVEL | General log level.
|
| services.doh-server.settings.path | HTTP path for resolve application
|
| services.tor.settings.ExitPolicy | See torrc manual.
|
| services.nvme-rs.settings.email.from | Sender email address
|
| services.pocket-id.settings.APP_URL | The URL where you will access the app.
|
| services.mpd.settings.db_file | The path to MPD's database.
|
| services.tsidp.settings.localPort | Listen on localhost:.
|
| services.heartbeat.name | Name of the beat
|
| services.mediawiki.name | Name of the wiki.
|
| services.teeworlds.name | Name of the server.
|
| services.corteza.settings | Configuration for Corteza, will be passed as environment variables
|
| services.orthanc.settings | Configuration written to a json file that is read by orthanc
|
| services.zeronet.settings | zeronet.conf configuration
|
| services.movim.h2o.settings | Attrset to be transformed into YAML for host config
|
| services.go-httpbin.settings | Configuration of go-httpbin
|
| services.nezha-agent.settings | Generate to config.json as a Nix attribute set
|
| services.glpiAgent.settings | GLPI Agent configuration options
|
| services.gancio.settings.db.host | Connection string for the PostgreSQL database
|
| services.omnom.settings.app.debug | Whether to enable debug mode.
|
| services.openbao.settings.ui | Whether to enable the OpenBao web UI.
|
| services.gns3-server.settings | The global options in config file in ini format
|
| services.udisks2.settings | Options passed to udisksd
|
| programs.yazi.settings | Configuration included in $YAZI_CONFIG_HOME.
|
| services.displayManager.sddm.settings | Extra settings merged in and overwriting defaults in sddm.conf.
|
| services.paisa.settings | Paisa configuration
|
| services.kubo.settings.Mounts.MFS | Where to mount the MFS namespace to
|
| services.grocy.phpfpm.settings | Options for grocy's PHPFPM pool.
|
| services.tor.settings.Address | See torrc manual.
|
| services.tor.settings.ClientUseIPv6 | See torrc manual.
|
| services.tor.settings.HSLayer3Nodes | See torrc manual.
|
| services.tor.settings.Sandbox | See torrc manual.
|
| services.tor.settings.HSLayer2Nodes | See torrc manual.
|
| services.tor.settings.ClientUseIPv4 | See torrc manual.
|
| systemd.network.networks.<name>.vxlan | A list of vxlan interfaces to be added to the network section of the
unit
|
| services.goeland.settings | Configuration of goeland
|
| services.corerad.settings | Configuration for CoreRAD, see https://github.com/mdlayher/corerad/blob/main/internal/config/reference.toml
for supported values
|
| services.merecat.settings | Merecat configuration
|
| services.sharkey.settings | Configuration options for Sharkey
|
| services.sabnzbd.settings | The sabnzbd configuration (see also
sabnzbd's wiki
for extra documentation)
|
| services.znc.confOptions.networks.<name>.hasBitlbeeControlChannel | Whether to add the special Bitlbee operations channel.
|
| services.legit.settings.meta.title | Website title.
|
| services.openiscsi.name | Name of this iscsi initiator
|
| services.tsidp.settings.logLevel | Set logging level: debug, info, warn, error.
|
| services.sing-box.settings | The sing-box configuration, see https://sing-box.sagernet.org/configuration/ for documentation
|
| services.pds.settings.PDS_BSKY_APP_VIEW_DID | DID of bsky frontend
|
| services.freeciv.settings.read | Startup script.
|
| services.sftpgo.settings.smtp.from | From address.
|
| services.sslh.settings.timeout | Timeout in seconds.
|
| services.lasuite-meet.livekit.settings | Settings to pass to the livekit server
|
| services.peertube.settings | Configuration for peertube.
|
| services.quickwit.settings | Quickwit configuration.
|
| services.warpgate.settings | Warpgate configuration.
|
| xdg.portal.wlr.settings | Configuration for xdg-desktop-portal-wlr
|
| services.oink.settings.ttl | The TTL ("Time to Live") value to set for your DNS records
|
| services.tuned.settings.daemon | Whether to enable the use of a daemon for TuneD.
|
| services.stash.settings.stash.*.path | location of your media files
|
| services.inadyn.settings.provider | Settings for DDNS providers built-in to inadyn
|
| services.xonotic.settings | Generates the server.cfg file
|
| services.tor.settings.HidServAuth.*.onion | Onion address.
|
| services.tor.settings.DirPortFrontPage | See torrc manual.
|
| services.opengfw.settingsFile | Path to file containing OpenGFW settings.
|
| services.wordpress.sites.<name>.database.name | Database name.
|
| services.pds.settings.PDS_BSKY_APP_VIEW_URL | URL of bsky frontend
|
| services.sftpgo.settings.smtp.user | SMTP username.
|
| services.zitadel.settings.Port | The port that ZITADEL listens on.
|
| services.grafana-to-ntfy.settings.bauthUser | The user that you will authenticate with in the Grafana webhook settings
|
| services.haste-server.settings | Configuration for haste-server
|
| services.zabbixProxy.settings | Zabbix Proxy configuration
|
| services.zabbixAgent.settings | Zabbix Agent configuration
|
| services.gitea.database.name | Database name.
|
| services.movim.database.name | Database name.
|
| services.pds.settings.LOG_ENABLED | Enable logging
|
| services.go-httpbin.settings.PORT | The port to listen on.
|
| services.go-httpbin.settings.HOST | The host to listen on.
|
| services.opendkim.settings | Additional opendkim configuration
|
| services.ente.api.settings | Museum yaml configuration
|
| services.glance.settings.pages | List of pages to be present on the dashboard
|
| services.scrutiny.settings | Scrutiny settings to be rendered into the configuration file
|
| services.homebox.settings | The homebox configuration as environment variables
|
| services.bonsaid.settings | State transition definitions
|
| services.unbound.settings | Declarative Unbound configuration
See the unbound.conf(5) manpage for a list of
available options.
|
| services.osquery.settings | Configuration to be written to the osqueryd JSON configuration file
|
| services.h2o.hosts.<name>.serverName | Server name to be used for this virtual host
|
| services.gitea.settings.log.ROOT_PATH | Root path for log files.
|
| services.mtr-exporter.jobs.*.name | Name of ICMP pinging job.
|
| programs.bat.settings | Parameters to be written to the system-wide bat configuration file.
|
| services.pdns-recursor.yaml-settings | PowerDNS Recursor settings
|
| services.freeciv.settings.auth | Whether to enable server authentication.
|
| services.kubo.settings.Mounts.IPNS | Where to mount the IPNS namespace to
|
| services.dwm-status.settings.order | List of enabled features in order.
|
| services.freeciv.settings.port | Listen for clients on given port
|
| services.kubo.settings.Mounts.IPFS | Where to mount the IPFS namespace to
|
| services.openssh.settings.UsePAM | Whether to enable PAM authentication.
|
| services.tor.settings.TransProxyType | See torrc manual.
|
| services.sftpgo.settings.smtp.port | Port of the SMTP Server.
|
| services.misskey.settings.port | The port your Misskey server should listen on.
|
| services.tor.settings.SocksPolicy | See torrc manual.
|
| services.tor.settings.BridgeRelay | See torrc manual.
|
| services.tor.settings.LongLivedPorts | See torrc manual.
|
| services.sharkey.settings.port | The port that Sharkey will listen on.
|
| services.xonotic.settings.port | The port Xonotic will listen on.
|
| power.ups.upsmon.settings | Additional settings to add to upsmon.conf.
|
| services.sharkey.settings.id | The ID generation method for Sharkey to use
|
| services.hound.settings | The full configuration of the Hound daemon
|
| services.memos.settings | The environment variables to configure Memos.
At time of writing, there is no clear documentation about possible values
|
| programs.atop.settings | Parameters to be written to /etc/atoprc.
|
| services.influxdb.settings | Extra configuration options for influxdb
|
| services.crowdsec.settings | Set of various configuration attributes
|
| services.openldap.settings | Configuration for OpenLDAP, in OLC format
|
| services.minidlna.settings | Configuration for minidlna.conf(5).
|
| services.dashy.settings | Settings serialized into user-data/conf.yml before build
|
| services.vmalert.settings | vmalert configuration, passed via command line flags
|
| services.maubot.settings.server | Listener config
|
| services.snipe-it.database.name | Database name.
|
| services.aria2.settings.enable-rpc | Enable JSON-RPC/XML-RPC server.
|
| services.lxd-image-server.settings | Configuration for lxd-image-server
|
| services.oncall.settings | Extra configuration options to append or override
|
| services.xinetd.services.*.name | Name of the service.
|
| services.doh-server.settings.tries | Number of tries if upstream DNS fails
|
| services.crowdsec.settings.general | Settings for the main CrowdSec configuration file
|
| services.sonic-server.settings | Sonic Server configuration options
|
| services.misskey.settings.id | The ID generation method to use
|
| services.hedgedoc.settings | HedgeDoc configuration, see
https://docs.hedgedoc.org/configuration/
for documentation.
|
| services.tor.settings.HTTPTunnelPort | See torrc manual.
|
| services.olivetin.settings | Configuration of OliveTin
|
| services.tor.settings.CookieAuthFile | See torrc manual.
|
| services.tor.settings.AuthDirListBadExits | See torrc manual.
|
| services.routedns.settings | Configuration for RouteDNS, see https://github.com/folbricht/routedns/blob/master/doc/configuration.md
for more information.
|
| systemd.network.networks.<name>.routes | A list of route sections to be added to the unit
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.name | The name of this authentication provider
|
| services.patroni.settings | The primary patroni configuration
|
| services.livekit.settings | LiveKit configuration file expressed in nix
|
| services.kanidm.unix.settings | Configure Kanidm unix daemon
|
| services.firezone.relay.name | The name of this gateway as shown in firezone
|
| services.oauth2-proxy.cookie.name | The name of the cookie that the oauth_proxy creates.
|
| services.misskey.settings.db.port | The PostgreSQL port.
|
| services.misskey.settings.db.host | The PostgreSQL host.
|
| services.wg-access-server.settings | See https://www.freie-netze.org/wg-access-server/2-configuration/ for possible options
|
| services.oink.settings.secretApiKey | Secret API key to use when modifying DNS records.
|
| services.traccar.settingsFile | File used as configuration for traccar
|
| services.ente.api.settings.apps.cast | Set this to the URL where your cast page is running
|
| services.evremap.settings.remap | List of remappings.
|
| services.rimgo.settings.ADDRESS | The address to listen on.
|
| services.i2pd.proto.i2pControl.name | The endpoint name.
|
| services.legit.settings.repo.scanPath | Directory where legit will scan for repositories.
|
| services.livekit.settings.port | Main TCP port for RoomService and RTC endpoint.
|
| services.mysql.settings | MySQL configuration
|
| services.stash.settings.stash | Add directories containing your adult videos and images
|
| services.ergochat.settings | Ergo IRC daemon configuration file.
https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml
|
| services.spotifyd.settings | Configuration for Spotifyd
|
| services.netatalk.settings | Configuration for Netatalk
|
| systemd.network.networks.<name>.enable | Whether to manage network configuration using systemd-network
|
| systemd.network.networks.<name>.tunnel | A list of tunnel interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.bridge | A list of bridge interfaces to be added to the network section of the
unit
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPasswordFile | Sets the password for WPA-PSK
|
| services.tor.settings.ControlPort | See torrc manual.
|
| services.tor.settings.FetchDirInfoEarly | See torrc manual.
|
| services.tor.settings.ContactInfo | See torrc manual.
|
| services.lidarr.settings | Attribute set of arbitrary config options
|
| services.cross-seed.settings | Configuration options for cross-seed
|
| services.sonarr.settings | Attribute set of arbitrary config options
|
| services.radarr.settings | Attribute set of arbitrary config options
|
| services.resolved.settings.Resolve | Settings option for systemd-resolved
|
| services.bonsaid.settings.*.type | Type of transition
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.id | If this attribute is given with non-zero length, it will set the password identifier
for this entry
|
| services.legit.settings.server.host | Host address.
|
| services.legit.settings.server.port | Legit port.
|
| services.legit.settings.repo.ignore | Repositories to ignore.
|
| services.grocy.settings.culture | Display language of the frontend.
|
| services.biboumi.settings.port | The TCP port to use to connect to the local XMPP component.
|
| services.tsidp.settings.enableSts | Enable OAuth token exchange using RFC 8693.
|
| services.pretix.settings.mail.host | Hostname of the SMTP server use for mail delivery.
|
| services.pretix.settings.mail.port | Port of the SMTP server to use for mail delivery.
|
| services.amule.settings.eMule.Port | TCP port for eD2k connections
|
| services.homer.settings | Settings serialized into config.yml before build
|
| services.nsd.zones.<name>.notify | This primary server will notify all given secondary servers about
zone changes
|
| services.mediagoblin.settings | Settings which are written into mediagoblin.ini.
|
| services.peroxide.settings | Configuration for peroxide
|
| services.fediwall.settings | Fediwall configuration
|
| services.ferretdb.settings | Additional configuration for FerretDB, see
https://docs.ferretdb.io/configuration/flags/
for supported values.
|
| services.sharkey.settings.url | The full URL that the Sharkey instance will be publically accessible on
|
| services.rkvm.server.settings.key | TLS key path.
This should be generated with rkvm-certificate-gen.
|
| services.polaris.settings | Contents for the TOML Polaris config, applied each start
|
| services.inadyn.settings.allow-ipv6 | Whether to get IPv6 addresses from interfaces.
|
| services.misskey.settings.db.user | The user used for database authentication.
|
| services.opengfw.settings.io.sndBuf | Netlink send buffer size.
|
| services.misskey.settings.db.pass | The password used for database authentication.
|
| services.opengfw.settings.io.rcvBuf | Netlink receive buffer size.
|
| services.amule.settings.eMule.TempDir | Directory where aMule stores incomplete downloads (.part/.part.met files).
|
| systemd.network.networks.<name>.bridgeFDBs | A list of BridgeFDB sections to be added to the unit
|
| systemd.network.networks.<name>.bridgeMDBs | A list of BridgeMDB sections to be added to the unit
|
| services.freeciv.settings.debug | Set debug log level.
|
| services.legit.settings.repo.readme | Readme files to look for.
|
| services.karma.settings.listen.port | HTTP port to listen on.
|
| services.nipap.settings.nipapd.port | Port to bind nipapd to.
|
| services.tor.settings.V3AuthUseLegacyKey | See torrc manual.
|
| services.davis.database.name | Database name, only used when the databse is created locally.
|
| services.wiki-js.settings.db.type | Database driver to use for persistence
|
| services.pretix.settings.mail.from | E-Mail address used in the FROM header of outgoing mails.
|
| services.chhoto-url.settings.db_url | The path of the sqlite database.
|
| services.apache-kafka.settings."log.dirs" | Log file directories.
|
| services.firefox-syncserver.settings | Settings for the sync server
|
| services.gitlab-runner.settings | Global gitlab-runner configuration
|
| services.libeufin.settings | Global configuration options for the libeufin bank system config file.
|
| services.temporal.settings | Temporal configuration
|
| services.sshwifty.settings | Configuration for Sshwifty
|
| services.tsidp.settings.debugTsnet | For development
|
| services.zabbixServer.settings | Zabbix Server configuration
|
| services.wiki-js.settings.offline | Disable latest file updates and enable
sideloading.
|
| services.step-ca.settings | Settings that go into ca.json
|
| services.bluesky-pds.settings.PDS_PORT | Port to listen on
|
| services.nezha-agent.settings.server | Address to the dashboard.
|
| services.zipline.settings.CORE_PORT | The port to listen on.
|
| systemd.network.networks.<name>.domains | A list of domains to pass to the network config.
|
| services.auto-cpufreq.settings | Configuration for auto-cpufreq
|
| services.buffyboard.settings | Settings to include in /etc/buffyboard.conf
|
| services.komga.settings.server.port | The port that Komga will listen on.
|
| services.legit.settings.dirs.static | Directories where static files are located.
|
| services.omnom.settings.smtp.sender | Omnom sender e-mail.
|
| services.wyoming.piper.servers.<name>.zeroconf.name | The advertised name for zeroconf discovery.
|
| systemd.network.networks.<name>.canConfig | Each attribute in this set specifies an option in the
[CAN] section of the unit
|
| systemd.network.networks.<name>.pieConfig | Each attribute in this set specifies an option in the
[PIE] section of the unit
|
| services.rsync.jobs.<name>.user | The name of an existing user account under which the rsync process should run.
|
| services.kea.dhcp6.configFile | Kea DHCP6 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html
|
| services.kea.dhcp4.configFile | Kea DHCP4 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html
|
| systemd.network.networks.<name>.bridgeVLANs | A list of BridgeVLAN sections to be added to the unit
|
| services.docuseal.redis.name | Name of the redis server
|
| services.bluesky-pds.settings | Environment variables to set for the service
|
| services.i2pd.websocket.name | The endpoint name.
|
| services.monica.database.name | Database name.
|
| services.moodle.database.name | Database name.
|
| services.zammad.database.name | Database name.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.mac | If this attribute is not included, or if is set to the wildcard address (ff:ff:ff:ff:ff:ff),
the entry is available for any station (client) to use
|
| services.doh-server.settings.listen | HTTP listen address and port
|
| services.tor.settings.DisableAllSwap | See torrc manual.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.pk | If this attribute is given, SAE-PK will be enabled for this connection
|
| services.castopod.settings | Environment variables used for Castopod
|
| services.radicale.settings | Configuration for Radicale
|
| services.rathole.settings | Rathole configuration, for options reference
see the example on GitHub
|
| services.frigate.settings | Frigate configuration as a nix attribute set
|
| services.grafana.settings.smtp.host | Host to connect to.
|
| services.hickory-dns.settings.zones | List of zones to serve.
|
| services.clamav.daemon.settings | ClamAV configuration
|
| services.prosody-filer.settings | Configuration for Prosody Filer
|
| services.fediwall.settings.tags | Tags to follow
|
| services.hedgedoc.settings.port | Port to listen on.
|
| services.hedgedoc.settings.host | Address to listen on.
|
| services.lasuite-docs.settings.DB_USER | User of the database
|
| services.lasuite-meet.settings.DB_HOST | Host of the database
|
| services.lasuite-meet.settings.DB_USER | User of the database
|
| services.lasuite-docs.settings.DB_HOST | Host of the database
|
| services.filebrowser.settings | Settings for FileBrowser
|
| services.firezone.server.provision.accounts.<name>.actors.<name>.name | The name of this actor
|
| services.firezone.server.provision.accounts.<name>.groups.<name>.name | The name of this group
|
| services.misskey.settings.redis | ioredis options
|
| services.lokinet.settings.dns.bind | Address to bind to for handling DNS requests.
|
| services.oncall.settings.db.conn.str | Database connection scheme
|
| systemd.network.networks.<name>.ipoIBConfig | Each attribute in this set specifies an option in the
[IPoIB] section of the unit
|
| services.immich.database.name | The name of the immich database.
|
| services.tomcat.virtualHosts.*.name | name of the virtualhost
|
| services.pangolin.settings | Additional attributes to be merged with the configuration options and written to Pangolin's config.yml file.
|
| services.pinnwand.settings | Your pinnwand.toml as a Nix attribute set
|
| services.postsrsd.settings | Configuration options for the postsrsd.conf file
|
| services.gitea-actions-runner.instances.<name>.name | The name identifying the runner instance towards the Gitea/Forgejo instance.
|
| services.amule.settings.WebServer.Port | Web server port
|
| services.grafana.settings.smtp.user | User used for authentication.
|
| services.tor.settings.ClientAutoIPv6ORPort | See torrc manual.
|
| services.misskey.settings.db.extra | Extra connection options.
|
| services.frigate.settings.mqtt.host | MQTT server hostname
|
| services.kanidm.client.settings.uri | Address of the Kanidm server.
|
| systemd.network.networks.<name>.extraConfig | Extra configuration append to unit
|
| services.pdns-recursor.old-settings | Older PowerDNS Recursor settings
|
| services.actual.settings.userFiles | The server will put all the budget files in this directory as binary blobs.
|
| hardware.cpu.x86.msr.settings | Parameters for the msr kernel module.
|
| services.cross-seed.settings.linkDirs | List of directories where cross-seed will create links
|
| services.crowdsec.settings.capi | CAPI Configuration attributes
|
| services.crowdsec.settings.lapi | LAPI Configuration attributes
|
| services.froide-govplan.settings | Configuration options to set in extra_settings.py.
|
| services.transmission.settings | Settings whose options overwrite fields in
.config/transmission-daemon/settings.json
(each time the service starts)
|
| services.freeciv.settings.exit-on-end | Whether to enable exit instead of restarting when a game ends.
|
| services.pretalx.settings.site.url | The base URI below which your pretalx instance will be reachable.
|
| services.gokapi.settingsFile | Path to config file to parse and append to settings
|
| services.pds.settings.PDS_CRAWLERS | URL of crawlers
|
| services.sftpgo.settings.smtp.host | Location of SMTP email server
|
| services.sslh.settings.numeric | Whether to disable reverse DNS lookups, thus keeping IP
address literals in the log.
|
| services.immich-kiosk.settings | Configuration for immich-kiosk
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.vlanid | If this attribute is given, all clients using this entry will get tagged with the given VLAN ID.
|
| services.borgmatic.settings | See https://torsion.org/borgmatic/docs/reference/configuration/
|
| services.sympa.database.name | Database name
|
| systemd.network.networks.<name>.linkConfig | Each attribute in this set specifies an option in the
[Link] section of the unit
|
| systemd.network.networks.<name>.lldpConfig | Each attribute in this set specifies an option in the
[LLDP] section of the unit
|
| systemd.network.networks.<name>.cakeConfig | Each attribute in this set specifies an option in the
[CAKE] section of the unit
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPskFile | Sets the password(s) for WPA-PSK
|
| services.go2rtc.settings.ffmpeg.bin | The ffmpeg package to use for transcoding.
|
| services.wakapi.database.name | The name of the database to use for Wakapi.
|
| services.webdav-server-rs.settings | Attrset that is converted and passed as config file
|
| services.forgejo.settings.log.LEVEL | General log level.
|
| services.tor.settings.ClientOnionAuthDir | See torrc manual.
|
| services.quickwit.settings.rest | Rest server configuration for Quickwit
|
| services.pretix.settings.tools.pdftk | Path to the pdftk executable.
|
| services.nipap.settings.nipapd.debug | Enable debug logging.
|
| services.opengfw.settings.io.rst | Set to true if you want to send RST for blocked TCP connections, needs local = false.
|
| services.lidarr.settings.server.port | Port Number
|
| services.maubot.settings.server.port | The port to listen on
|
| services.radarr.settings.server.port | Port Number
|
| services.sonarr.settings.server.port | Port Number
|
| services.lasuite-docs.settings.DATA_DIR | Path to the data directory
|
| systemd.network.networks.<name>.address | A list of addresses to be added to the network section of the
unit
|
| systemd.network.networks.<name>.gateway | A list of gateways to be added to the network section of the
unit
|
| services.zabbixWeb.database.name | Database name.
|
| programs.yazi.settings.vfs | Configuration included in vfs.toml
|
| services.anubis.defaultOptions.policy.settings | Additional policy settings merged into the policy file
|
| services.firefly-iii.settings.DB_PORT | The port your database is listening at. sqlite does not require
this value to be filled.
|
| services.meilisearch.settings | Configuration settings for Meilisearch
|
| services.sourcehut.settings | The configuration for the sourcehut network.
|
| services.bitmagnet.settings | Bitmagnet configuration (https://bitmagnet.io/setup/configuration.html).
|
| services.tinyproxy.settings | Configuration for tinyproxy.
|
| services.aria2.settings.listen-port | Set UDP listening port range used by DHT(IPv4, IPv6) and UDP tracker.
|
| services.microbin.settings | Additional configuration for MicroBin, see
https://microbin.eu/docs/installation-and-configuration/configuration/
for supported values
|
| services.wastebin.settings | Additional configuration for wastebin, see
https://github.com/matze/wastebin#usage for supported values
|
| services.zitadel.settings.TLS.KeyPath | Path to the TLS certificate private key.
|
| systemd.network.networks.<name>.macvtap | A list of macvtap interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.macvlan | A list of macvlan interfaces to be added to the network section of the
unit
|
| services.gemstash.settings.bind | Host and port combination for the server to listen on.
|
| services.suricata.settings.vars | Variables to be used within the suricata rules.
|
| services.oink.settings.interval | Seconds to wait before sending another request.
|
| services.suricata.settings.pcap | Cross platform libpcap capture support.
|
| services.listmonk.database.settings | Dynamic settings in the PostgreSQL database, set by a SQL script, see https://github.com/knadh/listmonk/blob/master/schema.sql#L177-L230 for details.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPassword | Sets the password for WPA-PSK that will be converted to the pre-shared key
|
| services.glance.settings.server.port | Glance port to listen on
|
| services.dnsmasq.settings.server | The DNS servers which dnsmasq should query.
|
| services.grafana-to-ntfy.settings.ntfyUrl | The URL to the ntfy-sh topic.
|
| services.glance.settings.server.host | Glance bind address
|
| services.gancio.settings.baseurl | The full URL under which the server is reachable.
|
| services.legit.settings.repo.mainBranch | Main branch to look for.
|
| services.tor.settings.DisableOOSCheck | See torrc manual.
|
| services.moosefs.master.settings | Master configuration options (mfsmaster.cfg).
|
| services.zitadel.settings.TLS.CertPath | Path to the TLS certificate.
|
| hardware.nfc-nci.settings | Configuration to be written to the libncf-nci configuration files
|
| services.sourcehut.settings."meta.sr.ht::settings".user-invites | How many invites each user is issued upon registration
(only applicable if open registration is disabled).
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords | Sets allowed passwords for WPA3-SAE
|
| services.homepage-dashboard.settings | Homepage settings
|
| services.cross-seed.settings.outputDir | Directory where cross-seed will place torrent files it finds.
|
| services.readarr.settings | Attribute set of arbitrary config options
|
| services.c2fmzq-server.settings | Configuration for c2FmZQ-server passed as CLI arguments
|
| services.teleport.settings | Contents of the teleport.yaml config file
|
| services.misskey.settings.redis.host | The Redis host.
|
| services.omnom.settings.storage.type | Storage type.
|
| services.misskey.settings.redis.port | The Redis port.
|
| services.sabnzbd.settings.misc.port | Port for the Web UI to listen on for incoming connections.
|
| services.pretix.settings.pretix.url | The installation’s full URL, without a trailing slash.
|
| services.sabnzbd.settings.misc.host | Address for the Web UI to listen on for incoming connections.
|
| services.doh-server.settings.timeout | Upstream timeout
|
| services.doh-server.settings.verbose | Enable logging
|
| services.umami.settings.HOSTNAME | The address to listen on.
|
| services.lasuite-docs.settings | Configuration options of docs
|
| services.gitea.settings.server.ROOT_URL | Full public URL of gitea server.
|
| services.aria2.settings.save-session | Save error/unfinished downloads to FILE on exit.
|
| systemd.network.networks.<name>.dhcpV4Config | Each attribute in this set specifies an option in the
[DHCPv4] section of the unit
|
| systemd.network.networks.<name>.dhcpV6Config | Each attribute in this set specifies an option in the
[DHCPv6] section of the unit
|
| services.firefly-iii.settings.APP_ENV | The app environment
|
| nix.settings.max-jobs | This option defines the maximum number of jobs that Nix will try to
build in parallel
|
| services.dsnet.settings | The settings to use for dsnet
|
| services.influxdb2.settings | configuration options for influxdb2, see https://docs.influxdata.com/influxdb/v2.0/reference/config-options for details.
|
| services.misskey.settings.socket | The UNIX socket your Misskey server should listen on.
|
| services.paisa.settings.journalFile | Filename of the main journal / ledger file.
|
| services.pocket-id.settings.TRUST_PROXY | Whether the app is behind a reverse proxy.
|
| nix.settings.extra-sandbox-paths | Directories from the host filesystem to be included
in the sandbox.
|
| services.dnsproxy.settings | Contents of the config.yaml config file
|
| services.stalwart.settings | Configuration options for the Stalwart server
|
| security.krb5.settings | Structured contents of the krb5.conf file
|
| programs.gamemode.settings | System-wide configuration for GameMode (/etc/gamemode.ini)
|
| services.glitchtip.settings | Configuration of GlitchTip
|
| services.supergfxd.settings | The content of /etc/supergfxd.conf
|
| services.rosenpass.settings | Configuration for Rosenpass, see https://rosenpass.eu/ for further information.
|
| services.mackerel-agent.settings | Options for mackerel-agent.conf
|
| services.tor.settings.ExtORPortCookieAuthFile | See torrc manual.
|
| services.tor.settings.AuthDirTestEd25519LinkKeys | See torrc manual.
|
| services.manticore.settings | Configuration for Manticoresearch
|
| services.mosquitto.settings | Global configuration options for the mosquitto broker.
|
| networking.nftables.tables.<name>.name | Table name.
|
| services.firezone.gui-client.name | The name of this client as shown in firezone
|
| services.scion.scion-router.settings | scion-router configuration
|
| services.scion.scion-daemon.settings | scion-daemon configuration
|
| services.go2rtc.settings.api.listen | API listen address, conforming to a Go address string.
|
| services.armagetronad.servers.<name>.name | The name of this server.
|
| services.transfer-sh.settings | Additional configuration for transfer-sh, see
https://github.com/dutchcoders/transfer.sh#usage-1
for supported values
|
| services.bluesky-pds.settings.PDS_DID_PLC_URL | URL of DID PLC directory
|
| services.openldap.settings.attrs | Attributes of the parent entry.
|
| services.stash.settings.database | Path to the SQLite database
|
| services.rsync.jobs.<name>.group | The name of an existing user group under which the rsync process should run.
|
| services.canaille.settings.CANAILLE_OIDC | OpenID Connect settings
|
| boot.initrd.unl0kr.settings | Configuration for unl0kr
|
| services.immich.settings | Configuration for Immich
|
| services.freeciv.settings.Guests | Whether to enable guests to login if auth is enabled.
|
| services.saunafs.master.settings | Contents of config file (sfsmaster.cfg(5)).
|
| systemd.network.networks.<name>.qdiscConfig | Each attribute in this set specifies an option in the
[QDisc] section of the unit
|
| systemd.network.networks.<name>.pfifoConfig | Each attribute in this set specifies an option in the
[PFIFO] section of the unit
|
| systemd.network.networks.<name>.bfifoConfig | Each attribute in this set specifies an option in the
[BFIFO] section of the unit
|
| services.aesmd.settings.proxyType | Type of proxy to use
|
| services.misskey.settings.url | The final user-facing URL
|
| services.librenms.settings | Attrset of the LibreNMS configuration
|
| services.gemstash.settings | Configuration for Gemstash
|
| services.forgejo.settings.log.ROOT_PATH | Root path for log files.
|
| services.immich-public-proxy.settings | Configuration for IPP
|
| services.swapspace.settings | Config file for swapspace
|
| services.navidrome.settings | Configuration for Navidrome, see https://www.navidrome.org/docs/usage/configuration-options/ for supported values.
|
| services.nextcloud.settings | Extra options which should be appended to Nextcloud's config.php file.
|
| services.pgbouncer.settings | Configuration for PgBouncer, see https://www.pgbouncer.org/config.html
for supported values.
|
| programs.yazi.settings.yazi | Configuration included in yazi.toml
|
| services.firezone.server.provision.accounts.<name>.relayGroups.<name>.name | The name of this relay group
|
| hardware.amdgpu.amdvlk.settings | Runtime settings for AMDVLK to be configured /etc/amd/amdVulkanSettings.cfg
|
| services.lasuite-meet.settings | Configuration options of meet
|
| services.pocket-id.settings.PUBLIC_APP_URL | The URL where you will access the app.
|
| services.gancio.settings.db.storage | Location for the SQLite database.
|
| services.gancio.settings.db.dialect | The database dialect to use
|
| services.opengfw.settings.io.queueSize | IO queue size.
|
| services.tor.settings.FetchDirInfoExtraEarly | See torrc manual.
|
| services.tor.settings.ControlSocket | See torrc manual.
|
| security.please.settings | Please configuration
|
| services.etebase-server.settings | Configuration for etebase-server
|
| services.matrix-tuwunel.settings | Generates the tuwunel.toml configuration file
|
| services.minidlna.settings.port | Port number for HTTP traffic (descriptions, SOAP, media transfer).
|
| services.postfix.settings.main.mynetworks_style | The method used for generating the default value for mynetworks, if that option is unset.
https://www.postfix.org/postconf.5.html#mynetworks_style
|
| services.lasuite-docs.settings.REDIS_URL | URL of the redis backend
|
| services.lasuite-meet.settings.REDIS_URL | URL of the redis backend
|
| services.clamav.updater.settings | freshclam configuration
|
| services.workout-tracker.settings | Extra config options.
|
| services.ndppd.proxies.<name>.rules.<name>.network | This is the target address is to match against
|
| services.mediagoblin.paste.settings | Settings which are written into paste.ini.
|
| programs.regreet.font.name | Name of the font to use for regreet.
|
| services.firewalld.settings | FirewallD config file
|
| services.moonraker.settings | Configuration for Moonraker
|
| services.mobilizon.settings | Mobilizon Elixir documentation, see
https://docs.joinmobilizon.org/administration/configure/reference/
for supported values.
|
| services.typesense.settings | Typesense configuration
|
| services.opengfw.settings.io.local | Set to false if you want to run OpenGFW on FORWARD chain. (e.g. on a router)
|
| services.amule.settings.eMule.UDPPort | UDP port for eD2k traffic (searches, source exchange) and all Kad network communication
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswordsFile | Sets the password for WPA3-SAE
|
| services.forgejo.database.name | Database name.
|
| services.redmine.database.name | Database name.
|
| services.kanidm.client.settings | Configure Kanidm clients, needed for the PAM daemon
|
| services.pds.settings.PDS_BLOB_UPLOAD_LIMIT | Size limit of uploaded blobs in bytes
|
| services.grocy.settings.currency | ISO 4217 code for the currency to display.
|
| services.nvme-rs.settings.email.use_tls | Use TLS for SMTP connection
|
| services.stash.settings.no_proxy | A list of domains for which the proxy must not be used
|
| services.paperless.exporter.settings | Settings to pass to the document exporter as CLI arguments.
|
| services.sunshine.settings.port | Base port -- others used are offset from this one, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port for details.
|
| services.aria2.settings.rpc-listen-port | Specify a port number for JSON-RPC/XML-RPC server to listen to
|
| networking.interfaces.<name>.name | Name of the interface.
|
| services.gitlab.pages.settings.pages-root | The directory where pages are stored.
|
| services.fediwall.settings.hideBots | Hide posts from bot accounts
|
| services.cryptpad.settings.httpPort | Port on which the Node.js server should listen
|
| services.tlsrpt.fetcher.settings | Flags from tlsrpt-fetcher(1) as key-value pairs.
|
| services.tlsrpt.reportd.settings | Flags from tlsrpt-reportd(1) as key-value pairs.
|
| services.rkvm.server.settings.listen | An internet socket address to listen on, either IPv4 or IPv6.
|
| services.sharkey.settings.socket | If specified, creates a UNIX socket at the given path that Sharkey listens on.
|
| services.openssh.settings.PrintMotd | Whether to enable printing /etc/motd when a user logs in interactively.
|
| services.cryptpad.settings.logLevel | Controls log level
|
| services.pomerium.settings | The contents of Pomerium's config.yaml, in Nix expressions
|
| programs.direnv.settings | Direnv configuration
|
| services.gitea.settings.server.HTTP_PORT | Listen port
|
| systemd.network.networks.<name>.ipv6SendRAConfig | Each attribute in this set specifies an option in the
[IPv6SendRA] section of the unit
|
| services.lldap.settings.http_url | The public URL of the server, for password reset links.
|
| services.warpgate.settings.http.key | Path to HTTPS listener private key.
|
| services.radicle.ci.adapters.native.instances.<name>.name | Adapter name that is used in the radicle-ci-broker configuration
|
| services.firefly-iii.settings | Options for firefly-iii configuration
|
| services.pdfding.database.name | PostgreSQL database name
|
| services.webdav.settings | Attrset that is converted and passed as config file
|
| services.rspamd-trainer.settings | IMAP authentication configuration for rspamd-trainer
|
| services.vmalert.settings.rule | Path to the files with alerting and/or recording rules.
Consider using the services.vmalert.rules option as a convenient alternative for declaring rules
directly in the nix language.
|
| services.dsnet.settings.Network | The IPv4 network that the server will use to allocate IPs on the network
|
| services.keycloak.settings.http-host | On which address Keycloak should accept new connections.
|
| services.nipap.settings.nipapd.listen | IP address to bind nipapd to.
|
| services.rkvm.client.settings.server | An RKVM server's internet socket address, either IPv4 or IPv6.
|
| services.kanidm.server.settings.role | The role of this server
|
| users.users.<name>.home | The user's home directory.
|
| services.tor.settings.MainloopStats | See torrc manual.
|
| services.tor.settings.NewCircuitPeriod | See torrc manual.
|
| services.tor.settings.OfflineMasterKey | See torrc manual.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.pairwiseCiphers | Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets)
|
| services.cgit.<name>.user | User to run the cgit service as.
|
| services.gitea.settings.server.HTTP_ADDR | Listen address
|
| services.create_ap.settings | Configuration for create_ap
|
| services.watchdogd.settings | Configuration to put in watchdogd.conf
|
| systemd.network.networks.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| services.knot-resolver.settings | Nix-based (RFC 42) configuration for Knot Resolver
|
| services.sharkey.settings.address | The address that Sharkey binds to.
|
| services.sabnzbd.settings.servers | Usenet provider specification
|
| services.readarr.settings.server.port | Port Number
|
| services.autossh.sessions.*.name | Name of the local AutoSSH session
|
| services.warpgate.settings.ssh.keys | Path to store SSH host & client keys.
|
| services.freeciv.settings.saves | Save games to given directory,
a sub-directory named after the starting date of the service
will me inserted to preserve older saves.
|
| services.firezone.gateway.name | The name of this gateway as shown in firezone
|
| services.keycloak.settings.http-port | On which port Keycloak should listen for new HTTP connections.
|
| services.immich-kiosk.settings.kiosk.port | Port on which immich-kiosk will listen.
|
| services.suricata.settings.run-as.user | Run Suricata with a specific user-id.
|
| services.firezone.server.settings | Environment variables for the Firezone server
|
| security.pam.u2f.settings.debug | Debug output to stderr.
|
| services.maubot.settings.logging | Python logging configuration
|
| services.dsnet.settings.Network6 | The IPv6 network that the server will use to allocate IPs on the
network
|
| services.hatsu.settings.HATSU_LISTEN_PORT | Port where hatsu should listen for incoming requests.
|
| services.hatsu.settings.HATSU_LISTEN_HOST | Host where hatsu should listen for incoming requests.
|
| services.radicle.ci.broker.settings.db | Database file path.
|
| services.hedgedoc.settings.urlPath | URL path for the website
|
| services.dnscrypt-proxy.settings | Attrset that is converted and passed as TOML config file
|
| services.tor.settings.ClientPreferIPv6ORPort | See torrc manual.
|
| services.scrutiny.settings.log.level | Log level for Scrutiny.
|
| services.umurmur.settings.ca_path | Path to your SSL CA certificate.
|
| services.zabbixProxy.database.name | Database name.
|
| nix.settings.cores | This option defines the maximum number of concurrent tasks during
one build
|
| services.radicle.ci.broker.settings | Configuration of radicle-ci-broker
|
| networking.vswitches.<name>.interfaces.<name>.name | Name of the interface
|
| services.gancio.settings.log_path | Directory Gancio logs into
|
| services.fediwall.settings.showMedia | Show media in posts
|
| services.navidrome.settings.Port | Port to run Navidrome on.
|
| services.tinyproxy.settings.Port | Specify which port to listen to.
|
| services.pinnwand.settings.footer | The footer in raw HTML.
|
| services.postfix-tlspol.settings | The postfix-tlspol configuration file as a Nix attribute set
|
| services.hans.clients | Each attribute of this option defines a systemd service that
runs hans
|
| services.mx-puppet-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.open-web-calendar.settings | Configuration for the server
|
| systemd.network.networks.<name>.bridgeConfig | Each attribute in this set specifies an option in the
[Bridge] section of the unit
|
| systemd.network.networks.<name>.pfifoFastConfig | Each attribute in this set specifies an option in the
[PFIFOFast] section of the unit
|
| services.dolibarr.h2o.settings | Attrset to be transformed into YAML for host config
|
| security.auditd.settings | auditd configuration file contents
|
| programs.foot.settings | Configuration for foot terminal emulator
|
| programs.htop.settings | Extra global default configuration for htop
which is read on first startup only
|
| services.blackfire-agent.settings | See https://blackfire.io/docs/up-and-running/configuration/agent
|
| programs.yazi.settings.theme | Configuration included in theme.toml
|
| services.cross-seed.settings.dataDirs | Paths to be searched for matching data
|
| services.stalwart-mail.settings | Configuration options for the Stalwart email server
|
| services.suricata.settings.af-xdp | Linux high speed af-xdp capture support, see
docs/capture-hardware/af-xdp.
|
| services.zram-generator.settings | Configuration for zram-generator,
see https://github.com/systemd/zram-generator for documentation.
|
| services.frigate.settings.cameras | Attribute set of cameras configurations.
https://docs.frigate.video/configuration/cameras
|
| services.xonotic.settings.sv_motd | Text displayed when players join the server.
|
| services.actual.settings.dataDir | Directory under which Actual runs and saves its data
|
| services.gitwatch.<name>.user | The name of services's user
|
| boot.iscsi-initiator.name | Name of the iSCSI initiator to boot from
|
| services.hedgedoc.settings.path | Path to UNIX domain socket to listen on
If specified, host and port will be ignored.
|
| services.matrix-synapse.settings | The primary synapse configuration
|
| services.biboumi.settings.admin | The bare JID of the gateway administrator
|
| services.kanboard.phpfpm.settings | Options for kanboard's PHPFPM pool.
|
| services.inadyn.settings.forced-update | Duration (in seconds) after which an update is forced.
|
| services.tor.settings.KeyDirectory | See torrc manual.
|
| services.tor.settings.ClientPreferIPv6DirPort | See torrc manual.
|
| services.tor.settings.ReducedExitPolicy | See torrc manual.
|
| services.apache-kafka.settings."broker.id" | Broker ID. -1 or null to auto-allocate in zookeeper mode.
|
| services.scion.scion-control.settings | scion-control configuration
|
| services.zwave-js.settings.storage.cacheDir | Cache directory
|
| services.prowlarr.settings | Attribute set of arbitrary config options
|
| services.whisparr.settings | Attribute set of arbitrary config options
|
| services.mosquitto.listeners.*.settings | Additional settings for this listener.
|
| services.nomad.settings | Configuration for Nomad
|
| services.suricata.settings.app-layer | app-layer configuration, see upstream docs.
|
| services.selfoss.database.name | Name of the existing database (has no effect if type is "sqlite").
|
| services.headscale.settings | Overrides to config.yaml as a Nix attribute set
|
| services.slskd.settings.web.url_base | The base path in the url for web requests.
|
| services.suwayomi-server.settings | Configuration to write to server.conf
|
| services.warpgate.settings.mysql.key | Path to MySQL listener private key.
|
| services.nsd.zones.<name>.zoneStats | When set to something distinct to null NSD is able to collect
statistics per zone
|
| services.opensearch.settings | OpenSearch configuration.
|
| services.wgautomesh.settings | Configuration for wgautomesh.
|
| programs.regreet.theme.name | Name of the theme to use for regreet.
|
| services.part-db.settings.DATABASE_URL | The postgresql database server to connect to
|
| services.firezone.server.provision.accounts.<name>.gatewayGroups.<name>.name | The name of this gateway group
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.passwordFile | The password for this entry, read from the given file when starting hostapd
|
| services.mchprs.settings.address | Address for the server
|
| services.go2rtc.settings.streams | Stream source configuration
|
| services.peroxide.settings.UserPortImap | The port on which to listen for IMAP connections.
|
| services.peroxide.settings.UserPortSmtp | The port on which to listen for SMTP connections.
|
| services.tor.settings.ControlPortWriteToFile | See torrc manual.
|
| services.tor.settings.ServerDNSResolvConfFile | See torrc manual.
|
| services.tor.settings.DisableNetwork | See torrc manual.
|
| services.peering-manager.settings | Configuration options to set in configuration.py
|
| security.krb5.settings.module | Modules to obtain Kerberos configuration from.
|
| services.bookstack.settings.DB_PORT | The port your database is listening at.
|
| services.omnom.settings.server.address | Server address.
|
| services.imaginary.settings | Command line arguments passed to the imaginary executable, stripped of
the prefix -
|
| services.openssh.settings.LogLevel | Gives the verbosity level that is used when logging messages from sshd(8)
|
| services.livekit.ingress.settings | LiveKit Ingress configuration
|
| services.peertube-runner.settings | Configuration for peertube-runner
|
| services.umami.settings.DATABASE_URL | Connection string for the database
|
| services.snips-sh.settings | The configuration of snips-sh is done through environment variables,
therefore you must use upper snake case (e.g. SNIPS_HTTP_INTERNAL)
|
| systemd.network.networks.<name>.flowQueuePIEConfig | Each attribute in this set specifies an option in the
[FlowQueuePIE] section of the unit
|
| services.pds.settings.PDS_REPORT_SERVICE_DID | DID of mod service
|
| services.bluesky-pds.settings.PDS_BSKY_APP_VIEW_DID | DID of bsky frontend
|
| services.go-csp-collector.settings.port | The port to listen on.
|
| services.litestream.settings | See the documentation.
|
| services.rebuilderd.settings | Configuration for rebuilderd (rebuilderd.conf)
|
| services.tsidp.settings.enableFunnel | Use Tailscale Funnel to make tsidp available on the public internet so it works with SaaS products.
|
| services.ntfy-sh.settings.base-url | Public facing base URL of the service
This setting is required for any of the following features:
- attachments (to return a download URL)
- e-mail sending (for the topic URL in the email footer)
- iOS push notifications for self-hosted servers
(to calculate the Firebase poll_request topic)
- Matrix Push Gateway (to validate that the pushkey is correct)
|
| services.angrr.settings.owned-only | Only monitors owned symbolic link target of GC roots.
- "auto": behaves like true for normal users, false for root.
- "true": only monitor GC roots owned by the current user.
- "false": monitor all GC roots.
|
| services.keycloak.settings.https-port | On which port Keycloak should listen for new HTTPS connections.
|
| services.gemstash.settings.db_url | The database to connect to when using postgres, mysql, or mysql2.
|
| services.suricata.settings.run-as.group | Run Suricata with a specific group-id.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.name | The name of this resource
|
| services.openssh.settings.AllowUsers | If specified, login is allowed only for the listed users
|
| services.smartdns.settings | A set that will be generated into configuration file, see the SmartDNS README for details of configuration parameters
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.password | The password for this entry
|
| services.openssh.settings.DenyUsers | If specified, login is denied for all listed users
|
| services.oncall.settings.db.conn.kwargs.host | Database host.
|
| services.misskey.settings.chmodSocket | The file access mode of the UNIX socket.
|
| services.pretix.settings.pretix.logdir | Directory for storing log files.
|
| services.oncall.settings.db.conn.kwargs.user | Database user.
|
| services.suricata.settings.af-packet | Linux high speed capture support.
|
| users.users.<name>.homeMode | The user's home directory mode in numeric format
|
| services.dnscrypt-proxy2.settings | Attrset that is converted and passed as TOML config file
|
| services.maubot.settings.admins | List of administrator users
|
| services.bookstack.settings.DB_HOST | The IP or hostname which hosts your database.
|
| services.anuko-time-tracker.settings.helpLink | Help link from the main menu.
|
| services.karma.settings.listen.address | Hostname or IP to listen on.
|
| services.tor.settings.DownloadExtraInfo | See torrc manual.
|
| services.tor.settings.DataDirectory | See torrc manual.
|
| services.tor.settings.BandwidthRate | See torrc manual.
|
| hardware.deviceTree.name | The name of an explicit dtb to be loaded, relative to the dtb base
|
| services.meshcentral.settings | Settings for MeshCentral
|
| services.frigate.settings.ffmpeg.path | Package providing the ffmpeg and ffprobe executables below the bin/ directory.
|
| services.i2pd.inTunnels.<name>.port | Bind port for ‹name› endpoint.
|
| services.pds.settings.PDS_REPORT_SERVICE_URL | URL of mod service
|
| services.bluesky-pds.settings.PDS_BSKY_APP_VIEW_URL | URL of bsky frontend
|
| services.scanservjs.settings | Config to set in config.local.js's afterConfig.
|
| services.lldap.settings.ldap_port | The port on which to have the LDAP server.
|
| services.reposilite.settings | Configuration written to the reposilite.cdn file
|
| services.stash.settings.generated | Path to generated files
|
| services.dsnet.settings.Networks | The CIDR networks that should route through this server
|
| services.hedgedoc.settings.db | Specify the configuration for sequelize
|
| services.caddy.settings | Structured configuration for Caddy to generate a Caddy JSON configuration file
|
| services.minidlna.settings.db_dir | Specify the directory to store database and album art cache.
|
| networking.wireless.networks.<name>.pskRaw | Either the raw pre-shared key in hexadecimal format
or the name of the secret (as defined inside
networking.wireless.secretsFile and prefixed
with ext:) containing the network pre-shared key.
Be aware that this will be written to the Nix store
in plaintext! Always use an external reference.
The external secret can be either the plaintext
passphrase or the raw pre-shared key.
Mutually exclusive with psk and auth.
|
| services.fediwall.settings.hideBoosts | Hide boosts
|
| services.bluesky-pds.settings.LOG_ENABLED | Enable logging
|
| programs.lazygit.settings | Lazygit configuration
|
| systemd.network.networks.<name>.ipv6Prefixes | A list of ipv6Prefix sections to be added to the unit
|
| services.languagetool.settings | Configuration file options for LanguageTool, see
'languagetool-http-server --help'
for supported settings.
|
| services.gitlab.pages.settings.listen-http | The address(es) to listen on for HTTP requests.
|
| services.gancio.settings.server.socket | The unix socket for the gancio server to listen on.
|
| services.chhoto-url.settings.site_url | The URL under which Chhoto URL is externally reachable.
|
| services.biboumi.settings.ca_file | Specifies which file should be used as the list of trusted CA
when negotiating a TLS session.
|
| services.tuned.settings.sections | attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.epgstation.settings | Options to add to config.yml
|
| services.tor.settings.TestingTorNetwork | See torrc manual.
|
| services.tor.settings.LogMessageDomains | See torrc manual.
|
| services.tor.settings.RefuseUnknownExits | See torrc manual.
|
| services.rosenpass.settings.peers | List of peers to exchange keys with.
|
| services.nezha-agent.settings.uuid | Must be set to a unique identifier, preferably a UUID according to
RFC 4122
|
| services.tlsrpt.collectd.settings | Flags from tlsrpt-collectd(1) as key-value pairs.
|
| services.fediwall.settings.loadPublic | Load public posts
|
| services.fediwall.settings.playVideos | Autoplay videos in posts
|
| services.fediwall.settings.loadTrends | Load trending posts
|
| services.traefik.static.settings | Static configuration for Traefik, written in Nix.
This will be serialized to JSON (which is considered valid YAML) at build, and passed to Traefik as --configfile.
|
| systemd.network.networks.<name>.dhcpServerConfig | Each attribute in this set specifies an option in the
[DHCPServer] section of the unit
|
| systemd.network.networks.<name>.pfifoHeadDropConfig | Each attribute in this set specifies an option in the
[PFIFOHeadDrop] section of the unit
|
| services.kubo.settings.Mounts.FuseAllowOther | Allow all users to access the FUSE mount points
|
| services.openssh.settings.StrictModes | Whether sshd should check file modes and ownership of directories
|
| services.kanidm.server.settings.origin | The origin of your Kanidm instance
|
| services.corosync.nodelist.*.name | Node name
|
| services.prometheus.exporters.nginxlog.settings | All settings of nginxlog expressed as an Nix attrset
|
| programs.regreet.settings | ReGreet configuration file
|
| services.forgejo.settings.server.ROOT_URL | Full public URL of Forgejo server.
|
| services.slskd.settings.shares.filters | Regular expressions of files to exclude from sharing.
|
| services.dolibarr.database.name | Database name.
|
| services.castopod.database.name | Database name.
|
| services.agorakit.database.name | Database name.
|
| services.mastodon.database.name | Database name.
|
| services.peertube.database.name | Database name.
|
| services.pixelfed.database.name | Database name.
|
| services.windmill.database.name | Database name.
|
| services.zabbixServer.database.name | Database name.
|
| services.factorio.game-name | Name of the game as it will appear in the game listing.
|
| services.i2pd.outTunnels.<name>.port | Bind port for ‹name› endpoint.
|
| services.geth.<name>.port | Port number Go Ethereum will be listening on, both TCP and UDP.
|
| services.matrix-hookshot.settings | config.yml configuration as a Nix attribute set
|
| services.waagent.settings.HttpProxy.Host | If you set http proxy, waagent will use is proxy to access the Internet.
|
| services.waagent.settings.HttpProxy.Port | If you set http proxy, waagent will use this proxy to access the Internet.
|
| services.firefly-iii.settings.APP_URL | The APP_URL used by firefly-iii internally
|
| services.crowdsec-firewall-bouncer.settings | Settings for the main CrowdSec Firewall Bouncer
|
| services.libeufin.bank.settings | Configuration options for the libeufin bank system config file
|
| services.gnome.gnome-settings-daemon.enable | Whether to enable GNOME Settings Daemon.
|
| services.metricbeat.settings | Configuration for metricbeat
|
| services.routinator.settings | Configuration for Routinator 3000, see https://routinator.docs.nlnetlabs.nl/en/stable/manual-page.html#configuration-file for options.
|
| services.warpgate.settings.ssh.enable | Whether to enable SSH listener.
|
| services.warpgate.settings.ssh.listen | Listen endpoint of SSH listener.
|
| services.stash.settings.nobrowser | If we should not auto-open a browser window on startup
|
| services.journalbeat.name | Name of the beat
|
| services.sympa.settingsFile | Set of files to be linked in /var/lib/sympa.
|
| services.zitadel.settings.TLS.Key | The TLS certificate private key, as a base64-encoded string
|
| services.cryptpad.settings.adminKeys | List of public signing keys of users that can access the admin panel
|
| users.users.<name>.uid | The account UID
|
| services.evremap.settings.remap.*.input | The key sequence that should be remapped
|
| services.grafana.settings.smtp.enabled | Whether to enable SMTP.
|
| services.saunafs.master.settings.DATA_PATH | Data storage directory.
|
| services.cgit.<name>.group | Group to run the cgit service as.
|
| services.acme-dns.settings.general.listen | IP+port combination to bind and serve the DNS server on.
|
| services.displayManager.gdm.settings | Options passed to the gdm daemon
|
| services.misskey.settings.redisForJobQueue | ioredis options for the job queue
|
| services.pretix.settings.celery.broker | URI to the celery broker used for the asynchronous job queue.
|
| services.crowdsec.settings.console | Console Configuration attributes
|
| services.fediwall.settings.servers | Servers to load posts from
|
| services.prowlarr.settings.server.port | Port Number
|
| services.pretix.settings.database.user | Database username.
|
| services.quickwit.settings.version | Configuration file version.
|
| services.umurmur.settings.channels | Channel tree definitions.
|
| services.whisparr.settings.server.port | Port Number
|
| services.mautrix-discord.settings | config.yaml configuration as a Nix attribute set
|
| systemd.network.networks.<name>.networkConfig | Each attribute in this set specifies an option in the
[Network] section of the unit
|
| systemd.network.networks.<name>.ipv6AcceptRAConfig | Each attribute in this set specifies an option in the
[IPv6AcceptRA] section of the unit
|
| services.gitea.settings.mailer.ENABLED | Whether to use an email service to send notifications.
|
| services.zitadel.settings.TLS.Cert | The TLS certificate, as a base64-encoded string
|
| services.cross-seed.settings.torrentDir | Directory containing torrent files, or if you're using a torrent
client integration and injection - your torrent client's .torrent
file store/cache.
|
| services.dawarich.database.name | The name of the dawarich database.
|
| services.cloudlog.database.name | MySQL database name.
|
| services.freshrss.database.name | Database name for FreshRSS.
|
| services.yggdrasil.settings | Configuration for yggdrasil, as a structured Nix attribute set
|
| services.lldap.settings.ldap_host | The host address that the LDAP server will be bound to.
|
| services.lldap.settings.http_host | The host address that the HTTP server will be bound to.
|
| services.lubelogger.settings | Additional configuration for LubeLogger, see https://docs.lubelogger.com/Environment%20Variables for supported values.
|
| services.lldap.settings.http_port | The port on which to have the HTTP server, for user login and administration.
|
| services.photoprism.settings | See the getting-started guide for available options.
|
| services.stash.settings.ui.frontPageContent | Search filters to display on the front page.
|
| services.hedgedoc.settings.domain | Domain to use for website
|
| services.journald.upload.settings | Configuration for journal-upload
|
| services.suricata.settings.rule-files | Files to load suricata-update managed rules, relative to 'default-rule-path'.
|
| programs.yazi.settings.keymap | Configuration included in keymap.toml
|
| services.broadcast-box.settings | Attribute set of environment variables.
https://github.com/Glimesh/broadcast-box#environment-variables
The status API exposes stream keys so DISABLE_STATUS is enabled
by default.
|
| services.wyoming.satellite.name | Name of the satellite.
|
| services.go-autoconfig.settings | Configuration for go-autoconfig
|
| services.gitlab.pages.settings.pages-domain | The domain to serve static pages on.
|
| services.moosefs.master.settings.DATA_PATH | Directory for storing master metadata.
|
| services.frigate.settings.mqtt.enabled | Whether to enable MQTT support.
|
| services.matrix-synapse.settings.redis | Redis configuration for synapse
|
| services.anuko-time-tracker.settings.forumLink | Forum link from the main menu.
|
| services.tor.settings.BandwidthBurst | See torrc manual.
|
| services.tsidp.settings.debugAllRequests | For development
|
| services.tor.settings.CacheDirectory | See torrc manual.
|
| services.umurmur.settings.bindport | Port to bind to (UDP and TCP).
|
| services.openbao.settings.listener | Configure a listener for responding to requests.
|
| systemd.settings.Manager | Options for the global systemd service manager
|
| nix.settings | Configuration for Nix, see
https://nixos.org/manual/nix/stable/command-ref/conf-file.html or
nix.conf(5) for available options
|
| services.pds.settings.PDS_DATA_DIRECTORY | Directory to store state
|
| services.misskey.settings.redisForJobQueue.port | The Redis port.
|
| services.misskey.settings.redisForJobQueue.host | The Redis host.
|
| services.lasuite-meet.settings.DJANGO_DATA_DIR | Path to the data directory
|
| systemd.network.networks.<name>.addresses | A list of address sections to be added to the unit
|
| services.filesender.settings | Configuration options used by FileSender
|
| services.homebridge.settings | Configuration options for homebridge
|
| services.canaille.settings.SECRET_KEY | Flask Secret Key
|
| services.snapserver.settings | Snapserver configuration
|
| services.misskey.settings.redisForPubsub | ioredis options for pubsub
|
| services.privatebin.settings | Options for privatebin configuration
|
| services.pgbouncer.settings.users | Optional
|
| services.pgbouncer.settings.peers | Optional
|
| services.mattermost.settings | Additional configuration options as Nix attribute set in config.json schema.
|
| services.hatsu.settings.HATSU_DATABASE_URL | Database URL.
|
| services.public-inbox.settings.coderepo | code repositories
|
| services.bacula-sd.device.<name>.archiveDevice | The specified name-string gives the system file name of the storage
device managed by this storage daemon
|
| services.gitlab.pages.settings.listen-https | The address(es) to listen on for HTTPS requests.
|
| services.amule.settings.WebServer.Enabled | Set to 1 to enable the web server
|
| services.gitlab.pages.settings.listen-proxy | The address(es) to listen on for proxy requests.
|
| services.ente.api.settings.apps.accounts | Set this to the URL where your accounts page is running
|
| services.rkvm.server.settings.switch-keys | A key list specifying a host switch combination.
A list of key names is available in https://github.com/htrefil/rkvm/blob/master/switch-keys.md.
|
| services.gitea.settings.server.DISABLE_SSH | Disable external SSH feature.
|
| services.freeciv.settings.quitidle | Quit if no players for given time in seconds.
|
| services.freeciv.settings.Database | Enable database connection with given configuration.
|
| services.pretix.settings.database.host | Database host or socket path.
|
| services.umurmur.settings.password | Required password to join server, if specified.
|
| services.postsrsd.settings.domains | List of local domains, that do not require rewriting.
|
| services.warpgate.settings.http.listen | Listen endpoint of HTTP listener.
|
| services.buildkite-agents.<name>.hooksPath | Path to the directory storing the hooks
|
| services.nipap.settings.nipapd.db_host | PostgreSQL host to connect to
|
| services.sourcehut.settings.mail.pgp-key-id | OpenPGP key identifier.
|
| services.headscale.settings.log.level | headscale log level.
|
| services.tor.settings.ShutdownWaitLength | See torrc manual.
|
| services.kanidm.server.settings.db_path | Path to Kanidm database.
|
| services.gitea.settings.server.SSH_PORT | SSH port displayed in clone URL
|
| services.matrix-conduit.settings | Generates the conduit.toml configuration file
|
| services.libeufin.nexus.settings | Configuration options for the libeufin nexus config file
|
| services.taler.exchange.settings | Configuration options for the taler exchange config file
|
| services.taler.merchant.settings | Configuration options for the taler merchant config file
|
| services.cryptpad.settings.logToStdout | Controls whether log output should go to stdout of the systemd service
|
| services.opensnitch.settings | opensnitchd configuration
|
| services.x2goserver.settings | x2goserver.conf ini configuration as nix attributes
|
| services.cgit.<name>.scanPath | A path which will be scanned for repositories.
|
| users.users.<name>.group | The user's primary group.
|
| services.lemmy.settings.captcha.enabled | Enable Captcha.
|
| services.gancio.settings.log_level | Gancio log level.
|
| services.hedgedoc.settings.allowOrigin | List of domains to whitelist.
|
| services.opengfw.settings.ruleset.geoip | Path to geoip.dat.
|
| services.tinyproxy.settings.Listen | Specify which address to listen to.
|
| services.invoiceplane.sites.<name>.database.name | Database name.
|
| services.journald.remote.settings | Configuration in the journal-remote configuration file
|
| services.zammad.database.settings | The database.yml configuration file as key value set
|
| services.forgejo.settings.server.HTTP_PORT | Listen port
|
| services.scanservjs.settings.host | The IP to listen on.
|
| services.scanservjs.settings.port | The port to listen on.
|
| security.pam.u2f.settings | Options to pass to the PAM module
|
| programs.openvpn3.log-service.settings | Options stored in /etc/openvpn3/log-service.json configuration file
|
| nix.settings.system-features | The set of features supported by the machine
|
| services.freeciv.settings.Announce | Announce game in LAN using given protocol.
|
| services.umurmur.settings.bindaddr | IPv4 address to bind to
|
| services.sftpgo.settings.ftpd.bindings | Configure listen addresses and ports for ftpd.
|
| services.opengfw.rules.*.modifier.name | Name of the modifier.
|
| services.bitmagnet.settings.dht_server | DHT server settings
|
| services.shairport-sync.settings | Configuration options for Shairport-Sync
|
| services.kanidm.server.settings.tls_key | TLS key in pem format.
|
| services.yggdrasil-jumper.settings | Configuration for Yggdrasil Jumper as a Nix attribute set.
|
| services.firezone.server.provision.accounts.<name>.name | The account name
|
| services.autotierfs.settings | The contents of the configuration file for autotier
|
| boot.zfs.pools.<name>.devNodes | Name of directory from which to import ZFS device, this is passed to zpool import
as the value of the -d option
|
| services.firefly-iii.settings.DB_HOST | The machine which hosts your database
|
| services.nylon.<name>.port | What port to listen for client requests, default is 1080.
|
| services.acme-dns.settings.database.engine | Database engine to use.
|
| services.tor.settings.FascistFirewall | See torrc manual.
|
| services.maubot.settings.database | The full URI to the database
|
| services.rsyncd.settings.sections | attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.draupnir.settings.dataPath | The path Draupnir will store its state/data in.
This option is read-only.
If you want to customize where this data is stored, use a bind mount.
|
| services.forgejo.settings.server.HTTP_ADDR | Listen address
|
| services.taler.settings.taler.CURRENCY | The currency which taler services will operate with
|
| services.cryptpad.settings.httpSafeOrigin | Cryptpad sandbox URL
|
| services.misskey.settings.redisForPubsub.port | The Redis port.
|
| services.misskey.settings.redisForPubsub.host | The Redis host.
|
| services.reposilite.settings.port | The TCP port to bind to.
|
| services.postgresql.settings.port | The port on which PostgreSQL listens.
|
| services.tuned.settings.globalSection | global section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.openssh.settings.AllowGroups | If specified, login is allowed only for users part of the
listed groups
|
| systemd.network.networks.<name>.ipv6PREF64Prefixes | A list of IPv6PREF64Prefix sections to be added to the unit
|
| services.librechat.settings | A free-form attribute set that will be written to librechat.yaml
|
| services.openssh.settings.DenyGroups | If specified, login is denied for all users part of the listed
groups
|
| services.freeciv.settings.Newusers | Whether to enable new users to login if auth is enabled.
|
| services.aesmd.settings.whitelistUrl | URL to retrieve authorized Intel SGX enclave signers.
|
| services.suricata.settings.plugins | Plugins -- Experimental -- specify the filename for each plugin shared object.
|
| services.openssh.settings.PermitRootLogin | Whether the root user can login using ssh.
|
| services.slskd.settings.global.upload.slots | Limit of the number of concurrent upload slots.
|
| services.veilid.settings.logging.api.level | The minimum priority of api events to be logged.
|
| services.suricata.settings.vars.address-groups | The address group variables for suricata, if not defined the
default value of suricata (see example) will be used
|
| services.fediwall.settings.hideReplies | Hide replies
|
| services.hedgedoc.settings.useSSL | Enable to use SSL server.
|
| security.krb5.settings.include | Files to include in the Kerberos configuration.
|
| services.sourcehut.settings."sr.ht".site-info | The top-level info page for your site.
|
| services.invidious-router.settings | Configuration for invidious-router
|
| services.acme-dns.settings.general.nsadmin | Zone admin email address for SOA.
|
| services.h2o.hosts.<name>.tls | TLS options for virtual host
|
| services.centrifugo.settings | Declarative Centrifugo configuration
|
| services.waagent.settings.OS.EnableRDMA | If enabled, the agent attempts to install and then load an RDMA kernel driver
that matches the version of the firmware on the underlying hardware.
|
| services.rosenpass.settings.listen | List of local endpoints to listen for connections.
|
| services.umami.settings.DISABLE_UPDATES | Disables the check for new versions of Umami.
|
| programs.regreet.iconTheme.name | Name of the icon theme to use for regreet.
|
| services.epgstation.settings.port | HTTP port for EPGStation to listen on.
|
| services.tor.settings.VirtualAddrNetworkIPv4 | See torrc manual.
|
| services.tor.settings.VirtualAddrNetworkIPv6 | See torrc manual.
|
| services.samba.settings.global.security | Samba security type.
|
| services.snips-sh.settings.SNIPS_SSH_INTERNAL | The internal SSH address of the service
|
| services.tor.settings.AccountingMax | See torrc manual.
|
| services.minidlna.settings.inotify | Whether to enable inotify monitoring to automatically discover new files.
|
| services.geth.<name>.http.apis | APIs to enable over WebSocket
|
| services.librespeed.frontend.settings | Override default settings of the speedtest web client
|
| services.sourcehut.settings."sr.ht".site-blurb | Blurb for your site.
|
| services.sourcehut.settings.mail.smtp-from | Outgoing SMTP FROM.
|
| services.lasuite-meet.settings.LIVEKIT_API_URL | URL to the livekit server
|
| services.iodine.clients | Each attribute of this option defines a systemd service that
runs iodine
|
| services.anuko-time-tracker.settings.email.mode | Mail sending mode
|
| services.routinator.settings.log | A string specifying where to send log messages to
|
| services.pretix.settings.pretix.datadir | Directory for storing user uploads and similar data.
|
| services.github-runners.<name>.replace | Replace any existing runner with the same name
|
| services.bluesky-pds.settings.PDS_CRAWLERS | URL of crawlers
|
| services.zipline.settings.CORE_HOSTNAME | The hostname to listen on.
|
| security.loginDefs.settings.UMASK | The file mode creation mask is initialized to this value.
|
| services.mchprs.settings.schemati | Mimic the verification and directory layout used by the
Open Redstone Engineers
Schemati plugin
|
| services.slskd.settings.web.https.disabled | Disable the built-in HTTPS server
|
| services.pretalx.settings.redis.session | Whether to use redis as the session storage.
|
| services.veilid.settings.core.network.upnp | Should the app try to improve its incoming network connectivity using UPnP?
|
| services.gitlab.pages.settings.gitlab-server | Public GitLab server URL.
|
| services.legit.settings.dirs.templates | Directories where template files are located.
|
| services.gitea.settings.mailer.PROTOCOL | Which mail server protocol to use.
|
| services.headscale.settings.oidc.scope | Scopes used in the OIDC flow.
|
| services.misskey.settings.db.disableCache | Whether to disable caching queries.
|
| services.warpgate.settings.mysql.enable | Whether to enable MySQL listener.
|
| services.warpgate.settings.mysql.listen | Listen endpoint of MySQL listener.
|
| services.c2fmzq-server.settings.verbose | The level of logging verbosity: 1:Error 2:Info 3:Debug
|
| services.sourcehut.settings.mail.smtp-port | Outgoing SMTP port.
|
| services.sourcehut.settings.mail.smtp-host | Outgoing SMTP host.
|
| services.sourcehut.settings.mail.smtp-user | Outgoing SMTP user.
|
| services.hedgedoc.settings.uploadsPath | Directory for storing uploaded images.
|
| services.cryptpad.settings.httpAddress | Address on which the Node.js server should listen
|
| services.nvme-rs.settings.email.smtp_port | SMTP server port
|
| services.tor.settings.AssumeReachable | See torrc manual.
|
| services.tor.settings.ServerDNSSearchDomains | See torrc manual.
|
| services.tor.settings.WarnPlaintextPorts | See torrc manual.
|
| services.nvme-rs.settings.thresholds | Threshold configuration for NVMe monitoring
|
| services.tor.settings.RelayBandwidthRate | See torrc manual.
|
| services.tor.settings.UnixSocksGroupWritable | See torrc manual.
|
| services.tor.settings.AutomapHostsOnResolve | See torrc manual.
|
| services.tor.settings.DormantOnFirstStartup | See torrc manual.
|
| services.openssh.settings.AcceptEnv | Specifies what environment variables sent by the client will be copied into the session's
environment
|
| services.postgrest.settings.db-uri | libpq connection parameters as documented in:
https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
The settings.db-uri.password and settings.db-uri.passfile options are blocked
|
| services.opengfw.settings.ruleset | The path to load specific local geoip/geosite db files
|
| services.nginx.virtualHosts.<name>.serverName | Name of this virtual host
|
| services.pretalx.settings.celery.broker | URI to the celery broker used for the asynchronous job queue.
|
| services.pretix.settings.celery.backend | URI to the celery backend used for the asynchronous job queue.
|
| services.neard.settings.General.ResetOnError | Power cycle the adapter when getting a driver error from the kernel.
|
| services.wg-access-server.settings.storage | A storage backend connection string
|
| systemd.network.networks.<name>.ipv6RoutePrefixes | A list of ipv6RoutePrefix sections to be added to the unit
|
| services.anuko-time-tracker.settings.email.smtpHost | MTA hostname.
|
| services.grafana.settings.database.type | Database type.
|
| services.dependency-track.settings | See https://docs.dependencytrack.org/getting-started/configuration/#default-configuration for possible options
|
| services.anuko-time-tracker.settings.email.smtpPort | MTA port.
|
| services.aesmd.settings.defaultQuotingType | Attestation quote type.
|
| services.pretalx.settings.database.user | Database username.
|
| services.parsedmarc.settings | Configuration parameters to set in
parsedmarc.ini
|
| services.sitespeed-io.runs.*.settings | Configuration for sitespeed-io, see
https://www.sitespeed.io/documentation/sitespeed.io/configuration/
for available options
|
| services.gitea.settings.server.STATIC_ROOT_PATH | Upper level of template and static files path.
|
| services.cryptpad.settings.maxWorkers | Number of child processes, defaults to number of cores available
|
| services.livekit.settings.redis.address | Host and port used to connect to a redis instance.
|
| services.opengfw.settings.workers.count | Number of workers
|
| services.anuko-time-tracker.database.name | Database name.
|
| security.loginDefs.settings.UID_MAX | Range of user IDs used for the creation of regular users by useradd or newusers.
|
| security.loginDefs.settings.UID_MIN | Range of user IDs used for the creation of regular users by useradd or newusers.
|
| services.c2fmzq-server.settings.database | Path of the database
|
| services.stash.settings.blobs_path | Path to blobs
|
| services.nsd.zones.<name>.requestXFR | Format: [AXFR|UDP] <ip-address> <key-name | NOKEY>
|
| services.firefly-iii.settings.APP_KEY_FILE | The path to your appkey
|
| services.opencloud.settings | Additional YAML configuration for OpenCloud services
|
| services.kubo.settings.Addresses.Swarm | Where Kubo listens for incoming p2p connections
|
| services.sftpgo.settings.httpd.bindings | Configure listen addresses and ports for httpd.
|
| services.metricbeat.settings.tags | Tags to place on the shipped metrics
|
| services.pretix.settings.redis.sessions | Whether to use redis as the session storage.
|
| services.scrutiny.settings.web.listen.port | Port for web application to listen on.
|
| services.sftpgo.settings.sftpd.bindings | Configure listen addresses and ports for sftpd.
|
| services.suricata.settings.stats.enable | Whether to enable suricata global stats.
|
| networking.wireless.networks.<name>.bssid | If set, this network block is used only when associating with
the AP using the configured BSSID.
|
| services.dnsmasq.settings | Configuration of dnsmasq
|
| services.traccar.settings | config.xml configuration as a Nix attribute set
|
| services.netbox.settings.ALLOWED_HOSTS | A list of valid fully-qualified domain names (FQDNs) and/or IP
addresses that can be used to reach the NetBox service.
|
| services.suricata.settings.stats | Engine statistics such as packet counters, memory use counters and others can be logged in several ways
|
| services.wastebin.settings.RUST_LOG | Influences logging
|
| services.sourcehut.settings.mail.error-to | Address receiving application exceptions
|
| services.suricata.settings.vars.port-groups | The port group variables for suricata.
|
| services.collabora-online.settings | Configuration for Collabora Online WebSocket Daemon, see
https://sdk.collaboraonline.com/docs/installation/Configuration.html, or
https://github.com/CollaboraOnline/online/blob/master/coolwsd.xml.in for the default
configuration.
|
| services.anuko-time-tracker.settings.email.smtpAuth | MTA requires authentication.
|
| services.anuko-time-tracker.settings.email.smtpUser | MTA authentication username.
|
| services.headscale.settings.log.format | headscale log format.
|
| services.tor.settings.CellStatistics | See torrc manual.
|
| services.snips-sh.settings.SNIPS_HTTP_INTERNAL | The internal HTTP address of the service
|
| services.tor.settings.OptimisticData | See torrc manual.
|
| services.tor.settings.DirReqStatistics | See torrc manual.
|
| services.yggdrasil.settings.Peers | List of outbound peer connection strings
|
| services.grafana.settings.paths.plugins | Directory where grafana will automatically scan and look for plugins
|
| services.wgautomesh.settings.peers | wgautomesh peer list.
|
| services.tahoe.nodes.<name>.nickname | The nickname of this Tahoe node.
|
| programs.gnupg.agent.settings | Configuration for /etc/gnupg/gpg-agent.conf
|
| services.reaction.settingsFiles | Configuration for reaction, see the wiki.
reaction supports JSON, YAML and JSONnet
|
| services.postgrest.settings | PostgREST configuration as documented in:
https://docs.postgrest.org/en/stable/references/configuration.html#list-of-parameters
db-uri is represented as an attribute set, see settings.db-uri
The settings.jwt-secret option is blocked
|
| services.evremap.settings.remap.*.output | The key sequence that should be output when the input sequence is entered
|
| services.ente.api.settings.apps.public-albums | If you're running a self hosted instance and wish to serve public links,
set this to the URL where your albums web app is running.
|
| services.grafana-to-ntfy.settings.ntfyBAuthPass | The path to the password for the specified ntfy-sh user
|
| services.gitea.settings.server.PROTOCOL | Listen protocol. +unix means "over unix", not "in addition to."
|
| services.scrutiny.settings.web.listen.host | Interface address for web application to bind to.
|
| services.samba.settings.global."invalid users" | List of users who are denied to login via Samba.
|
| nix.settings.trusted-users | A list of names of users that have additional rights when
connecting to the Nix daemon, such as the ability to specify
additional binary caches, or to import unsigned NARs
|
| services.gateone.settingsDir | Path of configuration files for GateOne.
|
| services.rkvm.client.settings.password | Shared secret token to authenticate the client
|
| services.rkvm.server.settings.password | Shared secret token to authenticate the client
|
| security.loginDefs.settings.GID_MAX | Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
|
| security.loginDefs.settings.GID_MIN | Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
|
| services.postsrsd.settings.chroot-dir | Path to chroot into at runtime as an additional layer of protection.
We confine the runtime environment through systemd hardening instead, so this option is read-only.
|
| services.acme-dns.settings.general.records | Predefined DNS records served in addition to the _acme-challenge TXT records.
|
| services.cgit.<name>.enable | Whether to enable cgit.
|
| services.grafana.settings.database.user | The database user (not applicable for sqlite3).
|
| services.grafana.settings.smtp.key_file | File path to a key file.
|
| services.hbase-standalone.settings | configurations in hbase-site.xml, see https://github.com/apache/hbase/blob/master/hbase-server/src/test/resources/hbase-site.xml for details.
|
| services.privoxy.settings.listen-address | Pair of address:port the proxy server is listening to.
|
| services.sabnzbd.settings.misc.email_to | Receiving address for email alerts
|
| services.pretalx.settings.database.host | Database host or socket path.
|
| services.parsedmarc.settings.smtp.to | The addresses to send outgoing mail to.
|
| services.frigate.settings.database.path | Path to the SQLite database used
|
| nix.settings.require-sigs | If enabled (the default), Nix will only download binaries from binary caches if
they are cryptographically signed with any of the keys listed in
nix.settings.trusted-public-keys
|
| services.rosenpass.settings.peers.*.peer | WireGuard public key corresponding to the remote Rosenpass peer.
|
| services.grafana-image-renderer.settings | Configuration attributes for grafana-image-renderer.
|
| services.tor.settings.ServerDNSAllowBrokenConfig | See torrc manual.
|
| services.tor.settings.ExitPolicyRejectPrivate | See torrc manual.
|
| services.opengfw.settings.workers.queueSize | Worker queue size.
|
| services.bcg.rename | Rename nodes to different name.
|
| systemd.network.networks.<name>.routingPolicyRules | A list of routing policy rules sections to be added to the unit
|
| services.k3s.manifests.<name>.target | Name of the symlink (relative to /var/lib/rancher/k3s/server/manifests)
|
| services.kavita.settings.IpAddresses | IP Addresses to bind to
|
| services.resolved.settings.Resolve.DNS | List of IP addresses to query as recursive DNS resolvers.
|
| services.sourcehut.settings."sr.ht".owner-email | Owner's email.
|
| services.navidrome.settings.Address | Address to run Navidrome on.
|
| services.pid-fan-controller.settings.fans | List of fans to be controlled.
|
| services.watchdogd.settings.timeout | The WDT timeout before reset.
|
| services.i2pd.inTunnels.<name>.enable | Whether to enable ‹name›.
|
| services.nix-store-gcs-proxy.<name>.bucketName | Name of Google storage bucket
|
| services.rsyncd.settings.globalSection | global section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.headscale.settings.dns.split | Split DNS configuration (map of domains and which DNS server to use for each)
|
| services.healthchecks.settings | Environment variables which are read by healthchecks (local)_settings.py
|
| nix.settings.allowed-users | A list of names of users (separated by whitespace) that are
allowed to connect to the Nix daemon
|
| services.dsnet.settings.ExternalIP | The external IP address of the server
|
| services.mympd.settings.http_port | The HTTP port where mympd's web interface will be available
|
| services.h2o.hosts.<name>.acme | ACME options for virtual host.
|
| services.h2o.hosts.<name>.http | HTTP options for virtual host
|
| networking.wireless.networks.<name>.hidden | Set this to true if the SSID of the network is hidden.
|
| hardware.apple.touchBar.settings | Configuration for tiny-dfr
|
| services.bookstack.database.name | Database name.
|
| services.mediawiki.database.name | Database name.
|
| services.scrutiny.collector.settings | Collector settings to be rendered into the collector configuration file
|
| services.sourcehut.settings."hg.sr.ht".origin | URL hg.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."hg.sr.ht".hg_ssh | Path to hg-ssh (if not in $PATH).
|
| services.sourcehut.settings."sr.ht".source-url | The source code for your fork of sr.ht.
|
| services.sourcehut.settings."hg.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."hg.sr.ht".debug-port | Port to bind the debug server to.
|
| services.snapserver.settings.tcp.port | Port to listen on for snapclient connections.
|
| services.imaginary.settings.return-size | Return the image size in the HTTP headers.
|
| services.postgrest.settings.server-port | The TCP port to bind the web server.
|
| services.tlsrpt.fetcher.settings.storage | Path to the collectd sqlite database.
|
| services.bookstack.settings.APP_URL | The root URL that you want to host BookStack on
|
| services.grafana-to-ntfy.settings.ntfyBAuthUser | The ntfy-sh user to use for authenticating with the ntfy-sh instance
|
| services.openafsClient.cellServDB.<name>.*.dnsname | DNS full-qualified domain name of a database server
|
| services.openafsServer.cellServDB.<name>.*.dnsname | DNS full-qualified domain name of a database server
|
| services.grafana.settings.database.wal | For sqlite3 only
|
| services.headscale.settings.oidc.issuer | URL to OpenID issuer.
|
| services.angrr.settings.profile-policies | Profile GC root policies.
|
| services.moosefs.cgiserver.settings | GUI server configuration options.
|
| services.tor.settings.RelayBandwidthBurst | See torrc manual.
|
| services.opensearch.settings."http.port" | The port to listen on for HTTP traffic.
|
| services.hickory-dns.settings.zones.*.file | Path to the .zone file
|
| services.headscale.settings.derp.urls | List of urls containing DERP maps
|
| services.geth.<name>.gcmode | Blockchain garbage collection mode.
|
| services.uhub.<name>.enable | Whether to enable hub instance.
|
| services.rke2.manifests.<name>.target | Name of the symlink (relative to /var/lib/rancher/rke2/server/manifests)
|
| programs.starship.settings | Configuration included in starship.toml
|
| services.litellm.settings.router_settings | LiteLLM Router settings
|
| services.mautrix-discord.settings.bridge | Bridge configuration
|
| services.geth.<name>.http.port | Port number of Go Ethereum HTTP API.
|
| services.amule.settings.eMule.IncomingDir | Directory where aMule moves completed downloads
|
| services.lokinet.settings.network.exit | Whether to act as an exit node
|
| services.parsedmarc.settings.smtp.ssl | Use an encrypted SSL/TLS connection.
|
| services.openldap.settings.children | Child entries of the current entry, with recursively the same structure.
|
| services.openldap.settings.includes | LDIF files to include after the parent's attributes but before its children.
|
| services.parsedmarc.settings.imap.ssl | Use an encrypted SSL/TLS connection.
|
| services.discourse.database.name | Discourse database name.
|
| services.sourcehut.settings."meta.sr.ht::settings".registration | Whether to enable public registration.
|
| services.pretix.settings.redis.location | URI to the redis server, used to speed up locking, caching and session storage.
|
| services.warpgate.settings.log.send_to | Path of UNIX socket of log forwarder
|
| services.i2pd.outTunnels.<name>.enable | Whether to enable ‹name›.
|
| services.sourcehut.settings.mail.error-from | Address sending application exceptions
|
| services.sourcehut.settings."hub.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."man.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."git.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."man.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."git.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."man.sr.ht".origin | URL man.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."hub.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."git.sr.ht".origin | URL git.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."hub.sr.ht".origin | URL hub.sr.ht is being served at (protocol://domain)
|
| services.autosuspend.settings | Configuration for autosuspend, see
https://autosuspend.readthedocs.io/en/latest/configuration_file.html#general-configuration
for supported values.
|
| services.acme-dns.settings.general.protocol | Protocols to serve DNS responses on.
|
| services.bluesky-pds.settings.PDS_BLOB_UPLOAD_LIMIT | Size limit of uploaded blobs in bytes
|
| services.immichframe.settings | Configuration for ImmichFrame
|
| services.umurmur.settings.max_users | Maximum number of concurrent clients allowed.
|
| services.pretix.settings.pretix.cachedir | Directory for storing temporary files.
|
| services.mollysocket.settings | Configuration for MollySocket
|
| services.prometheus.remoteRead.*.name | Name of the remote read config, which if specified must be unique among remote read configs
|
| security.loginDefs.settings | Config options for the /etc/login.defs file, that defines
the site-specific configuration for the shadow password suite
|
| services.anuko-time-tracker.settings.email.smtpDebug | Debug mail sending.
|
| services.anuko-time-tracker.settings.email.sender | Default sender for mail.
|
| services.tor.settings.UseDefaultFallbackDirs | See torrc manual.
|
| services.parsedmarc.settings.imap.port | The IMAP server port.
|
| services.tor.settings.AccountingStart | See torrc manual.
|
| services.tor.settings.ProtocolWarnings | See torrc manual.
|
| services.parsedmarc.settings.smtp.user | The SMTP server username.
|
| services.parsedmarc.settings.smtp.port | The SMTP server port.
|
| services.tor.settings.EntryStatistics | See torrc manual.
|
| services.omnom.settings.db.connection | Database connection URI.
|
| services.parsedmarc.settings.imap.user | The IMAP server username.
|
| services.lasuite-docs.settings.CELERY_BROKER_URL | URL of the redis backend for celery
|
| services.lasuite-meet.settings.CELERY_BROKER_URL | URL of the redis backend for celery
|
| networking.wireless.networks.<name>.psk | The network's pre-shared key in plaintext defaulting
to being a network without any authentication.
Be aware that this will be written to the Nix store
in plaintext! Use pskRaw with an external
reference to keep it safe.
Mutually exclusive with pskRaw.
|
| systemd.network.networks.<name>.dhcpServerStaticLeases | A list of DHCPServerStaticLease sections to be added to the unit
|
| services.grafana.settings.server.socket | Path where the socket should be created when protocol=socket
|
| services.openssh.settings.GatewayPorts | Specifies whether remote hosts are allowed to connect to
ports forwarded for the client
|
| services.matrix-appservice-irc.settings | Configuration for the appservice, see
https://github.com/matrix-org/matrix-appservice-irc/blob/4.0.0/config.sample.yaml
for supported values
|
| services.cgit.<name>.nginx.virtualHost | VirtualHost to serve cgit on, defaults to the attribute name.
|
| security.loginDefs.settings.SYS_UID_MAX | Range of user IDs used for the creation of system users by useradd or newusers.
|
| security.loginDefs.settings.SYS_UID_MIN | Range of user IDs used for the creation of system users by useradd or newusers.
|
| services.vmalert.settings."notifier.url" | Prometheus Alertmanager URL
|
| services.yggdrasil.settings.Listen | Listen addresses for incoming connections
|
| services.bonsaid.settings.*.command | Command to run when this transition is taken
|
| services.watchdogd.settings.safe-exit | With safeExit enabled, the daemon will ask the driver to disable the WDT before exiting
|
| security.pam.rssh.settings | Options to pass to the pam_rssh module
|
| services.actual.settings.serverFiles | The server will put an account.sqlite file in this directory, which will contain the (hashed) server password, a list of all the budget files the server knows about, and the active session token (along with anything else the server may want to store in the future).
|
| services.postgrest.settings.db-config | Enables the in-database configuration.
https://docs.postgrest.org/en/stable/references/configuration.html#in-database-configuration
This is enabled by default upstream, but disabled by default in this module.
|
| services.matrix-hookshot.settings.passFile | A passkey used to encrypt tokens stored inside the bridge
|
| services.mysql.initialDatabases.*.name | The name of the database to create.
|
| services.umurmur.settings.bindaddr6 | IPv6 address to bind to
|
| services.syncthing.settings.options | The options element contains all other global configuration options
|
| services.writefreely.settings | Writefreely configuration (config.ini)
|
| services.xonotic.settings.sv_public | Controls whether the server will be publicly listed.
|
| services.geth.<name>.enable | Whether to enable Go Ethereum Node.
|
| services.geth.<name>.extraArgs | Additional arguments passed to Go Ethereum.
|
| services.nntp-proxy.users.<name>.username | Username
|
| services.bitmagnet.settings.http_server | HTTP server settings
|
| services.gitea.settings.mailer.SENDMAIL_PATH | Path to sendmail binary or script.
|
| services.grafana.settings.smtp.startTLS_policy | StartTLS policy when connecting to server.
|
| services.suwayomi-server.settings.server.ip | The ip that Suwayomi will bind to.
|
| services.snapserver.settings.http.port | Port to listen on for snapclient connections.
|
| services.parsedmarc.settings.smtp.from | The From address to use for the
outgoing mail.
|
| services.garage.settings.data_dir | The directory in which Garage will store the data blocks of objects
|
| systemd.network.networks.<name>.fairQueueingConfig | Each attribute in this set specifies an option in the
[FairQueueing] section of the unit
|
| services.grafana.settings.database.path | Only applicable to sqlite3 database
|
| <imports = [ pkgs.php.services.default ]>.php-fpm.settings | PHP FPM configuration
|
| services.sourcehut.settings.mail.pgp-pubkey | OpenPGP public key.
|
| services.tor.settings.ExitPortStatistics | See torrc manual.
|
| services.tor.settings.AutomapHostsSuffixes | See torrc manual.
|
| services.waagent.settings.Logs.Verbose | If you set this option, log verbosity is boosted
|
| networking.wireless.networks.<name>.ssid | You could use this field to override the network's ssid
|
| services.pretalx.settings.celery.backend | URI to the celery backend used for the asynchronous job queue.
|
| services.postfix-tlspol.settings.server.log-level | Log level
|
| services.rauc.slots.<name>.*.type | The type of the device.
|
| services.lokinet.settings.dns.upstream | Upstream resolver(s) to use as fallback for non-loki addresses
|
| services.prometheus.exporters.fritz.settings | Configuration settings for fritz-exporter.
|
| services.hercules-ci-agent.settings.apiBaseUrl | API base URL that the agent will connect to
|
| security.loginDefs.settings.SYS_GID_MAX | Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
|
| security.loginDefs.settings.SYS_GID_MIN | Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
|
| services.birdwatcher.settings | birdwatcher configuration, for configuration options see the example on github
|
| services.meshtasticd.settings | The Meshtastic configuration file
|
| services.sourcehut.settings."lists.sr.ht".redis | The Redis connection used for the Celery worker.
|
| services.etebase-server.settings.global.debug | Whether to set django's DEBUG flag.
|
| services.parsedmarc.settings.imap.host | The IMAP server hostname or IP address.
|
| services.parsedmarc.settings.smtp.host | The SMTP server hostname or IP address.
|
| services.reposilite.settings.sslPort | SSL port to bind to
|
| services.dsnet.settings.ExternalIP6 | The external IPv6 address of the server
|
| services.mautrix-signal.settings | config.yaml configuration as a Nix attribute set
|
| services.sourcehut.settings."todo.sr.ht".origin | URL todo.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."meta.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."todo.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."meta.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."todo.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."meta.sr.ht".origin | URL meta.sr.ht is being served at (protocol://domain)
|
| services.forgejo.settings.server.DISABLE_SSH | Disable external SSH feature.
|
| services.sourcehut.settings."hg.sr.ht".repos | Path to mercurial repositories on disk
|
| services.sourcehut.settings."meta.sr.ht::settings".onboarding-redirect | Where to redirect new users upon registration.
|
| programs.spacefm.settings | The system-wide spacefm configuration
|
| services.epgstation.settings.encode | Encoding presets for recorded videos.
|
| services.tor.settings.ServerDNSRandomizeCase | See torrc manual.
|
| services.tor.settings.BridgeRecordUsageByCountry | See torrc manual.
|
| users.groups.<name>.gid | The group GID
|
| services.firewalld.settings.RFC3964_IPv4 | Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet.
|
| services.forgejo.settings.server.SSH_PORT | SSH port displayed in clone URL
|
| power.ups.ups.<name>.port | The serial port to which your UPS is connected. /dev/ttyS0 is
usually the first port on Linux boxes, for example.
|
| services.sftpgo.settings.smtp.auth_type |
0: Plain
1: Login
2: CRAM-MD5
|
| services.peroxide.settings.ServerAddress | The address on which to listen for connections.
|
| services.corteza.settings.HTTP_WEBAPP_ENABLED | Whether to enable webapps.
|
| services.firewalld.settings.DefaultZone | Default zone for connections.
|
| services.opengfw.settings.ruleset.geosite | Path to geosite.dat.
|
| services.matrix-synapse.settings.pid_file | The file to store the PID in.
|
| services.suricata.settings.host-mode | If the Suricata box is a router for the sniffed networks, set it to 'router'
|
| users.extraUsers.<name>.homeMode | The user's home directory mode in numeric format
|
| services.filebeat.settings | Configuration for filebeat
|
| services.geoipupdate.settings | geoipupdate configuration options
|
| services.suricata.settings.default-rule-path | Path in which suricata-update managed rules are stored by default.
|
| services.filebrowser.settings.port | The port to listen on.
|
| services.quicktun.<name>.privateKey | Local secret key in hexadecimal form.
This option is deprecated
|
| services.apache-kafka.settings.listeners | Kafka Listener List
|
| services.typesense.settings.server.api-port | Port on which the Typesense API service listens.
|
| services.warpgate.settings.postgres.key | Path to PostgreSQL listener private key.
|
| services.grocy.settings.calendar.firstDayOfWeek | Which day of the week (0=Sunday, 1=Monday etc.) should be the
first day.
|
| services.prometheus.exporters.script.settings.scripts | All settings expressed as an Nix attrset
|
| services.hatsu.settings.HATSU_PRIMARY_ACCOUNT | The primary account of your instance (eg 'example.com').
|
| services.sourcehut.settings."git.sr.ht".repos | Path to git repositories on disk
|
| services.headscale.settings.derp.paths | List of file paths containing DERP maps
|
| services.writefreely.admin.name | The name of the first admin user.
|
| services.prometheus.remoteWrite.*.name | Name of the remote write config, which if specified must be unique among remote write configs
|
| services.botamusique.settings | Your configuration.ini as a Nix attribute set
|
| services.samba.settings.global."passwd program" | Path to a program that can be used to set UNIX user passwords.
|
| services.pretix.settings.pretix.currency | Default currency for events in its ISO 4217 three-letter code.
|
| services.zigbee2mqtt.settings | Your configuration.yaml as a Nix attribute set
|
| services.tor.settings.MaxCircuitDirtiness | See torrc manual.
|
| services.tor.settings.RejectPlaintextPorts | See torrc manual.
|
| services.knot-resolver.settings.workers | The number of running kresd (Knot Resolver daemon) workers
|
| services.gotosocial.settings | Contents of the GoToSocial YAML config
|
| services.pgbackrest.settings | An attribute set of options as described in:
https://pgbackrest.org/configuration.html
All globally available options, i.e. all except stanza options, can be used
|
| services.tts.servers.<name>.model | Name of the model to download and use for speech synthesis
|
| services.grafana.settings.server.protocol | Which protocol to listen.
|
| services.uhub.<name>.enableTLS | Whether to enable TLS support.
|
| services.amule.settings.WebServer.Password | MD5 hash of the password, obtainaible with echo "<password>" | md5sum | cut -d ' ' -f 1
|
| hardware.sata.timeout.drives.*.name | Drive name without the full path.
|
| services.typesense.settings.server.data-dir | Path to the directory where data will be stored on disk.
|
| services.veilid.settings.logging.api.enabled | Events of type 'api' will be logged.
|
| services.veilid.settings.logging.system.level | The minimum priority of system events to be logged.
|
| services.firewalld.settings.ReloadPolicy | The policy during reload.
|
| services.lokinet.settings.network.exit-node | Specify a .loki address and an optional ip range to use as an exit broker
|
| services.cryptpad.settings.httpUnsafeOrigin | This is the URL that users will enter to load your instance
|
| services.headscale.settings.policy.mode | The mode can be "file" or "database" that defines
where the ACL policies are stored and read from.
|
| services.headscale.settings.policy.path | If the mode is set to "file", the path to a
HuJSON file containing ACL policies.
|
| services.anuko-time-tracker.settings.reportFooter | Defines whether to use a footer on reports.
|
| services.listmonk.database.settings.smtp | List of outgoing SMTP servers
|
| services.pid-fan-controller.settings.fans.*.minPwm | Minimum PWM value.
|
| services.pid-fan-controller.settings.fans.*.maxPwm | Maximum PWM value.
|
| services.suwayomi-server.settings.server.port | The port that Suwayomi will listen to.
|
| systemd.network.networks.<name>.tokenBucketFilterConfig | Each attribute in this set specifies an option in the
[TokenBucketFilter] section of the unit
|
| systemd.network.networks.<name>.heavyHitterFilterConfig | Each attribute in this set specifies an option in the
[HeavyHitterFilter] section of the unit
|
| services.sftpgo.settings.ftpd.bindings.*.port | The port for serving FTP requests
|
| services.ndppd.proxies.<name>.rules.<name>.interface | Interface to use when method is iface.
|
| services.postgresql.ensureUsers.*.name | Name of the user to ensure.
|
| services.filebrowser.settings.root | The directory where FileBrowser stores files.
|
| services.postfix-tlspol.settings.server.cache-file | Path to the cache file.
|
| services.tor.settings.ExtraInfoStatistics | See torrc manual.
|
| services.mollysocket.settings.port | Listening port of the web server
|
| services.tor.settings.CookieAuthFileGroupReadable | See torrc manual.
|
| services.tlsrpt.collectd.settings.storage | Storage backend definition.
|
| services.mollysocket.settings.host | Listening address of the web server
|
| users.extraUsers.<name>.home | The user's home directory.
|
| services.libeufin.nexus.settings.nexus-ebics.BIC | BIC of the bank account that is associated with the EBICS subscriber.
|
| services.canaille.settings.CANAILLE.ACL | Access Control Lists
|
| services.privoxy.settings.enable-edit-actions | Whether the web-based actions file editor may be used.
|
| services.bitmagnet.settings.postgres | PostgreSQL database configuration
|
| services.cntlm.username | Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
|
| services.traefik.dynamic.settings | Dynamic configuration for Traefik, written in Nix
|
| services.suricata.settings.includes | Files to include in the suricata configuration
|
| networking.wireless.networks.<name>.auth | Use this option to configure advanced authentication methods
like EAP
|
| services.mautrix-discord.settings.logging | Logging configuration
|
| services.szurubooru.server.settings | Configuration to write to config.yaml
|
| hardware.cpu.x86.msr.settings.allow-writes | Whether to allow writes to MSRs ("on") or not ("off").
|
| services.bluesky-pds.settings.PDS_REPORT_SERVICE_DID | DID of mod service
|
| services.crab-hole.settings.blocklist.lists | List of blocklists
|
| services.grocy.settings.calendar.showWeekNumber | Show the number of the weeks in the calendar views.
|
| services.libeufin.nexus.settings.nexus-httpd.PORT | The port on which libeufin-bank should listen.
|
| services.nsd.zones.<name>.allowNotify | Listed primary servers are allowed to notify this secondary server
|
| services.pretalx.settings.redis.location | URI to the redis server, used to speed up locking, caching and session storage.
|
| services.opensnitch.settings.LogLevel | Default log level from 0 to 4 (debug, info, important, warning,
error).
|
| security.pam.u2f.settings.appid | By default pam-u2f module sets the application
ID to pam://$HOSTNAME
|
| services.sourcehut.settings."paste.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."pages.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."pages.sr.ht".origin | URL pages.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."lists.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."paste.sr.ht".origin | URL paste.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."paste.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."lists.sr.ht".origin | URL lists.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."pages.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."lists.sr.ht".debug-host | Address to bind the debug server to.
|
| services.moosefs.cgiserver.settings.PORT | Port for CGI server to listen on.
|
| services.crowdsec.settings.console.tokenFile | The Console Token file to use.
|
| services.grafana.settings.smtp.cert_file | File path to a cert file.
|
| services.firewalld.settings.FlushAllOnReload | Whether to flush all runtime rules on a reload.
|
| services.kubo.settings.Addresses.Gateway | Where the IPFS Gateway can be reached
|
| services.anubis.defaultOptions.settings | Freeform configuration via environment variables for Anubis
|
| programs.regreet.cursorTheme.name | Name of the cursor theme to use for regreet.
|
| services.routinator.settings.retry | An integer value specifying the number of seconds an RTR client is requested to wait after it failed to receive a data set.
|
| services.firezone.headless-client.name | The name of this client as shown in firezone
|
| services.mchprs.settings.bungeecord | Enable compatibility with
BungeeCord
|
| services.bluesky-pds.settings.PDS_REPORT_SERVICE_URL | URL of mod service
|
| hardware.deviceTree.overlays.*.name | Name of this overlay
|
| services.reposilite.settings.basePath | Custom base path for this Reposilite instance
|
| containers.<name>.bindMounts.<name>.hostPath | Location of the host path to be mounted.
|
| services.librespeed.settings | LibreSpeed configuration written as Nix expression
|
| services.umami.settings.APP_SECRET_FILE | A file containing a secure random string
|
| services.libeufin.nexus.settings.nexus-ebics.NAME | Legal entity that is associated with the EBICS subscriber.
|
| services.forgejo.settings.server.STATIC_ROOT_PATH | Upper level of template and static files path.
|
| services.slskd.settings.global.download.slots | Limit of the number of concurrent download slots.
|
| services.sourcehut.settings."hg.sr.ht".api-origin | Origin URL for the API
|
| services.routinator.settings.log-level | A string value specifying the maximum log level for which log messages should be emitted
|
| nix.settings.trusted-public-keys | List of public keys used to sign binary caches
|
| services.sourcehut.settings."builds.sr.ht".redis | The Redis connection used for the Celery worker.
|
| services.firewalld.settings.CleanupOnExit | Whether to clean up firewall rules when firewalld stops.
|
| services.chhoto-url.settings.slug_style | The slug style to use for auto-generated URLs.
|
| services.resolved.settings.Resolve.DNSSEC | Whether to validate DNSSEC for DNS lookups.
|
| services.scrutiny.settings.web.influxdb.org | InfluxDB organisation under which to store data.
|
| services.sftpgo.settings.webdavd.bindings | Configure listen addresses and ports for webdavd.
|
| services.mautrix-telegram.settings | config.yaml configuration as a Nix attribute set
|
| systemd.automounts.*.name | The name of this systemd unit, including its extension
|
| services.hylafax.modems.<name>.type | Name of modem configuration file,
will be searched for in config
in the spooling area directory.
|
| services.tinyproxy.settings.Filter | Tinyproxy supports filtering of web sites based on URLs or domains
|
| xdg.terminal-exec.settings | Configuration options for the Default Terminal Execution Specification
|
| services.matrix-synapse.settings.redis.enabled | Whether to use redis support
|
| services.filesender.settings.admin | UIDs (as per the configured saml_uid_attribute) of FileSender administrators
|
| services.postsrsd.settings.srs-domain | Dedicated mail domain used for ephemeral SRS envelope addresses
|
| services.pgbackrest.stanzas.<name>.jobs.<name>.type | Backup type as described in:
https://pgbackrest.org/command.html#command-backup/category-command/option-type
|
| services.lidarr.settings.update.mechanism | which update mechanism to use
|
| services.radicle.ci.broker.settings.triggers | CI triggers.
|
| services.sonarr.settings.update.mechanism | which update mechanism to use
|
| services.radarr.settings.update.mechanism | which update mechanism to use
|
| services.kanidm.server.settings.log_level | Log level of the server.
|
| services.wastebin.settings.WASTEBIN_TITLE | Overrides the HTML page title
|
| security.pam.u2f.settings.cue | By default pam-u2f module does not inform user
that he needs to use the u2f device, it just waits without a prompt
|
| services.postgresql.settings | PostgreSQL configuration
|
| services.sourcehut.settings."pages.sr.ht".max-site-size | Maximum size of any given site (post-gunzip), in MiB.
|
| services.sourcehut.settings."hg.sr.ht".srhtext | Path to the srht mercurial extension
(defaults to where the hgsrht code is)
|
| services.libeufin.nexus.settings.nexus-ebics.IBAN | IBAN of the bank account that is associated with the EBICS subscriber.
|
| services.umami.settings.COLLECT_API_ENDPOINT | Allows you to send metrics to a location different than the default /api/send.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers | Additionally enable the recommended set of pairwise ciphers
|
| services.displayManager.lemurs.settings | Configuration for lemurs, provided as a Nix attribute set and automatically
serialized to TOML
|
| services.umami.settings.DATABASE_URL_FILE | A file containing a connection string for the database
|
| services.forgejo.settings.server.PROTOCOL | Listen protocol. +unix means "over unix", not "in addition to."
|
| services.mbpfan.settings.general.low_temp | If temperature is below this, fans will run at minimum speed.
|
| services.mbpfan.settings.general.max_temp | If temperature is above this, fans will run at maximum speed.
|
| services.sourcehut.settings."git.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."hub.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."man.sr.ht".api-origin | Origin URL for the API
|
| services.hickory-dns.settings.directory | The directory in which hickory-dns should look for .zone files,
whenever zones aren't specified by absolute path.
|
| services.sourcehut.settings."todo.sr.ht".notify-from | Outgoing email for notifications generated by users.
|
| services.swapspace.settings.swappath | Location where swapspace may create and delete swapfiles
|
| services.minidlna.settings.log_level | Defines the type of messages that should be logged and down to which level of importance.
|
| services.lasuite-docs.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.lasuite-meet.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.i2pd.inTunnels.<name>.address | Bind address for ‹name› endpoint.
|
| services.scrutiny.settings.web.influxdb.port | The port of the InfluxDB instance.
|
| services.suricata.settings.stats.stream-events | Add stream events as stats.
|
| services.kanidm.server.settings.tls_chain | TLS chain in pem format.
|
| services.evremap.settings.dual_role | List of dual-role remappings that output different key sequences based on whether the
input key is held or tapped.
|
| services.biboumi.settings.log_level | Indicate what type of log messages to write in the logs.
0 is debug, 1 is info, 2 is warning, 3 is error.
|
| services.sftpgo.settings.sftpd.bindings.*.port | The port for serving SFTP requests
|
| services.postsrsd.settings.secrets-file | Path to the file containing the secret keys.
Secrets are passed using LoadCredential= on the systemd unit,
so this options is read-only
|
| services.cryptpad.settings.installMethod | Install method is listed in telemetry if you agree to it through the consentToContact
setting in the admin panel.
|
| services.homebridge.settings.bridge.port | The port homebridge listens on
|
| services.opengfw.settings.workers.udpMaxStreams | UDP max streams.
|
| services.moosefs.metalogger.settings | Metalogger configuration options (mfsmetalogger.cfg).
|
| services.tor.settings.ServerTransportPlugin | See torrc manual.
|
| services.tor.settings.MaxClientCircuitsPending | See torrc manual.
|
| services.h2o.hosts.<name>.host | Set the host address for this virtual host
|
| services.routinator.settings.log-file | A string value containing the path to a file to which log messages will be appended if the log configuration value is set to file
|
| services.sabnzbd.settings.misc.email_rss | Whether to send alerts for jobs added by RSS feeds
|
| services.pretix.settings.database.backend | Database backend to use
|
| services.bluesky-pds.settings.PDS_RATE_LIMITS_ENABLED | Enable rate limiting
|
| services.nginx.virtualHosts.<name>.locations.<name>.root | Root directory for requests.
|
| services.resolved.settings.Resolve.DNSOverTLS | Whether to use TLS encryption for DNS queries
|
| services.angrr.settings.touch.project-globs | List of glob patterns to include or exclude files when touching GC roots
|
| services.sourcehut.settings."hg.sr.ht".oauth-client-id | hg.sr.ht's OAuth client id for meta.sr.ht.
|
| services.scrutiny.settings.web.influxdb.host | IP or hostname of the InfluxDB instance.
|
| services.sftpgo.settings.httpd.bindings.*.port | The port for serving HTTP(S) requests
|
| services.bookstack.settings.APP_KEY_FILE | The path to your appkey
|
| systemd.network.networks.<name>.quickFairQueueingConfig | Each attribute in this set specifies an option in the
[QuickFairQueueing] section of the unit
|
| services.canaille.settings.CANAILLE_LDAP | Configuration for the LDAP backend
|
| services.kanidm.server.settings.domain | The domain that Kanidm manages
|
| services.nginx.proxyCachePath.<name>.keysZoneName | Set name to shared memory zone.
|
| services.snapserver.settings.stream.port | Port to listen on for snapclient connections.
|
| services.tsidp.settings.useLocalTailscaled | Use local tailscaled instead of tsnet.
|
| services.stash.settings.theme_color | Sets the theme-color property in the UI
|
| services.cgit.<name>.package | The cgit package to use.
|
| services.geth.<name>.package | The geth package to use.
|
| services.uhub.<name>.plugins | Uhub plugin configuration.
|
| services.filesender.database.name | Database name.
|
| services.limesurvey.database.name | Database name.
|
| services.zoneminder.database.name | Name of database.
|
| services.ndppd.proxies.<name>.rules.<name>.method | static: Immediately answer any Neighbor Solicitation Messages
(if they match the IP rule).
iface: Forward the Neighbor Solicitation Message through the specified
interface and only respond if a matching Neighbor Advertisement
Message is received.
auto: Same as iface, but instead of manually specifying the outgoing
interface, check for a matching route in /proc/net/ipv6_route.
|
| services.grafana.settings.server.cert_key | Path to the certificate key file (if protocol is set to https or h2).
|
| services.tlsrpt.reportd.settings.fetchers | Comma-separated list of fetcher programs that retrieve collectd data.
|
| services.litellm.settings.general_settings | LiteLLM Server settings
|
| services.litellm.settings.litellm_settings | LiteLLM Module settings
|
| services.gitlab.pages.settings | Configuration options to set in the GitLab Pages config
file
|
| networking.wireguard.interfaces.<name>.peers.*.name | Name used to derive peer unit name.
|
| services.i2pd.outTunnels.<name>.address | Bind address for ‹name› endpoint.
|
| services.nylon.<name>.enable | Enables nylon as a running service upon activation.
|
| services.postgrest.settings.admin-server-port | Specifies the port for the admin server, which can be used for healthchecks.
https://docs.postgrest.org/en/stable/references/admin_server.html#admin-server
|
| services.scion.scion-dispatcher.settings | scion-dispatcher configuration
|
| services.postsrsd.settings.socketmap | Listener configuration in socket map format native to Postfix configuration.
|
| services.fediwall.settings.loadFederated | Load federated posts
|
| services.immich-kiosk.settings.immich_url | URL of the immich instance.
|
| services.bluesky-pds.settings.PDS_DATA_DIRECTORY | Directory to store state
|
| services.clamav.fangfrisch.settings | fangfrisch configuration
|
| services.blackfire-agent.settings.server-id | Sets the server id used to authenticate with Blackfire
You can find your personal server-id at https://blackfire.io/my/settings/credentials
|
| services.autorandr.profiles.<name>.config.<name>.dpi | Output DPI configuration.
|
| services.sourcehut.settings."meta.sr.ht::aliases" | Aliases for the client IDs of commonly used OAuth clients.
|
| services.sourcehut.settings."meta.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."todo.sr.ht".api-origin | Origin URL for the API
|
| i18n.inputMethod.fcitx5.settings.addons | The addon configures in conf folder in ini format with global sections
|
| services.sourcehut.settings."man.sr.ht".oauth-client-id | man.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."git.sr.ht".oauth-client-id | git.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."hub.sr.ht".oauth-client-id | hub.sr.ht's OAuth client id for meta.sr.ht.
|
| services.listmonk.database.settings.smtp.*.port | Port for the SMTP server
|
| services.listmonk.database.settings.smtp.*.host | Hostname for the SMTP server
|
| services.xonotic.settings.maxplayers | Number of player slots on the server, including spectators.
|
| systemd.tmpfiles.settings | Declare systemd-tmpfiles rules to create, delete, and clean up volatile
and temporary files and directories
|
| networking.wireless.networks.<name>.extraConfig | Extra configuration lines appended to the network block
|
| services.journald.remote.settings.Remote.Seal | Periodically sign the data in the journal using Forward Secure
Sealing.
|
| services.sourcehut.settings."builds.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."builds.sr.ht".origin | URL builds.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."builds.sr.ht".debug-port | Port to bind the debug server to.
|
| services.go-csp-collector.settings.output-format | Define how the violation reports are formatted for output.
|
| services.knot-resolver.settings.network.listen | List of interfaces to listen to and its configuration.
|
| services.taler.merchant.settings.merchant.DB | Plugin to use for the database.
|
| services.taler.exchange.settings.exchange.DB | Plugin to use for the database.
|
| services.reposilite.settings.cachedLogSize | Amount of messages stored in the cache logger.
|
| services.warpgate.settings.log.retention | How long Warpgate keep its logs.
|
| services.szurubooru.database.name | Name of the PostgreSQL database.
|
| services.linkwarden.database.name | The name of the Linkwarden database.
|
| services.sourcehut.settings."todo.sr.ht::mail".sock | Path for the lmtp daemon's unix socket
|
| services.xserver.displayManager.gdm.settings | Options passed to the gdm daemon
|
| services.h2o.hosts.<name>.tls.port | Override the default TLS port for this virtual host.
|
| services.cryptpad.settings.websocketPort | Port for the websocket that needs to be separate
|
| services.filebrowser.settings.cache-dir | The directory where FileBrowser stores its cache.
|
| services.tor.settings.ControlPortFileGroupReadable | See torrc manual.
|
| services.reposilite.settings.enforceSsl | Whether to redirect all traffic to SSL.
|
| services.moosefs.cgiserver.settings.DATA_PATH | Directory for lock files.
|
| services.suricata.settings.threshold-file | Suricata threshold configuration file.
|
| services.tor.settings.ServerDNSDetectHijacking | See torrc manual.
|
| services.tor.settings.PaddingStatistics | See torrc manual.
|
| boot.initrd.network.ifstate.settings | Content of IfState's initrd configuration file
|
| services.syncthing.settings.folders | Folders which should be shared by Syncthing
|
| services.guacamole-client.settings | Configuration written to guacamole.properties.
The Guacamole web application uses one main configuration file called
guacamole.properties
|
| services.wg-access-server.settings.dns.enabled | Enable/disable the embedded DNS proxy server
|
| services.sharkey.settings.mediaDirectory | Path to the folder where Sharkey stores uploaded media such as images and attachments.
|
| services.slskd.settings.filters.search.request | Incoming search requests which match this filter are ignored.
|
| services.prometheus.xmpp-alerts.settings | Configuration for prometheus xmpp-alerts, see
https://github.com/jelmer/prometheus-xmpp-alerts/blob/master/xmpp-alerts.yml.example
for supported values.
|
| services.keycloak.settings | Configuration options corresponding to parameters set in
conf/keycloak.conf
|
| services.nebula-lighthouse-service.settings | Configuration for nebula-lighthouse-service.
|
| security.wrappers.<name>.program | The name of the wrapper program
|
| services.bitmagnet.settings.postgres.user | User to connect as
|
| services.writefreely.settings.app.theme | The theme to apply.
|
| services.opensnitch.settings.Rules.Path | Path to the directory where firewall rules can be found and will
get stored by the NixOS module.
|
| services.litellm.settings.model_list | List of supported models on the server, with model-specific configs.
|
| services.firefox-syncserver.settings.port | Port to bind to.
|
| services.taler.settings.taler.CURRENCY_ROUND_UNIT | Smallest amount in this currency that can be transferred using the underlying RTGS
|
| services.opengfw.settings.replay.realtime | Whether the packets in the PCAP file should be replayed in "real time" (instead of as fast as possible).
|
| services.sourcehut.settings."lists.sr.ht".notify-from | Outgoing email for notifications generated by users.
|
| services.autorandr.profiles.<name>.config.<name>.mode | Output resolution.
|
| services.autorandr.profiles.<name>.config.<name>.rate | Output framerate.
|
| services.gitea.settings.session.COOKIE_SECURE | Marks session cookies as "secure" as a hint for browsers to only send
them via HTTPS
|
| fileSystems.<name>.noCheck | Disable running fsck on this filesystem.
|
| systemd.units.<name>.text | Text of this systemd unit.
|
| services.akkoma.config.":pleroma".":instance".name | Instance name.
|
| services.mattermost.database.name | Local Mattermost database name.
|
| services.watchdogd.settings.interval | The kick interval, i.e. how often watchdogd(8) should reset the WDT timer.
|
| services.vmalert.settings."datasource.url" | Datasource compatible with Prometheus HTTP API.
|
| services.fediwall.settings.hideSensitive | Hide sensitive (potentially NSFW) posts
|
| services.openssh.settings.X11Forwarding | Whether to allow X11 connections to be forwarded.
|
| services.nextcloud-whiteboard-server.settings | Settings to configure backend server
|
| services.syncthing.settings.devices | Peers/devices which Syncthing should communicate with
|
| services.suricata.settings.stats.interval | The interval field (in seconds) controls the interval at
which stats are updated in the log.
|
| services.tor.settings.DirAllowPrivateAddresses | See torrc manual.
|
| services.tor.settings.AuthDirSharedRandomness | See torrc manual.
|
| services.suricata.settings.dpdk.eal-params.proc-type | dpdk eal-params.proc-type, see data plane development kit docs.
|
| services.postfix.masterConfig.<name>.command | A program name specifying a Postfix service/daemon process
|
| services.saunafs.metalogger.settings | Contents of metalogger config file (see sfsmetalogger.cfg(5)).
|
| services.grafana.settings.server.http_port | Listening port.
|
| services.healthchecks.settings.DB | Database engine to use.
|
| services.oncall.settings.oncall_host | FQDN for the Oncall instance.
|
| services.opensearch.settings."network.host" | Which port this service should listen on.
|
| services.syncthing.settings | Extra configuration options for Syncthing
|
| users.extraUsers.<name>.uid | The account UID
|
| services.keycloak.database.name | Database name to use when connecting to an external or
manually provisioned database; has no effect when a local
database is automatically provisioned
|
| services.evremap.settings.dual_role.*.tap | The key sequence that should be output when the input key is tapped
|
| services.sourcehut.settings."builds.sr.ht".allow-free | Whether to enable nonpaying users to submit builds.
|
| services.misskey.settings.redisForTimelines | ioredis options for timelines
|
| services.opensnitch.settings.Stats.MaxStats | Max stats per item to keep in backlog.
|
| environment.etc.<name>.target | Name of symlink (relative to
/etc)
|
| services.nginx.virtualHosts.<name>.locations.<name>.index | Adds index directive.
|
| services.nginx.virtualHosts.<name>.locations.<name>.alias | Alias directory for requests.
|
| services.amule.settings.ExternalConnect.ECPort | TCP port for external connections, like remote control via amule-gui
|
| services.gemstash.settings.base_path | Path to store the gem files and the sqlite database
|
| services.sourcehut.settings."hg.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.sourcehut.settings."lists.sr.ht".allow-new-lists | Whether to enable creation of new lists.
|
| services.sourcehut.settings."todo.sr.ht".oauth-client-id | todo.sr.ht's OAuth client id for meta.sr.ht.
|
| services.moosefs.cgiserver.settings.BIND_HOST | IP address to bind CGI server to.
|
| services.reposilite.settings.sslEnabled | Whether to listen for encrypted connections on settings.sslPort.
|
| services.scrutiny.settings.web.influxdb.token | Authentication token for connecting to InfluxDB.
|
| services.your_spotify.settings | Your Spotify Configuration
|
| services.wgautomesh.settings.peers.*.pubkey | Wireguard public key of this peer.
|
| services.hedgedoc.settings.protocolUseSSL | Use https:// for all links
|
| programs.neovim.runtime.<name>.target | Name of symlink
|
| services.radicle.ci.broker.settings.adapters | CI adapters
|
| networking.ifstate.settings | Content of IfState's configuration file
|
| services.szurubooru.server.settings.debug | Whether to generate server logs.
|
| services.neard.settings.General.DefaultPowered | Automatically turn an adapter on when being discovered.
|
| services.spacecookie.settings.log.level | Log level for the spacecookie service.
|
| services.warpgate.settings.postgres.enable | Whether to enable PostgreSQL listener.
|
| services.warpgate.settings.postgres.listen | Listen endpoint of PostgreSQL listener.
|
| services.homebridge.uiSettings.name | Name of the homebridge UI platform
|
| services.postfix-tlspol.settings.dns.address | IP and port to your DNS resolver
|
| services.immich.settings.newVersionCheck.enabled | Check for new versions
|
| services.sftpgo.settings.smtp.encryption | Encryption scheme:
0: No encryption
1: TLS
2: STARTTLS
|
| services.tor.settings.DormantCanceledByStartup | See torrc manual.
|
| services.tor.settings.DoSConnectionEnabled | See torrc manual.
|
| services.readarr.settings.update.mechanism | which update mechanism to use
|
| services.tor.settings.ExtORPortCookieAuthFileGroupReadable | See torrc manual.
|
| services.biboumi.settings.password | The password used to authenticate the XMPP component to your XMPP server
|
| services.quicktun.<name>.publicKey | Remote public key in hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| services.nsd.zones.<name>.data | The actual zone data
|
| services.autorandr.profiles.<name>.config.<name>.crtc | Output video display controller.
|
| services.acme-dns.settings.logconfig.loglevel | Level to log on.
|
| services.legit.settings.meta.description | Website description.
|
| services.sourcehut.settings."todo.sr.ht::mail".sock-group | The lmtp daemon will make the unix socket group-read/write
for users in this group.
|
| services.nsd.zones.<name>.dnssec | Whether to enable DNSSEC.
|
| services.postgrest.settings.server-unix-socket | Unix domain socket where to bind the PostgREST web server.
|
| services.firewalld.settings.LogDenied | Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type.
|
| containers.<name>.bindMounts.<name>.isReadOnly | Determine whether the mounted path will be accessed in read-only mode.
|
| services.sourcehut.settings."pages.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."lists.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."paste.sr.ht".api-origin | Origin URL for the API
|
| services.epgstation.database.name | Name of the MySQL database that holds EPGStation's data.
|
| services.sourcehut.settings."git.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.snapserver.settings.tcp.enabled | Whether to enable the TCP JSON-RPC.
|
| services.anuko-time-tracker.settings.emailRequired | Defines whether an email is required for new registrations.
|
| services.nipap.settings.nipapd.foreground | Remain in foreground rather than forking to background.
|
| services.matrix-synapse.settings.turn_uris | The public URIs of the TURN server to give to clients
|
| services.lokinet.settings.network.keyfile | The private key to persist address with
|
| services.stash.settings.stash_boxes | Stash-box facilitates automated tagging of scenes and performers based on fingerprints and filenames
|
| i18n.inputMethod.fcitx5.settings.inputMethod | The input method configure in profile file in ini format.
|
| services.libeufin.nexus.settings.nexus-ebics.HOST_BASE_URL | URL of the EBICS server.
|
| services.tlsrpt.reportd.settings.log_level | Level of log messages to emit.
|
| services.reposilite.settings.idleTimeout | Default idle timeout used by Jetty.
|
| services.tlsrpt.fetcher.settings.log_level | Level of log messages to emit.
|
| services.suricata.settings.stats.decoder-events | Add decode events to stats
|
| services.wastebin.settings.WASTEBIN_MAX_BODY_SIZE | Number of bytes to accept for POST requests
|
| services.sabnzbd.settings.misc.https_key | Path to the TLS key for the web UI
|
| services.postgrest.settings.server-host | Where to bind the PostgREST web server.
The admin server will also bind here, but potentially exposes sensitive information
|
| programs.openvpn3.log-service.settings.journald | Use systemd-journald
|
| services.sourcehut.settings."pages.sr.ht".user-domain | Configures the user domain, if enabled
|
| services.httpd.virtualHosts.<name>.locations.<name>.index | Adds DirectoryIndex directive
|
| services.httpd.virtualHosts.<name>.locations.<name>.alias | Alias directory for requests
|
| services.tor.settings.DoSCircuitCreationEnabled | See torrc manual.
|
| services.tor.settings.ServerTransportPlugin.exec | Command of pluggable transport.
|
| services.rosenpass.settings.verbosity | Verbosity of output produced by the service.
|
| services.postsrsd.settings.separator | SRS tag separator used in generated sender addresses
|
| services.routinator.settings.expire | An integer value specifying the number of seconds an RTR client is requested to use a data set if it cannot get an update before throwing it away and continuing with no data at all.
|
| services.postfix-tlspol.settings.server.address | Path or address/port where postfix-tlspol binds its socket to.
|
| services.matrix-conduit.settings.global.address | Address to listen on for connections by the reverse proxy/tls terminator.
|
| services.misskey.settings.redisForTimelines.port | The Redis port.
|
| services.misskey.settings.redisForTimelines.host | The Redis host.
|
| services.opensnitch.settings.Firewall | Which firewall backend to use.
|
| services.evremap.settings.dual_role.*.input | The key that should be remapped
|
| users.extraUsers.<name>.group | The user's primary group.
|
| services.pid-fan-controller.settings.fans.*.cutoff | Whether to stop the fan when minPwm is reached.
|
| services.lasuite-docs.settings.DJANGO_ALLOWED_HOSTS | Comma-separated list of hosts that are able to connect to the server
|
| services.lasuite-meet.settings.DJANGO_ALLOWED_HOSTS | Comma-separated list of hosts that are able to connect to the server
|
| services.veilid.settings.logging.system.enabled | Events of type 'system' will be logged.
|
| services.evremap.settings.dual_role.*.hold | The key sequence that should be output when the input key is held
|
| services.nginx.virtualHosts.<name>.locations.<name>.tryFiles | Adds try_files directive.
|
| systemd.network.networks.<name>.networkEmulatorConfig | Each attribute in this set specifies an option in the
[NetworkEmulator] section of the unit
|
| services.bind.zones.<name>.file | Zone file resource records contain columns of data, separated by whitespace, that define the record.
|
| services.taler.merchant.settings.merchant.PORT | Port on which the HTTP server listens.
|
| services.taler.exchange.settings.exchange.PORT | Port on which the HTTP server listens.
|
| services.watchdogd.settings.filenr.enabled | Whether to enable watchdogd plugin filenr.
|
| services.sslh.settings.transparent | Whether the services behind sslh (Apache, sshd and so on) will see the
external IP and ports as if the external world connected directly to
them.
|
| services.nginx.upstreams.<name>.servers.<name>.backup | Marks the server as a backup server
|
| services.kubo.settings.Addresses.API | Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on
|
| services.suricata.settings.af-xdp.*.interface | af-xdp capture interface, see upstream docs.
|
| services.sabnzbd.settings.misc.email_from | 'From:' field for emails (needs to be an address)
|
| services.szurubooru.server.settings.smtp.port | Port of the SMTP server.
|
| services.opensnitch.settings.Stats.MaxEvents | Max events to send to the GUI.
|
| services.pretalx.settings.filesystem.data | Base path for all other storage paths.
|
| services.libeufin.nexus.settings.nexus-ebics.USER_ID | User ID of the EBICS subscriber
|
| services.bacula-sd.director.<name>.tls.verifyPeer | Verify peer certificate
|
| services.bacula-fd.director.<name>.tls.verifyPeer | Verify peer certificate
|
| services.journald.upload.settings.Upload.URL | The URL to upload the journal entries to
|
| services.suricata.settings.pcap.*.interface | pcap capture interface, see upstream docs.
|
| services.crowdsec.settings.simulation | Attributes inside the simulation.yaml file.
|
| services.chhoto-url.settings.slug_length | The length of auto-generated slugs.
|
| services.chhoto-url.settings.public_mode | Whether to enable public mode.
|
| services.nvme-rs.settings.email.smtp_server | SMTP server address
|
| services.pinnwand.settings.paste_size | Maximum size of a paste in bytes.
|
| services.h2o.hosts.<name>.http.port | Override the default HTTP port for this virtual host.
|
| services.mautrix-whatsapp.settings | config.yaml configuration as a Nix attribute set
|
| services.wastebin.settings.WASTEBIN_BASE_URL | Base URL for the QR code display
|
| services.canaille.settings.CANAILLE_LDAP.BIND_PW | The LDAP bind password
|
| services.bitmagnet.settings.postgres.host | Address, hostname or Unix socket path of the database server
|
| services.immich.settings.server.externalDomain | Domain for publicly shared links, including http(s)://.
|
| services.matrix-conduit.settings.global.port | The port Conduit will be running on
|
| services.nezha-agent.settings.temperature | Enable temperature monitoring.
|
| services.nezha-agent.settings.disable_nat | Disable NAT penetration.
|
| services.your_spotify.settings.PORT | The port of the api server
|
| services.borgbackup.jobs.<name>.archiveBaseName | How to name the created archives
|
| security.loginDefs.settings.DEFAULT_HOME | Indicate if login is allowed if we can't cd to the home directory.
|
| services.lldap.settings.ldap_user_pass | Password for default admin password
|
| services.livekit.ingress.settings.redis.address | Address or hostname and port for redis connection
|
| services.mbpfan.settings.general.high_temp | If temperature is above this, fan speed will gradually increase.
|
| services.watchdogd.settings.filenr.warning | The high watermark level
|
| services.spacecookie.settings.root | The directory spacecookie should serve via gopher
|
| services.ferretdb.settings.FERRETDB_HANDLER | Backend handler
|
| services.autorandr.profiles.<name>.config.<name>.gamma | Output gamma configuration.
|
| services.sourcehut.settings."meta.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.sourcehut.settings."todo.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.sourcehut.settings."lists.sr.ht".oauth-client-id | lists.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."pages.sr.ht".oauth-client-id | pages.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."paste.sr.ht".oauth-client-id | paste.sr.ht's OAuth client id for meta.sr.ht.
|
| services.bookstack.settings.DB_PASSWORD_FILE | The file containing your mysql/mariadb database password.
|
| services.libeufin.bank.settings.libeufin-bank.PORT | The port on which libeufin-bank should listen.
|
| services.rosenpass.settings.peers.*.endpoint | Endpoint of the remote Rosenpass peer.
|
| services.szurubooru.server.settings.smtp.user | User to connect to the SMTP server.
|
| services.sabnzbd.settings.misc.email_full | Whether to send alerts for full disks
|
| services.snapserver.settings.http.enabled | Whether to enable the HTTP JSON-RPC.
|
| services.pgbouncer.settings.databases | Detailed information about PostgreSQL database definitions:
https://www.pgbouncer.org/config.html#section-databases
|
| nix.settings.auto-optimise-store | If set to true, Nix automatically detects files in the store that have
identical contents, and replaces them with hard links to a single copy
|
| services.geth.<name>.http.enable | Whether to enable Go Ethereum HTTP API.
|
| services.geth.<name>.network | The network to connect to
|
| services.froide-govplan.settings.ALLOWED_HOSTS | A list of valid fully-qualified domain names (FQDNs) and/or IP
addresses that can be used to reach the Froide-Govplan service.
|
| services.opengfw.settings.workers.tcpTimeout | How long a connection is considered dead when no data is being transferred
|
| services.nextcloud.settings.log_type | Logging backend to use.
systemd automatically adds the php-systemd extensions to services.nextcloud.phpExtraExtensions
|
| services.pretalx.settings.database.backend | Database backend to use
|
| services.openssh.settings.KexAlgorithms | Allowed key exchange algorithms
Uses the lower bound recommended in both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| security.loginDefs.settings.TTYPERM | The terminal permissions: the login tty will be owned by the TTYGROUP group,
and the permissions will be set to TTYPERM
|
| services.ferretdb.settings.FERRETDB_SQLITE_URL | SQLite URI (directory) for 'sqlite' handler
|
| services.lidarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.sonarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.suricata.settings.unix-command.enabled | Enable unix-command socket.
|
| services.radarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.matrix-tuwunel.settings.global.port | The port(s) tuwunel will be running on
|
| services.sourcehut.settings.mail.smtp-password | Outgoing SMTP password.
|
| services.reposilite.settings.debugEnabled | Whether to enable debug mode.
|
| services.tor.settings.ReachableAddresses | See torrc manual.
|
| services.privoxy.settings.filterfile | List of paths to Privoxy filter files
|
| services.grafana.settings.server.cert_file | Path to the certificate file (if protocol is set to https or h2).
|
| services.mchprs.settings.max_players | Maximum number of simultaneous players
|
| services.watchdogd.settings.filenr.logmark | Whether to log current stats every poll interval.
|
| services.grafana-image-renderer.settings.service.port | The TCP port to use for the rendering server.
|
| services.blackfire-agent.settings.server-token | Sets the server token used to authenticate with Blackfire
You can find your personal server-token at https://blackfire.io/my/settings/credentials
|
| services.pretalx.settings.filesystem.logs | Path to the log directory, that pretalx logs message to.
|
| services.veilid.settings.logging.terminal.level | The minimum priority of terminal events to be logged.
|
| systemd.network.networks.<name>.quickFairQueueingConfigClass | Each attribute in this set specifies an option in the
[QuickFairQueueingClass] section of the unit
|
| services.filebrowser.settings.address | The address to listen on.
|
| services.opensnitch.settings.Server.LogFile | File to write logs to (use /dev/stdout to write logs to standard
output).
|
| services.gitlab.pages.settings.artifacts-server | API URL to proxy artifact requests to.
|
| services.typesense.settings.server.api-address | Address to which Typesense API service binds.
|
| services.scrutiny.settings.web.influxdb.bucket | InfluxDB bucket in which to store data.
|
| services.grafana.settings.database.host | Only applicable to MySQL or Postgres
|
| services.canaille.settings.CANAILLE.SMTP | SMTP configuration
|
| containers.<name>.bindMounts.<name>.mountPoint | Mount point on the container file system.
|
| services.bitcoind.<name>.rpc.users.<name>.passwordHMAC | Password HMAC-SHA-256 for JSON-RPC connections
|
| services.cgit.<name>.extraConfig | These lines go to the end of cgitrc verbatim.
|
| systemd.services.<name>.preStop | Shell commands executed to stop the service.
|
| users.mysql.pam | Settings for pam_mysql
|
| services.spacecookie.settings.log.enable | Whether to enable logging for spacecookie.
|
| services.snapserver.settings.tcp-control.port | Port to listen on for snapclient connections.
|
| services.waagent.settings.OS.RootDeviceScsiTimeout | Configures the SCSI timeout in seconds on the OS disk and data drives
|
| power.ups.ups.<name>.driver | Specify the program to run to talk to this UPS. apcsmart,
bestups, and sec are some examples.
|
| services.headscale.settings.oidc.pkce.method | PKCE method to use:
- plain: Use plain code verifier
- S256: Use SHA256 hashed code verifier (default, recommended)
|
| services.neard.settings.General.ConstantPoll | Enable constant polling
|
| services.sourcehut.settings."pages.sr.ht".gemini-certs | An absolute file path (which should be outside the Nix-store)
to Gemini certificates.
|
| services.firefly-iii.settings.DB_CONNECTION | The type of database you wish to use
|
| services.etebase-server.settings.database.engine | The database engine to use.
|
| services.grafana-image-renderer.settings.server.addr | Listen address of the service.
|
| services.lemmy.settings.captcha.difficulty | The difficultly of the captcha to solve.
|
| services.tor.settings.ReachableORAddresses | See torrc manual.
|
| services.tor.settings.FetchHidServDescriptors | See torrc manual.
|
| services.pid-fan-controller.settings.heatSources | List of heat sources to be monitored.
|
| hardware.bluetooth.settings | Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf)
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.module | Optional PKCS#11 module name.
|
| services.scrutiny.collector.settings.host.id | Host ID for identifying/labelling groups of disks
|
| services.misskey.settings.meilisearch | Meilisearch connection options.
|
| services.transmission.settings.rpc-port | The RPC port to listen to.
|
| services.rauc.slots.<name>.*.device | The device to update.
|
| services.nylon.<name>.logging | Enable logging, default is no logging.
|
| services.scrutiny.settings.web.influxdb.scheme | URL scheme to use when connecting to InfluxDB.
|
| services.pinnwand.settings.paste_help | Raw HTML help text shown in the header area.
|
| services.waagent.settings.ResourceDisk.SwapSizeMB | Specifies the size of the swap file in MiB (1024×1024 bytes)
|
| services.lldap.settings.database_url | Database URL.
|
| services.lldap.settings.ldap_user_dn | Admin username
|
| services.stash.settings.plugins_path | Path to scrapers
|
| services.firefly-iii-data-importer.settings | Options for firefly-iii data importer configuration
|
| services.awstats.configs.<name>.domain | The domain name to collect stats for.
|
| services.sourcehut.settings."builds.sr.ht".api-origin | Origin URL for the API
|
| programs.openvpn3.netcfg.settings | Options stored in /etc/openvpn3/netcfg.json configuration file
|
| services.maubot.settings.server.public_url | Public base URL where the server is visible.
|
| services.matrix-synapse.settings.listeners.*.type | The type of the listener, usually http.
|
| services.firezone.server.web.settings | Environment variables for this component of the Firezone server
|
| services.firezone.server.api.settings | Environment variables for this component of the Firezone server
|
| services.umami.settings.DISABLE_TELEMETRY | Umami collects completely anonymous telemetry data in order help improve the application
|
| services.spacecookie.settings.log.hide-time | If enabled, spacecookie will not print timestamps
at the beginning of every log line.
|
| services.wastebin.settings.WASTEBIN_CACHE_SIZE | Number of rendered syntax highlight items to cache
|
| services.headscale.settings.dns.magic_dns | Whether to use MagicDNS.
|
| services.sftpgo.settings.webdavd.bindings.*.port | The port for serving WebDAV requests
|
| services.hedgedoc.settings.allowGravatar | Whether to enable Libravatar as
profile picture source on your instance
|
| services.szurubooru.server.settings.smtp.host | Host of the SMTP server used to send reset password.
|
| services.suricata.settings.vars.address-groups.HOME_NET | HOME_NET variable.
|
| services.tor.settings.KeyDirectoryGroupReadable | See torrc manual.
|
| services.umurmur.settings.welcometext | Welcome message for connected clients.
|
| services.tor.settings.ReachableDirAddresses | See torrc manual.
|
| services.moosefs.chunkserver.settings | Chunkserver configuration options (mfschunkserver.cfg).
|
| services.xonotic.settings.net_address | The address Xonotic will listen on.
|
| services.writefreely.settings.server.port | The port WriteFreely should listen on.
|
| services.spacecookie.settings.log.hide-ips | If enabled, spacecookie will hide personal
information of users like IP addresses from
log output.
|
| services.nginx.virtualHosts.<name>.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.grafana.settings.smtp.password | Password used for authentication
|
| services.gemstash.settings.db_adapter | Which database type to use
|
| security.acme.certs.<name>.domain | Domain to fetch certificate for (defaults to the entry name).
|
| services.sourcehut.settings."lists.sr.ht::worker".reject-url | Reject URL.
|
| services.geoipupdate.settings.AccountID | Your MaxMind account ID.
|
| services.healthchecks.settings.DEBUG | Enable debug mode.
|
| services.lldap.settings.ldap_base_dn | Base DN for LDAP.
|
| services.ax25.axports.<name>.tty | Location of hardware kiss tnc for this interface.
|
| services.znapzend.zetup.<name>.destinations.<name>.label | Label for this destination
|
| services.snapserver.settings.stream.source | One or multiple URIs to PCM input streams.
|
| services.matrix-synapse.settings.listeners.*.port | The port to listen for HTTP(S) requests on.
|
| services.matrix-synapse.settings.listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.public-inbox.settings.publicinbox | public inboxes
|
| services.postfix.settings.main.relayhost | List of hosts to use for relaying outbound mail.
Putting the hostname in angled brackets, e.g. [relay.example.com], turns off MX and SRV lookups for the hostname.
https://www.postfix.org/postconf.5.html#relayhost
|
| services.routinator.settings.rtr-listen | An array of string values each providing an address and port on which the RTR server should listen in TCP mode
|
| services.sourcehut.settings."lists.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.minidlna.settings.media_dir | Directories to be scanned for media files
|
| services.searx.settingsFile | The path of the Searx server settings.yml file
|
| services.pppd.peers.<name>.enable | Whether to enable this PPP peer.
|
| services.tts.servers.<name>.port | Port to bind the TTS server to.
|
| services.phpfpm.pools.<name>.user | User account under which this pool runs.
|
| systemd.services.<name>.wants | Start the specified units when this unit is started.
|
| services.botamusique.settings.server.port | Port of the mumble server to connect to.
|
| services.biboumi.settings.identd_port | The TCP port on which to listen for identd queries.
|
| services.botamusique.settings.server.host | Hostname of the mumble server to connect to.
|
| services.livekit.ingress.settings.rtmp_port | TCP port for RTMP connections
|
| services.livekit.ingress.settings.whip_port | TCP port for WHIP connections
|
| services.httpd.virtualHosts.<name>.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.anuko-time-tracker.settings.weekendStartDay | This option defines which days are highlighted with weekend color.
6 means Saturday
|
| services.routinator.settings.http-listen | An array of string values each providing an address and port on which the HTTP server should listen
|
| services.minidlna.settings.wide_links | Set this to yes to allow symlinks that point outside user-defined media_dir.
|
| services.matrix-synapse.settings.database.args.user | Username to connect with psycopg2, set to null
when using sqlite3.
|
| services.sourcehut.settings."sr.ht".network-key | An absolute file path (which should be outside the Nix-store)
to a secret key to encrypt internal messages with
|
| services.matrix-appservice-irc.settings.ircService | IRC bridge configuration
|
| services.pid-fan-controller.settings.interval | Interval between controller cycles in milliseconds.
|
| services.saunafs.metalogger.settings.DATA_PATH | Data storage directory
|
| services.tuned.settings.profile_dirs | Directories to search for profiles, separated by , or ;.
|
| services.tor.settings.ControlSocketsGroupWritable | See torrc manual.
|
| services.prowlarr.settings.update.mechanism | which update mechanism to use
|
| services.whisparr.settings.update.mechanism | which update mechanism to use
|
| systemd.services.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.autorandr.profiles.<name>.config.<name>.scale.y | Vertical scaling factor/pixels.
|
| services.autorandr.profiles.<name>.config.<name>.scale.x | Horizontal scaling factor/pixels.
|
| services.anuko-time-tracker.settings.multiorgMode | Defines whether users see the Register option in the menu of Time Tracker that allows them
to self-register and create new organizations (top groups).
|
| services.grafana.settings.users.home_page | Path to a custom home page
|
| services.sourcehut.settings.objects.s3-access-key | Access key to the S3-compatible object storage service
|
| services.szurubooru.server.settings.domain | Full URL to the homepage of this szurubooru site (with no trailing slash).
|
| services.crowdsec-firewall-bouncer.settings.mode | Firewall mode to use.
|
| security.agnos.settings.accounts.*.email | Email associated with this account.
|
| systemd.services.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.healthchecks.settingsFile | Environment variables which are read by healthchecks (local)_settings.py
|
| services.grafana.settings.server.http_addr | Listening address.
This setting intentionally varies from upstream's default to be a bit more secure by default.
|
| services.mchprs.settings.chat_format | How to format chat message interpolating username
and message with curly braces
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.module | Optional PKCS#11 module name.
|
| services.sourcehut.settings."builds.sr.ht".oauth-client-id | builds.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."hg.sr.ht".oauth-client-secret | hg.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.scrutiny.collector.settings.log.level | Log level for Scrutiny collector.
|
| services.watchdogd.settings.loadavg.enabled | Whether to enable watchdogd plugin loadavg.
|
| services.watchdogd.settings.meminfo.enabled | Whether to enable watchdogd plugin meminfo.
|
| services.autorandr.profiles.<name>.config.<name>.enable | Whether to enable the output.
|
| services.autorandr.profiles.<name>.config.<name>.rotate | Output rotate configuration.
|
| services.fedimintd.<name>.nginx.config.serverName | Name of this virtual host
|
| services.headscale.settings.oidc.client_id | OpenID Connect client ID.
|
| services.tlsrpt.collectd.settings.log_level | Level of log messages to emit.
|
| services.moosefs.metalogger.settings.DATA_PATH | Directory for storing metalogger data.
|
| services.watchdogd.settings.filenr.interval | Amount of seconds between every poll.
|
| fileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| programs.openvpn3.log-service.settings.log_level | How verbose should the logging be
|
| services.suricata.settings.app-layer.error-policy | The error-policy setting applies to all app-layer parsers
|
| services.tor.settings.DataDirectoryGroupReadable | See torrc manual.
|
| services.tor.settings.HiddenServiceNonAnonymousMode | See torrc manual.
|
| services.tor.settings.ConstrainedSockets | See torrc manual.
|
| boot.initrd.systemd.settings.Manager | Options for the global systemd service manager used in initrd
|
| services.buffyboard.settings.input.pointer | Enable or disable the use of a hardware mouse or other pointing device.
|
| services.parsedmarc.settings.mailbox.watch | Use the IMAP IDLE command to process messages as they arrive.
|
| services.suricata.settings.app-layer.protocols | app-layer protocols, see upstream docs.
|
| services.ocsinventory-agent.settings.tag | Tag for the generated inventory.
|
| services.bind.zones.<name>.master | Master=false means slave server
|
| services.bind.zones.<name>.slaves | Addresses who may request zone transfers.
|
| services.nsd.zones.<name>.minRetrySecs | Limit retry time for secondary zones.
|
| services.rauc.slots.<name>.*.enable | Whether to enable this RAUC slot.
|
| systemd.network.networks.<name>.controlledDelayConfig | Each attribute in this set specifies an option in the
[ControlledDelay] section of the unit
|
| services.angrr.settings.temporary-root-policies | Policies for temporary GC roots(e.g. result and direnv).
|
| services.watchdogd.settings.loadavg.warning | The high watermark level
|
| services.watchdogd.settings.meminfo.warning | The high watermark level
|
| services.homebridge.settings.platforms | Homebridge Platforms
|
| services.open-web-calendar.settings.ALLOWED_HOSTS | The hosts that the Open Web Calendar permits
|
| services.sourcehut.settings."git.sr.ht".oauth-client-secret | git.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."hub.sr.ht".oauth-client-secret | hub.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."man.sr.ht".oauth-client-secret | man.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.fastnetmon-advanced.traffic_db.settings | Additional settings for /etc/fastnetmon/traffic_db.conf
|
| services.forgejo.settings.session.COOKIE_SECURE | Marks session cookies as "secure" as a hint for browsers to only send
them via HTTPS
|
| services.peering-manager.settings.ALLOWED_HOSTS | A list of valid fully-qualified domain names (FQDNs) and/or IP
addresses that can be used to reach the peering manager service.
|
| services.grafana.settings.server.cdn_url | Specify a full HTTP URL address to the root of your Grafana CDN assets
|
| services.hickory-dns.settings.listen_port | Port to listen on (applies to all listen addresses).
|
| services.transmission.settings.peer-port | The peer port to listen for incoming connections.
|
| services.readarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.warpgate.settings.recordings.path | Path to store session recordings.
|
| services.ax25.axports.<name>.baud | The serial port speed of this interface.
|
| services.sourcehut.settings."lists.sr.ht::worker".sock | Path for the lmtp daemon's unix socket
|
| services.postfix-tlspol.settings.server.prefetch | Whether to prefetch DNS records when the TTL of a cached record is about to expire.
|
| services.botamusique.settings.bot.comment | Comment displayed for the bot.
|
| services.tor.settings.ExtendAllowPrivateAddresses | See torrc manual.
|
| services.sabnzbd.settings.misc.html_login | Prompt for login with an html login mask if enabled,
otherwise prompt for basic auth (useful for SSO)
|
| containers.<name>.flake | The Flake URI of the NixOS configuration to use for the container
|
| services.netbird.tunnels.<name>.user.group | A system group name for this client instance.
|
| services.netbird.clients.<name>.user.group | A system group name for this client instance.
|
| services.pds.settings.PDS_BLOBSTORE_DISK_LOCATION | Store blobs at this location, set to null to use e.g
|
| services.umurmur.settings.certificate | Path to your SSL certificate
|
| services.umurmur.settings.private_key | Path to your SSL key
|
| services.saunafs.chunkserver.settings | Contents of chunkserver config file (see sfschunkserver.cfg(5)).
|
| services.watchdogd.settings.loadavg.logmark | Whether to log current stats every poll interval.
|
| services.watchdogd.settings.meminfo.logmark | Whether to log current stats every poll interval.
|
| systemd.network.networks.<name>.stochasticFairBlueConfig | Each attribute in this set specifies an option in the
[StochasticFairBlue] section of the unit
|
| services.sourcehut.settings."lists.sr.ht".posting-domain | Posting domain.
|
| services.hddfancontrol.settings | Parameter-sets for each instance of hddfancontrol.
|
| services.wastebin.settings.WASTEBIN_ADDRESS_PORT | Address and port to bind to
|
| services.nginx.virtualHosts.<name>.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.nginx.virtualHosts.<name>.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.reposilite.settings.database | Database connection string
|
| services.hercules-ci-agent.settings.baseDirectory | State directory (secrets, work directory, etc) for agent
|
| programs.openvpn3.log-service.settings.timestamp | Add timestamp log file
|
| services.sourcehut.settings."builds.sr.ht".shell | Scripts used to launch on SSH connection.
/usr/bin/master-shell on master,
/usr/bin/runner-shell on runner
|
| services.redis.servers.<name>.logfile | Specify the log file name
|
| services.nsd.keys.<name>.keyFile | Path to the file which contains the actual base64 encoded
key
|
| services.doh-server.settings.upstream | Upstream DNS resolver
|
| services.snapserver.settings.http.doc_root | Path to serve from the HTTP servers root.
|
| services.stash.settings.stash_boxes.*.apikey | Stash Box API key
|
| services.phpfpm.pools.<name>.phpEnv | Environment variables used for this PHP-FPM pool.
|
| services.buffyboard.settings.theme.default | Selects the default theme on boot
|
| services.grafana.settings.users.login_hint | Text used as placeholder text on login page for login/username input.
|
| services.suricata.settings.logging.outputs.file.type | Type of logfile.
|
| services.misskey.settings.meilisearch.ssl | Whether to connect via SSL.
|
| services.kerberos_server.settings | Settings for the kerberos server of choice
|
| services.fastnetmon-advanced.settings | Extra configuration options to declaratively load into FastNetMon Advanced
|
| services.sabnzbd.settings.misc.https_cert | Path to the TLS certificate for the web UI
|
| services.matrix-synapse.settings.listeners.*.tls | Whether to enable TLS on the listener socket.
This option will be ignored for UNIX domain sockets.
|
| services.netbird.tunnels.<name>.dir.baseName | A systemd service name to use (without .service suffix).
|
| services.netbird.clients.<name>.dir.baseName | A systemd service name to use (without .service suffix).
|
| services.bitcoind.<name>.user | The user as which to run bitcoind.
|
| services.geth.<name>.syncmode | Blockchain sync mode.
|
| services.geth.<name>.maxpeers | Maximum peers to connect to.
|
| services.i2pd.inTunnels.<name>.type | Tunnel type.
|
| services.opensnitch.settings.Ebpf.ModulesPath | Configure eBPF modules path
|
| services.hercules-ci-agent.settings.labels | A key-value map of user data
|
| services.headscale.settings.server_url | The url clients will connect to.
|
| services.acme-dns.settings.database.connection | Database connection string.
|
| services.tor.settings.HiddenServiceStatistics | See torrc manual.
|
| services.tor.settings.PublishServerDescriptor | See torrc manual.
|
| services.tor.settings.FetchServerDescriptors | See torrc manual.
|
| services.suricata.settings.reference-config-file | Suricata reference configuration file.
|
| services.writefreely.database.name | The name of the database to store data in.
|
| services.matrix-appservice-irc.settings.database | Configuration for the database
|
| services.sourcehut.settings."git.sr.ht".outgoing-domain | Outgoing domain.
|
| services.sourcehut.settings."todo.sr.ht::mail".posting-domain | Posting domain.
|
| services.languagetool.settings.cacheSize | Number of sentences cached.
|
| services.maubot.settings.api_features | API feature switches.
|
| services.misskey.settings.meilisearch.host | The Meilisearch host.
|
| services.misskey.settings.meilisearch.port | The Meilisearch port.
|
| services.routinator.settings.refresh | An integer value specifying the number of seconds Routinator should wait between consecutive validation runs in server mode
|
| services.pocket-id.settings.ANALYTICS_DISABLED | Whether to disable analytics
|
| services.hercules-ci-agent.settings.secretsJsonPath | Path to a JSON file containing secrets for effects
|
| services.sourcehut.settings."todo.sr.ht".oauth-client-secret | todo.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.transmission.settings.watch-dir | Watch a directory for torrent files and add them to transmission.
|
| services.parsedmarc.settings.mailbox.delete | Delete messages after processing them, instead of archiving them.
|
| services.pretalx.settings.filesystem.static | Path to the directory that contains static files.
|
| services.rkvm.server.settings.certificate | TLS certificate path.
This should be generated with rkvm-certificate-gen.
|
| services.szurubooru.server.settings.smtp.passFile | File containing the password associated to the given user for the SMTP server.
|
| services.rkvm.client.settings.certificate | TLS ceritficate path.
This should be generated with rkvm-certificate-gen.
|
| services.globalprotect.settings | GlobalProtect-openconnect configuration
|
| services.canaille.settings.PREFERRED_URL_SCHEME | The url scheme by which canaille will be served.
|
| services.grafana-image-renderer.settings.browser.path | Path to the executable of the chromium to use.
|
| services.sourcehut.settings."meta.sr.ht".welcome-emails | Whether to enable sending stock sourcehut welcome emails after signup.
|
| services.epgstation.settings.socketioPort | Socket.io port for EPGStation to listen on
|
| services.mautrix-discord.settings.appservice | Appservice configuration
|
| services.tor.settings.CacheDirectoryGroupReadable | See torrc manual.
|
| services.misskey.settings.meilisearch.apiKey | The Meilisearch API key.
|
| services.borgbackup.jobs.<name>.startAt | When or how often the backup should run
|
| services.sourcehut.settings."git.sr.ht".post-update-script | A post-update script which is installed in every git repo
|
| services.taler.merchant.settings.merchant.SERVE | Whether the HTTP server should listen on a UNIX domain socket ("unix") or on a TCP socket ("tcp").
|
| services.wgautomesh.settings.peers.*.address | Wireguard address of this peer (a single IP address, multiple
addresses or address ranges are not supported).
|
| services.yggdrasil.settings.AllowedPublicKeys | List of peer public keys to allow incoming peering connections from
|
| systemd.services.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.network.networks.<name>.hierarchyTokenBucketConfig | Each attribute in this set specifies an option in the
[HierarchyTokenBucket] section of the unit
|
| services.opensnitch.settings.DefaultAction | Default action whether to block or allow application internet
access.
|
| services.journald.remote.settings.Remote.SplitMode | With "host", a separate output file is used, based on the
hostname of the other endpoint of a connection
|
| services.sftpgo.settings.ftpd.bindings.*.address | Network listen address
|
| services.cryptpad.settings.blockDailyCheck | Disable telemetry
|
| services.sourcehut.settings."lists.sr.ht::worker".sock-group | The lmtp daemon will make the unix socket group-read/write
for users in this group.
|
| users.extraGroups.<name>.gid | The group GID
|
| services.h2o.hosts.<name>.acme.root | Directory for the ACME challenge, which is public
|
| services.gitwatch.<name>.path | The path to repo in local machine
|
| services.anuko-time-tracker.settings.email.smtpPasswordFile | Path to file containing the MTA authentication password.
|
| services.omnom.settings.activitypub.pubkey | ActivityPub public key
|
| security.loginDefs.settings.TTYGROUP | The terminal permissions: the login tty will be owned by the TTYGROUP group,
and the permissions will be set to TTYPERM
|
| services.nginx.virtualHosts.<name>.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.mackerel-agent.settings.diagnostic | Whether to enable collecting memory usage for the agent itself.
|
| networking.wireless.networks.<name>.authProtocols | The list of authentication protocols accepted by this network
|
| services.scrutiny.settings.web.listen.basepath | If Scrutiny will be behind a path prefixed reverse proxy, you can override this
value to serve Scrutiny on a subpath.
|
| systemd.services.<name>.postStop | Shell commands executed after the service's main process
has exited.
|
| power.ups.ups.<name>.summary | Lines which would be added inside ups.conf for handling this UPS.
|
| services.hercules-ci-agent.settings.workDirectory | The directory in which temporary subdirectories are created for task state
|
| services.grafana.settings.smtp.skip_verify | Verify SSL for SMTP server.
|
| services.suwayomi-server.settings.server.localSourcePath | Path to the local source folder.
|
| services.sourcehut.settings.objects.s3-secret-key | An absolute file path (which should be outside the Nix-store)
to the secret key of the S3-compatible object storage service.
|
| services.i2pd.outTunnels.<name>.type | Tunnel type.
|
| services.rspamd.locals.<name>.text | Text of the file.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.module | Optional PKCS#11 module name.
|
| services.filebrowser.settings.database | The path to FileBrowser's Bolt database.
|
| services.opensnitch.settings.ProcMonitorMethod | Which process monitoring method to use.
|
| services.yggdrasil.settings.PrivateKeyPath | Path to the private key file on the host system
|
| security.pam.u2f.settings.origin | By default pam-u2f module sets the origin
to pam://$HOSTNAME
|
| i18n.inputMethod.fcitx5.settings.globalOptions | The global options in config file in ini format.
|
| services.netbird.clients.<name>.bin.suffix | A system group name for this client instance.
|
| services.netbird.tunnels.<name>.bin.suffix | A system group name for this client instance.
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.sourcehut.settings."sr.ht".service-key | An absolute file path (which should be outside the Nix-store)
to a key used for encrypting session cookies
|
| services.listmonk.database.settings.smtp.*.enabled | Whether to enable this SMTP server for listmonk.
|
| services.schleuder.settings.keyserver | Key server from which to fetch and update keys
|
| services.ocsinventory-agent.settings | Configuration for /etc/ocsinventory-agent/ocsinventory-agent.cfg
|
| services.openafsServer.roles.backup.cellServDB.<name>.*.dnsname | DNS full-qualified domain name of a database server
|
| services.sourcehut.settings."hg.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.headscale.settings.database.type | Database engine to use
|
| services.headscale.settings.prefixes.v6 | Each prefix consists of either an IPv4 or IPv6 address,
and the associated prefix length, delimited by a slash
|
| services.headscale.settings.prefixes.v4 | Each prefix consists of either an IPv4 or IPv6 address,
and the associated prefix length, delimited by a slash
|
| services.watchdogd.settings.filenr.critical | The critical watermark level
|
| systemd.paths.<name>.wants | Start the specified units when this unit is started.
|
| services.ocsinventory-agent.settings.ca | Path to CA certificates file in PEM format, for server
SSL certificate validation.
|
| services.swapspace.settings.cooldown | Duration (roughly in seconds) of the moratorium on swap allocation that is instated if disk space runs out, or the cooldown time after a new swapfile is successfully allocated before swapspace will consider deallocating swap space again
|
| services.reposilite.settings.keyPath | Path to the .jsk KeyStore or paths to the PKCS#8 certificate and private key, separated by a space (see example)
|
| services.sourcehut.settings."meta.sr.ht::billing".enabled | Whether to enable the billing system.
|
| services.omnom.settings.smtp.send_timeout | Send timeout duration in seconds.
|
| services.watchdogd.settings.loadavg.interval | Amount of seconds between every poll.
|
| services.watchdogd.settings.meminfo.interval | Amount of seconds between every poll.
|
| services.thanos.query.grpc-client-server-name | Server name to verify the hostname on the returned gRPC certificates
|
| services.bitcoind.<name>.port | Override the default port on which to listen for connections.
|
| services.i2pd.inTunnels.<name>.keys | Keyset used for tunnel identity.
|
| services.phpfpm.pools.<name>.group | Group account under which this pool runs.
|
| nix.registry.<name>.flake | The flake input from is rewritten to.
|
| services.slskd.settings.shares.directories | Paths to shared directories
|
| services.tor.settings.AuthDirHasIPv6Connectivity | See torrc manual.
|
| services.suricata.settings.vars.address-groups.DNP3_SERVER | DNP3_SERVER variable.
|
| services.suricata.settings.vars.address-groups.DNP3_CLIENT | DNP3_CLIENT variable.
|
| services.matrix-tuwunel.settings.global.address | Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator
|
| systemd.network.networks.<name>.trivialLinkEqualizerConfig | Each attribute in this set specifies an option in the
[TrivialLinkEqualizer] section of the unit
|
| containers.<name>.extraVeths.<name>.hostBridge | Put the host-side of the veth-pair into the named bridge
|
| services.privoxy.settings.actionsfile | List of paths to Privoxy action files
|
| services.firewalld.settings.CleanupModulesOnExit | Whether to unload all firewall-related kernel modules when firewalld stops.
|
| services.matrix-continuwuity.settings | Generates the continuwuity.toml configuration file
|
| services.filesender.settings.site_url | Site URL
|
| services.epgstation.settings.mirakurunPath | URL to connect to Mirakurun.
|
| services.opensearch.settings."discovery.type" | The type of discovery to use.
|
| services.misskey.settings.meilisearch.scope | The search scope.
|
| users.users.<name>.extraGroups | The user's auxiliary groups.
|
| services.bacula-sd.autochanger.<name>.changerDevice | The specified name-string must be the generic SCSI device name of the
autochanger that corresponds to the normal read/write Archive Device
specified in the Device resource
|
| security.loginDefs.settings.ENCRYPT_METHOD | This defines the system default encryption algorithm for encrypting passwords.
|
| services.suricata.settings.af-packet.*.interface | af-packet capture interface, see upstream docs reagrding tuning.
|
| services.prosody.virtualHosts.<name>.domain | Domain name
|
| systemd.services.<name>.path | Packages added to the service's PATH
environment variable
|
| services.sourcehut.settings."git.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."man.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."hub.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.slskd.settings.retention.files.complete | Lifespan of completely downloaded files in minutes.
|
| services.veilid.settings.logging.terminal.enabled | Events of type 'terminal' will be logged.
|
| services.httpd.virtualHosts.<name>.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.nginx.virtualHosts.<name>.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.znapzend.zetup.<name>.destinations.<name>.dataset | Dataset name to send snapshots to.
|
| security.krb5.settings.includedir | Directories containing files to include in the Kerberos configuration.
|
| services.maubot.settings.homeservers | Known homeservers
|
| virtualisation.interfaces.<name>.name | Interface name
|
| boot.initrd.systemd.tmpfiles.settings | Similar to systemd.tmpfiles.settings but the rules are
only applied by systemd-tmpfiles before initrd-switch-root.target
|
| services.sourcehut.settings."lists.sr.ht".oauth-client-secret | lists.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."paste.sr.ht".oauth-client-secret | paste.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."pages.sr.ht".oauth-client-secret | pages.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.headscale.settings.database.sqlite.path | Path to the sqlite3 database file.
|
| services.immichframe.settings.Accounts | Accounts configuration, multiple are permitted
|
| services.radicle.ci.broker.settings.triggers.*.filters | Trigger filter.
|
| services.nextcloud-spreed-signaling.settings | Declarative configuration
|
| services.autorandr.profiles.<name>.config.<name>.primary | Whether output should be marked as primary
|
| services.grafana.settings.database.ssl_mode | For Postgres, use either disable, require or verify-full
|
| services.geth.<name>.metrics.port | Port number of Go Ethereum metrics service.
|
| services.geth.<name>.http.address | Listen address of Go Ethereum HTTP API.
|
| systemd.services.<name>.preStart | Shell commands executed before the service's main process
is started.
|
| services.bitcoind.<name>.dataDir | The data directory for bitcoind.
|
| services.rsync.jobs.<name>.sources | Source directories.
|
| services.pppd.peers.<name>.config | pppd configuration for this peer, see the pppd(8) man page.
|
| services.h2o.hosts.<name>.tls.quic | Enables HTTP/3 over QUIC on the UDP port for TLS
|
| services.wastebin.settings.WASTEBIN_HTTP_TIMEOUT | Maximum number of seconds a request can be processed until wastebin responds with 408
|
| services.glitchtip.settings.GLITCHTIP_DOMAIN | The URL under which GlitchTip is externally reachable.
|
| services.tor.settings.PublishHidServDescriptors | See torrc manual.
|
| services.misskey.settings.meilisearch.index | Meilisearch index to use.
|
| services.tor.settings.MaxAdvertisedBandwidth | See torrc manual.
|
| services.opensearch.settings."transport.port" | The port to listen on for transport traffic.
|
| services.ocsinventory-agent.settings.debug | Whether to enable debug mode.
|
| services.hercules-ci-agent.settings.binaryCachesPath | Path to a JSON file containing binary cache secret keys
|
| services.reposilite.settings.ioThreadPool | The IO thread pool handles all tasks that may benefit from non-blocking IO. (min: 2)
Because most tasks are redirected to IO thread pool, it might be a good idea to keep it at least equal to web thread pool.
|
| systemd.paths.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.pretix.settings.memcached.location | The host:port combination or the path to the UNIX socket of a memcached instance
|
| services.garage.settings.metadata_dir | The metadata directory, put this on a fast disk (e.g
|
| services.radicle.ci.broker.settings.report_dir | Directory where HTML and JSON report pages are written.
|
| systemd.user.services.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.sftpgo.settings.sftpd.bindings.*.address | Network listen address
|
| services.sftpgo.settings.httpd.bindings.*.address | Network listen address
|
| services.reposilite.settings.webThreadPool | Maximum amount of threads used by the core thread pool. (min: 5)
The web thread pool handles the first few steps of incoming HTTP connections, tasks are redirected as soon as possible to the IO thread pool.
|
| services.suricata.settings.logging.outputs.file.level | Loglevel for logs written to the logfile.
|
| services.autosuspend.checks.<name>.class | Name of the class implementing the check
|
| services.waagent.settings.ResourceDisk.EnableSwap | If enabled, the agent creates a swap file (/swapfile) on the resource disk
and adds it to the system swap space
|
| services.firezone.server.settingsSecret | This is a convenience option which allows you to set secret values for
environment variables by specifying a file which will contain the value
at runtime
|
| services.mautrix-discord.settings.homeserver | fullDataDiration
|
| services.kanidm.server.settings.bindaddress | Address/port combination the webserver binds to.
|
| services.k3s.autoDeployCharts.<name>.package | The packaged Helm chart
|
| services.epgstation.settings.encodeProcessNum | The maximum number of processes that EPGStation would allow to run
at the same time for encoding or streaming videos.
|
| services.suwayomi-server.settings.server.downloadAsCbz | Download chapters as .cbz files.
|
| services.prowlarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.whisparr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.firezone.server.domain.settings | Environment variables for this component of the Firezone server
|
| services.i2pd.outTunnels.<name>.keys | Keyset used for tunnel identity.
|
| services.libeufin.nexus.settings.nexus-ebics.PARTNER_ID | Partner ID of the EBICS subscriber
|
| services.bitmagnet.settings.dht_server.port | DHT listen port
|
| services.tor.settings.FetchUselessDescriptors | See torrc manual.
|
| services.suricata.settings.vars.address-groups.ENIP_CLIENT | ENIP_CLIENT variable.
|
| services.tlsrpt.collectd.settings.socketmode | Permissions on the UNIX socket.
|
| services.suricata.settings.vars.address-groups.ENIP_SERVER | ENIP_SERVER variable.
|
| services.szurubooru.server.settings.data_dir | Path to the static files.
|
| services.waagent.settings.ResourceDisk.MountPoint | This option specifies the path at which the resource disk is mounted
|
| nix.registry.<name>.to | The flake reference from is rewritten to
|
| users.users.<name>.enable | If set to false, the user account will not be created
|
| nix.settings.substituters | List of binary cache URLs used to obtain pre-built binaries
of Nix packages
|
| services.szurubooru.server.settings.secretFile | File containing a secret used to salt the users' password hashes and generate filenames for static content.
|
| services.geth.<name>.authrpc.port | Port number of Go Ethereum Auth RPC API.
|
| services.tts.servers.<name>.useCuda | Whether to offload computation onto a CUDA compatible GPU.
|
| containers.<name>.extraVeths.<name>.hostAddress | The IPv4 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| services.minidlna.settings.enable_tivo | Support for streaming .jpg and .mp3 files to a TiVo supporting HMO.
|
| services.gvpe.nodename | GVPE node name
|
| services.opensnitch.settings.Server.Address | Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
mandatory) or TCP socket (192.168.1.100:50051).
|
| services.sourcehut.settings.objects.s3-upstream | Configure the S3-compatible object storage service.
|
| services.sourcehut.settings."meta.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."todo.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| virtualisation.allInterfaces.<name>.name | Interface name
|
| services.bitcoind.<name>.pidFile | Location of bitcoind pid file.
|
| services.grafana.settings.server.root_url | This is the full URL used to access Grafana from a web browser
|
| services.swapspace.settings.freetarget | Percentage of free space swapspace should aim for when adding swapspace
|
| services.wgautomesh.settings.interface | Wireguard interface to manage (it is NOT created by wgautomesh, you
should use another NixOS option to create it such as
networking.wireguard.interfaces.wg0 = {...};).
|
| services.wgautomesh.settings.peers.*.endpoint | Bootstrap endpoint for connecting to this Wireguard peer if no
other address is known or none are working.
|
| services.sourcehut.settings."builds.sr.ht::worker".timeout | Max build duration
|
| networking.wireless.iwd.settings | Options passed to iwd
|
| systemd.user.units.<name>.text | Text of this systemd unit.
|
| services.szurubooru.server.settings.data_url | Full URL to the data endpoint.
|
| services.warpgate.settings.recordings.enable | Whether to enable session recording.
|
| systemd.network.networks.<name>.dhcpPrefixDelegationConfig | Each attribute in this set specifies an option in the
[DHCPPrefixDelegation] section of the unit
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.slot | Optional slot number of the token that stores the certificate.
|
| services.bitcoind.<name>.group | The group as which to run bitcoind.
|
| services.draupnir.settings.homeserverUrl | Base URL of the Matrix homeserver that provides the Client-Server API.
|
| services.tor.settings.ExitPolicyRejectLocalInterfaces | See torrc manual.
|
| services.tor.settings.ConnDirectionStatistics | See torrc manual.
|
| services.kanidm.unix.settings.hsm_pin_path | Path to a HSM pin.
|
| ec2.zfs.datasets.<name>.mount | Where to mount this dataset.
|
| services.netbird.clients | Attribute set of NetBird client daemons, by default each one will:
- be manageable using dedicated tooling:
netbird-<name> script,
NetBird - netbird-<name> graphical interface when appropriate (see ui.enable),
- run as a
netbird-<name>.service,
- listen for incoming remote connections on the port
51820 (openFirewall by default),
- manage the
netbird-<name> wireguard interface,
- use the /var/lib/netbird-/config.json configuration file,
- override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json,
- (
hardened) be locally manageable by netbird-<name> system group,
With following caveats:
- multiple daemons will interfere with each other's DNS resolution of
netbird.cloud, but
should remain fully operational otherwise
|
| services.tinyproxy.settings.Anonymous | If an Anonymous keyword is present, then anonymous proxying is enabled
|
| services.postfix.networksStyle | Name of standard way of trusted network specification to use,
leave blank if you specify it explicitly or if you want to use
default (localhost-only).
|
| services.anuko-time-tracker.settings.defaultCurrency | Defines a default currency symbol for new groups
|
| services.rke2.autoDeployCharts.<name>.package | The packaged Helm chart
|
| <imports = [ pkgs.php.services.default ]>.php-fpm.settings.log_level | Error log level.
|
| services.adguardhome.settings | AdGuard Home configuration
|
| systemd.user.services.<name>.preStop | Shell commands executed to stop the service.
|
| systemd.services.<name>.script | Shell commands executed as the service's main process.
|
| programs.tsmClient.servers.<name>.nodename | Target node name on the IBM TSM server.
|
| services.omnom.settings.activitypub.privkey | ActivityPub private key
|
| services.stash.settings.scrapers_path | Path to scrapers
|
| services.stash.settings.blobs_storage | Where to store blobs
|
| services.i2pd.inTunnels.<name>.inbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| containers.<name>.extraVeths.<name>.hostAddress6 | The IPv6 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| services.webhook.hooks.<name>.id | The ID of your hook
|
| services.szurubooru.server.settings.show_sql | Whether to show SQL in server logs.
|
| networking.wireless.networks.<name>.priority | By default, all networks will get same priority group (0)
|
| services.fedimintd.<name>.nginx.config.locations.<name>.root | Root directory for requests.
|
| services.autorandr.profiles.<name>.config.<name>.scale.method | Output scaling method.
|
| fileSystems.<name>.fsType | Type of the file system
|
| services.headscale.settings.oidc.pkce.enabled | Enable or disable PKCE (Proof Key for Code Exchange) support
|
| services.saunafs.chunkserver.settings.DATA_PATH | Directory for chunck meta data
|
| users.users.<name>.cryptHomeLuks | Path to encrypted luks device that contains
the user's home directory.
|
| services.drupal.sites.<name>.filesDir | The location of the Drupal files directory.
|
| boot.initrd.luks.devices.<name>.header | The name of the file or block device that
should be used as header for the encrypted device.
|
| services.suricata.settings.vars.address-groups.DC_SERVERS | DC_SERVERS variable.
|
| services.tor.settings.GuardfractionFile | See torrc manual.
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.stash.settings.stash.*.excludevideo | Whether to exclude video files from being scanned into Stash
|
| services.stash.settings.stash.*.excludeimage | Whether to exclude image files from being scanned into Stash
|
| users.users.<name>.shell | The path to the user's shell
|
| systemd.services.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.prometheus.exporters.ping.settings | Configuration for ping_exporter, see
https://github.com/czerwonk/ping_exporter
for supported values.
|
| services.waagent.settings.AutoUpdate.UpdateToLatestVersion | Whether or not to enable auto-update of the Extension Handler.
|
| services.nix-store-gcs-proxy.<name>.enable | Whether to enable proxy for this bucket
|
| services.geoipupdate.settings.EditionIDs | List of database edition IDs
|
| services.parsedmarc.settings.imap.password | The IMAP server password
|
| services.parsedmarc.settings.smtp.password | The SMTP server password
|
| services.reposilite.settings.keyPassword | Plaintext password used to unlock the Java KeyStore set in services.reposilite.settings.keyPath
|
| services.suricata.settings.stats.decoder-events-prefix | Decoder event prefix in stats
|
| services.watchdogd.settings.loadavg.critical | The critical watermark level
|
| services.watchdogd.settings.meminfo.critical | The critical watermark level
|
| services.sourcehut.settings."builds.sr.ht".oauth-client-secret | builds.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.moosefs.chunkserver.settings.DATA_PATH | Directory for lock files and other runtime data.
|
| services.snapserver.settings.tcp-control.enabled | Whether to enable the TCP JSON-RPC.
|
| services.anubis.defaultOptions.settings.BIND_NETWORK | The network family that Anubis should bind to
|
| services.i2pd.inTunnels.<name>.inPort | Service port
|
| systemd.services.<name>.postStart | Shell commands executed after the service's main process
is started.
|
| systemd.services.<name>.reload | Shell commands executed when the service's main process
is reloaded.
|
| services.snapserver.settings.tcp-streaming.port | Port to listen on for snapclient connections.
|
| services.warpgate.settings.http.certificate | Path to HTTPS listener certificate.
|
| systemd.network.networks.<name>.hierarchyTokenBucketClassConfig | Each attribute in this set specifies an option in the
[HierarchyTokenBucketClass] section of the unit
|
| services.i2pd.outTunnels.<name>.inbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| services.awstats.configs.<name>.extraConfig | Extra configuration to be appended to awstats.${name}.conf.
|
| services.rosenpass.settings.public_key | Path to a file containing the public key of the local Rosenpass peer
|
| services.rosenpass.settings.secret_key | Path to a file containing the secret key of the local Rosenpass peer
|
| services.rsync.jobs.<name>.timerConfig | When to run the job.
|
| services.github-runners.<name>.runnerGroup | Name of the runner group to add this runner to (defaults to the default runner group)
|
| services.wyoming.piper.servers.<name>.voice | Name of the voice model to use
|
| services.nezha-agent.settings.report_delay | The interval between system status reportings
|
| services.bitmagnet.settings.postgres.password | Password for database user
|
| services.suricata.settings.vars.address-groups.AIM_SERVERS | AIM_SERVERS variable.
|
| services.suricata.settings.vars.address-groups.DNS_SERVERS | DNS_SERVERS variable.
|
| services.suricata.settings.vars.address-groups.SQL_SERVERS | SQL_SERVERS variable.
|
| services.stash.settings.preview_audio | Include audio stream in previews
|
| services.listmonk.database.settings.smtp.*.tls_type | Type of TLS authentication with the SMTP server
|
| services.geoipupdate.settings.LicenseKey | A file containing the MaxMind license key
|
| services.bonsaid.settings.*.transitions | List of transitions out of this state
|
| services.autorandr.profiles.<name>.config.<name>.position | Output position
|
| services.postfix.settings.main.smtp_tls_CAfile | File containing CA certificates of root CAs trusted to sign either remote SMTP server certificates or intermediate CA certificates
|
| services.waagent.settings.ResourceDisk.FileSystem | The file system type for the resource disk
|
| services.drupal.sites.<name>.stateDir | The location of the Drupal site state directory.
|
| systemd.user.services.<name>.wants | Start the specified units when this unit is started.
|
| services.sourcehut.settings."pages.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."lists.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."paste.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.suricata.settings.logging.outputs.file.format | Logformat for logs written to the logfile.
|
| services.suricata.settings.logging.outputs.file.enable | Whether to enable logging to file.
|
| services.suricata.settings.logging.outputs.syslog.type | Type of logs send to syslog.
|
| users.users.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| services.jupyter.kernels.<name>.displayName | Name that will be shown to the user.
|
| services.matrix-synapse.settings.listeners | List of ports that Synapse should listen on, their purpose and their configuration
|
| services.ndppd.proxies.<name>.ttl | Controls how long a valid or invalid entry remains in the cache, in
milliseconds.
|
| systemd.user.services.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.firewalld.settings.NftablesCounters | Whether to add a counter to every nftables rule.
|
| services.opengfw.settings.workers.tcpMaxBufferedPagesTotal | TCP max total buffered pages.
|
| services.quickwit.settings.rest.listen_port | The port to listen on for HTTP REST traffic.
|
| services.pgbackrest.stanzas.<name>.jobs.<name>.schedule | When or how often the backup should run
|
| services.quicktun.<name>.privateKeyFile | Path to file containing local secret key in binary or hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| security.agnos.settings.accounts | A list of ACME accounts
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.slot | Optional slot number of the token that stores the certificate.
|
| services.gitlab.pages.settings.internal-gitlab-server | Internal GitLab server used for API requests, useful
if you want to send that traffic over an internal load
balancer
|
| security.pam.services.<name>.text | Contents of the PAM service file.
|
| services.libeufin.nexus.settings.nexus-ebics.BANK_PUBLIC_KEYS_FILE | Filesystem location where Nexus should store the bank public keys.
|
| services.opensnitch.settings.Audit.AudispSocketPath | Configure audit socket path
|
| services.sourcehut.settings.mail.pgp-privkey | An absolute file path (which should be outside the Nix-store)
to an OpenPGP private key
|
| services.keycloak.settings.http-relative-path | The path relative to / for serving
resources.
In versions of Keycloak using Wildfly (<17),
this defaulted to /auth
|
| services.tor.settings.ClientRejectInternalAddresses | See torrc manual.
|
| services.archisteamfarm.bots.<name>.username | Name of the user to log in
|
| systemd.services.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.canaille.settings.CANAILLE.SMTP.PASSWORD | SMTP Password
|
| services.opengfw.settings.workers.tcpMaxBufferedPagesPerConn | TCP max total bufferd pages per connection.
|
| services.wastebin.settings.WASTEBIN_DATABASE_PATH | Path to the sqlite3 database file
|
| services.etebase-server.settings.global.media_root | The media directory.
|
| services.crowdsec-firewall-bouncer.settings.api_url | URL of the local API.
|
| services.sourcehut.settings."git.sr.ht::api".internal-ipnet | Set of IP subnets which are permitted to utilize internal API
authentication
|
| services.amule.settings.ExternalConnect.ECPassword | MD5 hash of the password, obtainaible with echo "<password>" | md5sum | cut -d ' ' -f 1
|
| services.hickory-dns.settings.zones.*.zone_type | One of:
- "Primary" (the master, authority for the zone).
- "Secondary" (the slave, replicated from the primary).
- "External" (a cached zone that queries other nameservers)
|
| services.matrix-synapse.settings.listeners.*.path | Unix domain socket path to bind this listener to.
|
| systemd.paths.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.evdevremapkeys.settings | config.yaml for evdevremapkeys
|
| hardware.alsa.controls.<name>.card | Name of the PCM card to control (slave).
|
| services.sabnzbd.settings.misc.cache_limit | Size of the RAM cache, in bytes (prefixes supported)
|
| security.acme.certs.<name>.s3Bucket | S3 bucket name to use for HTTP-01 based challenges
|
| services.suricata.settings.dpdk.interfaces | See upstream docs: docs/capture-hardware/dpdk and docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk.
|
| services.bluemap.maps.<name>.world | Path to world folder containing the dimension to render
|
| services.bind.zones.<name>.masters | List of servers for inclusion in stub and secondary zones.
|
| services.quicktun.<name>.tunMode | Whether to operate in tun (IP) or tap (Ethernet) mode.
|
| services.redis.servers.<name>.bind | The IP interface to bind to.
null means "all interfaces".
|
| services.spiped.config.<name>.keyfile | Name of a file containing the spiped key
|
| services.healthchecks.settings.SECRET_KEY_FILE | Path to a file containing the secret key.
|
| services.openvpn.servers | Each attribute of this option defines a systemd service that
runs an OpenVPN instance
|
| services.fedimintd.<name>.nginx.config.locations.<name>.alias | Alias directory for requests.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.index | Adds index directive.
|
| services.canaille.settings.CANAILLE_OIDC.JWT.PRIVATE_KEY | JWT private key
|
| services.librespeed.frontend.servers.*.name | Name shown in the server list.
|
| services.grafana.settings.security.admin_user | Default admin username.
|
| services.tor.settings.DoSRefuseSingleHopClientRendezvous | See torrc manual.
|
| services.suricata.settings.vars.address-groups.SMTP_SERVERS | SMTP_SERVERS variable.
|
| services.suricata.settings.vars.address-groups.HTTP_SERVERS | HTTP_SERVERS variable.
|
| services.autosuspend.wakeups.<name>.class | Name of the class implementing the check
|
| services.tahoe.nodes.<name>.tub.port | The port on which the tub will listen
|
| services.tahoe.nodes.<name>.web.port | The port on which the Web server will listen
|
| services.matrix-synapse.settings.presence.enabled | Whether to enable presence tracking
|
| services.waagent.settings.ResourceDisk.MountOptions | This option specifies disk mount options to be passed to the mount -o command
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.draupnir.settings.rawHomeserverUrl | Public base URL of the Matrix homeserver that provides the Client-Server API when using the Draupnir's
Report forwarding feature.
When using Pantalaimon, do not set this to the Pantalaimon URL!
|
| services.udp-over-tcp.tcp2udp.<name>.bind | Which local IP to bind the UDP socket to.
|
| services.ferretdb.settings.FERRETDB_TELEMETRY | Enable or disable basic telemetry
|
| services.transmission.settings.utp-enabled | Whether to enable Micro Transport Protocol (µTP).
|
| services.stash.settings.calculate_md5 | Whether to calculate MD5 checksums for scene video files
|
| systemd.services.<name>.aliases | Aliases of that unit.
|
| services.suricata.settings.logging.default-log-level | The default log level: can be overridden in an output section
|
| services.reposilite.settings.defaultFrontend | Whether to enable the default included frontend with a dashboard.
|
| security.pam.services.<name>.zfs | Enable unlocking and mounting of encrypted ZFS home dataset at login.
|
| boot.initrd.luks.devices.<name>.keyFile | The name of the file (can be a raw device or a partition) that
should be used as the decryption key for the encrypted device
|
| services.routinator.settings.repository-dir | The path where the collected RPKI data is stored.
|
| services.slskd.settings.soulseek.description | The user description for the Soulseek network.
|
| services.slskd.settings.soulseek.listen_port | The port on which to listen for incoming connections.
|
| services.warpgate.settings.mysql.certificate | Path to MySQL listener certificate.
|
| services.filebeat.modules.<name>.module | The name of the module
|
| services.syncoid.commands.<name>.source | Source ZFS dataset
|
| services.phpfpm.pools.<name>.listen | The address on which to accept FastCGI requests.
|
| services.dendrite.settings.sync_api.search.enabled | Whether to enable Dendrite's full-text search engine.
|
| services.tor.settings.ClientDNSRejectInternalAddresses | See torrc manual.
|
| services.tor.settings.DisableDebuggerAttachment | See torrc manual.
|
| services.tor.settings.DormantTimeoutDisabledByIdleStreams | See torrc manual.
|
| nix.registry.<name>.from | The flake reference to be rewritten
|
| power.ups.users.<name>.upsmon | Add the necessary actions for a upsmon process to work
|
| services.nginx.virtualHosts.<name>.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.oncall.settings.db.conn.require_auth | Whether authentication is required to access the web app.
|
| services.sourcehut.settings."meta.sr.ht::api".internal-ipnet | Set of IP subnets which are permitted to utilize internal API
authentication
|
| hardware.nvidia.datacenter.settings | Additional configuration options for fabricmanager.
|
| services.pid-fan-controller.settings.fans.*.heatPressureSrcs | Heat pressure sources affected by the fan.
|
| services.stash.settings.stash_boxes.*.endpoint | URL to the Stash Box graphql api
|
| hardware.tuxedo-drivers.settings.fn-lock | Enables or disables the laptop keyboard's Function (Fn) lock at boot
|
| services.kimai.sites.<name>.package | The kimai package to use.
|
| services.tahoe.nodes.<name>.package | The tahoelafs package to use.
|
| services.blockbook-frontend.<name>.user | The user as which to run blockbook-frontend-‹name›.
|
| users.users.<name>.createHome | Whether to create the home directory and ensure ownership as well as
permissions to match the user.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.P | K_p of PID controller.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.D | K_d of PID controller.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.I | K_i of PID controller.
|
| services.rosenpass.settings.peers.*.public_key | Path to a file containing the public key of the remote Rosenpass peer.
|
| services.syncthing.settings.options.relaysEnabled | When true, relays will be connected to and potentially used for device to device connections.
|
| services.grafana.settings.smtp.from_address | Address used when sending out emails.
|
| services.crowdsec.settings.lapi.credentialsFile | The LAPI credential file to use.
|
| services.crowdsec.settings.capi.credentialsFile | The CAPI credential file to use.
|
| services.librenms.distributedPoller.name | Custom name of this poller.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.tryFiles | Adds try_files directive.
|
| services.pgbackrest.stanzas.<name>.instances.<name>.host | PostgreSQL host for operating remotely.
|
| services.asusd.auraConfigs.<name>.text | Text of the file.
|
| services.sourcehut.settings."builds.sr.ht::worker".bind-address | HTTP bind address for serving local build information/monitoring.
|
| services.suricata.settings.vars.address-groups.MODBUS_CLIENT | MODBUS_CLIENT variable
|
| services.suricata.settings.vars.address-groups.MODBUS_SERVER | MODBUS_SERVER variable.
|
| services.taler.exchange.settings.exchange.CURRENCY | The currency which the exchange will operate with
|
| services.drupal.sites.<name>.enable | Whether to enable Drupal web application.
|
| services.bitcoind.<name>.dbCache | Override the default database cache size in MiB.
|
| services.tts.servers.<name>.extraArgs | Extra arguments to pass to the server commandline.
|
| services.tts.servers.<name>.enable | Whether to enable Coqui TTS server.
|
| services.sourcehut.settings."builds.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-public-key | Public key for Stripe
|
| services.suwayomi-server.settings.server.systemTrayEnabled | Whether to enable a system tray icon, if possible.
|
| services.transmission.settings.umask | Sets transmission's file mode creation mask
|
| services.jupyter.kernels.<name>.language | Language of the environment
|
| services.sourcehut.settings."sr.ht".environment | Values other than "production" adds a banner to each page.
|
| services.sabnzbd.settings.misc.enable_https | Whether to enable HTTPS for the web UI
|
| services.sabnzbd.settings.misc.email_server | SMTP server for email alerts (server:host)
|
| services.slskd.settings.global.upload.speed_limit | Total upload speed limit.
|
| services.nsd.zones.<name>.notifyRetry | Specifies the number of retries for failed notifies
|
| systemd.user.services.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.network.networks.<name>.deficitRoundRobinSchedulerConfig | Each attribute in this set specifies an option in the
[DeficitRoundRobinScheduler] section of the unit
|
| services.ocsinventory-agent.settings.local | If specified, the OCS Inventory Agent will run in offline mode
and the resulting inventory file will be stored in the specified path.
|
| services.tlsrpt.reportd.settings.http_script | Call to an HTTPS client, that accepts the URL on the commandline and the request body from stdin.
|
| services.maubot.settings.database_opts | Additional arguments for asyncpg.create_pool() or sqlite3.connect()
|
| services.ax25.axports.<name>.window | Default window size for this interface.
|
| services.uhub.<name>.plugins.*.plugin | Path to plugin file.
|
| services.authelia.instances.<name>.user | The name of the user for this authelia instance.
|
| services.v4l2-relayd.instances.<name>.cardLabel | The name the camera will show up as.
|
| services.suricata.settings.logging.default-log-format | The default output format
|
| services.headscale.settings.database.postgres.user | Database user.
|
| services.transmission.settings.message-level | Set verbosity of transmission messages.
|
| services.maubot.settings.server.ui_base_path | The base path for the UI.
|
| services.httpd.virtualHosts.<name>.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.nginx.virtualHosts.<name>.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.transmission.settings.download-dir | Directory where to download torrents.
|
| services.matrix-appservice-irc.settings.database.engine | Which database engine to use
|
| services.bitcoind.<name>.rpc.port | Override the default port on which to listen for JSON-RPC connections.
|
| systemd.user.services.<name>.postStop | Shell commands executed after the service's main process
has exited.
|
| services.errbot.instances.<name>.backend | Errbot backend name.
|
| services.sftpgo.settings.webdavd.bindings.*.address | Network listen address
|
| services.restic.backups.<name>.user | As which user the backup should run.
|
| systemd.timers.<name>.wants | Start the specified units when this unit is started.
|
| systemd.slices.<name>.wants | Start the specified units when this unit is started.
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.slot | Optional slot number of the token that stores the certificate.
|
| services.headscale.settings.database.postgres.host | Database host address.
|
| services.headscale.settings.database.postgres.port | Database host port.
|
| services.moosefs.cgiserver.settings.GUISERV_LISTEN_PORT | Port for GUI server to listen on.
|
| services.firewalld.settings.NftablesTableOwner | If enabled, the generated nftables rule set will be owned exclusively by firewalld
|
| services.maubot.settings.plugin_databases | Plugin database settings
|
| services.waagent.settings.ResourceDisk.Format | If set to true, waagent formats and mounts the resource disk that the platform provides,
unless the file system type in `ResourceDisk
|
| services.grafana.settings.database.cache_mode | For sqlite3 only.
Shared cache setting used for connecting to the database.
|
| services.nextcloud-spreed-signaling.settings.mcu.type | The type of MCU to use
|
| services.quicktun.<name>.localPort | Local UDP port.
|
| services.suricata.settings.vars.address-groups.EXTERNAL_NET | EXTERNAL_NET variable.
|
| services.waagent.settings.Provisioning.Agent | Which provisioning agent to use.
|
| services.matrix-appservice-irc.settings.ircService.servers | IRC servers to connect to
|
| services.scrutiny.collector.settings.api.endpoint | Scrutiny app API endpoint for sending metrics to.
|
| services.sourcehut.settings."pages.sr.ht::api".internal-ipnet | Set of IP subnets which are permitted to utilize internal API
authentication
|
| services.ax25.axports.<name>.enable | Whether to enable Enables the axport interface.
|
| services.ax25.axports.<name>.paclen | Default maximum packet size for this interface.
|
| services.transmission.settings.rpc-bind-address | Where to listen for RPC connections
|
| services.mchprs.settings.auto_redpiler | Use redpiler automatically
|
| services.warpgate.settings.database_url | Database connection string
|
| services.nix-store-gcs-proxy.<name>.address | The address of the proxy.
|
| services.crab-hole.settings.blocklist.allow_list | List of allowlists
|
| services.bacula-sd.director.<name>.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.bacula-fd.director.<name>.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.matrix-appservice-irc.settings.homeserver | Homeserver configuration
|
| services.anuko-time-tracker.settings.defaultLanguage | Defines Anuko Time Tracker default language
|
| services.grafana-image-renderer.settings.rendering.args | List of CLI flags passed to chromium.
|
| services.suwayomi-server.settings.server.basicAuthEnabled | Whether to enable basic access authentication for Suwayomi-Server
|
| services.bitmagnet.settings.http_server.port | HTTP server listen port
|
| services.nginx.proxyCachePath.<name>.maxSize | Set maximum cache size
|
| systemd.user.services.<name>.path | Packages added to the service's PATH
environment variable
|
| systemd.slices.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.timers.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.ocsinventory-agent.settings.server | The URI of the OCS Inventory server where to send the inventory file
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.i2pd.inTunnels.<name>.outbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| services.bluesky-pds.settings.PDS_BLOBSTORE_DISK_LOCATION | Store blobs at this location, set to null to use e.g
|
| services.grafana-image-renderer.settings.service.logging.level | The log-level of the grafana-image-renderer.service-unit.
|
| services.bind.zones.<name>.extraConfig | Extra zone config to be appended at the end of the zone section.
|
| systemd.user.services.<name>.preStart | Shell commands executed before the service's main process
is started.
|
| services.suricata.settings.logging.outputs.syslog.format | Logformat for logs send to syslog.
|
| services.suricata.settings.logging.outputs.syslog.enable | Whether to enable logging to syslog.
|
| services.moosefs.cgiserver.settings.GUISERV_LISTEN_HOST | IP address to bind GUI server to (* means any).
|
| services.pretix.settings.pretix.registration | Whether to allow registration of new admin users.
|
| services.syncthing.settings.options.localAnnouncePort | The port on which to listen and send IPv4 broadcast announcements to.
|
| services.homebridge.settings.accessories | Homebridge Accessories
|
| services.gitwatch.<name>.enable | Whether to enable watching for repo.
|
| services.gitwatch.<name>.remote | Optional url of remote repository
|
| services.gitwatch.<name>.branch | Optional branch in remote repository
|
| services.bitcoind.<name>.enable | Whether to enable Bitcoin daemon.
|
| systemd.services.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.autorandr.profiles.<name>.config.<name>.scale | Output scale configuration
|
| services.blockbook-frontend.<name>.dataDir | Location of blockbook-frontend-‹name› data directory.
|
| services.dependency-track.settings."alpine.ldap.enabled" | Defines if LDAP will be used for user authentication
|
| services.healthchecks.settings.ALLOWED_HOSTS | The host/domain names that this site can serve.
|
| services.dependency-track.settings."alpine.database.url" | Specifies the JDBC URL to use when connecting to the database.
|
| services.pretalx.settings.files.upload_limit | Maximum file upload size in MiB.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.reposilite.settings.bypassExternalCache | Add cache bypass headers to responses from /api/* to avoid issues with proxies such as Cloudflare.
|
| services.sourcehut.settings."hg.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.dendrite.settings.media_api.base_path | Storage path for uploaded media.
|
| services.transmission.settings.watch-dir-enabled | Whether to enable the
services.transmission.settings.watch-dir.
|
| services.blockbook-frontend.<name>.group | The group as which to run blockbook-frontend-‹name›.
|
| services.grafana.settings.database.password | The database user's password (not applicable for sqlite3)
|
| services.hercules-ci-agent.settings.clusterJoinTokenPath | Location of the cluster-join-token.key file
|
| services.grafana.settings.server.socket_mode | Mode where the socket should be set when protocol=socket
|
| services.listmonk.database.settings.smtp.*.max_conns | Maximum number of simultaneous connections, defaults to 1
|
| services.opensnitch.settings.InterceptUnknown | Whether to intercept spare connections.
|
| services.tor.settings.BridgeAuthoritativeDir | See torrc manual.
|
| services.nextcloud.settings.mail_domain | The return address that you want to appear on emails sent by the Nextcloud server, for example nc-admin@example.com, substituting your own domain, of course.
|
| services.homebridge.settings.description | Description of the homebridge instance.
|
| services.transmission.settings.peer-port-random-on-start | Randomize the peer port.
|
| services.umurmur.settings.channel_links | Channel tree definitions.
|
| services.netbird.server.dashboard.settings | An attribute set that will be used to substitute variables when building the dashboard
|
| services.nsd.zones.<name>.maxRetrySecs | Limit retry time for secondary zones
|
| services.dependency-track.settings."alpine.oidc.enabled" | Defines if OpenID Connect will be used for user authentication
|
| services.geth.<name>.authrpc.vhosts | List of virtual hostnames from which to accept requests.
|
| services.hans.clients.<name>.server | IP address of server running hans
|
| services.drupal.sites.<name>.themesDir | The location for users to install Drupal themes.
|
| services.nsd.zones.<name>.minRefreshSecs | Limit refresh time for secondary zones.
|
| services.spiped.config.<name>.maxConns | Limit on the number of simultaneous connections allowed.
|
| services.dependency-track.settings."alpine.oidc.client.id" | Defines the client ID to be used for OpenID Connect
|
| systemd.network.networks.<name>.genericRandomEarlyDetectionConfig | Each attribute in this set specifies an option in the
[GenericRandomEarlyDetection] section of the unit
|
| services.suricata.settings.logging.default-output-filter | A regex to filter output
|
| services.suwayomi-server.settings.server.extensionRepos | URL of repositories from which the extensions can be installed.
|
| services.suricata.settings.pcap-file.checksum-checks | Possible values are:
- yes: checksum validation is forced
- no: checksum validation is disabled
- auto: Suricata uses a statistical approach to detect when
checksum off-loading is used. (default)
Warning: 'checksum-validation' must be set to yes to have checksum tested.
|
| services.i2pd.outTunnels.<name>.outbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| security.pam.services.<name>.rootOK | If set, root doesn't need to authenticate (e.g. for the
useradd service).
|
| services.epgstation.settings.clientSocketioPort | Socket.io port that the web client is going to connect to
|
| services.mchprs.settings.view_distance | Maximal distance (in chunks) between players and loaded chunks
|
| services.sourcehut.settings."hub.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."git.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."man.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| security.pam.services.<name>.showMotd | Whether to show the message of the day.
|
| services.taler.exchange.settings.exchange.MASTER_PUBLIC_KEY | Used by the exchange to verify information signed by the offline system.
|
| services.bind.zones.<name>.allowQuery | List of address ranges allowed to query this zone
|
| services.suricata.settings.vars.address-groups.TELNET_SERVERS | TELNET_SERVERS variable.
|
| nix.settings.sandbox | If set, Nix will perform builds in a sandboxed environment that it
will set up automatically for each build
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-secret-key | An absolute file path (which should be outside the Nix-store)
to a secret key for Stripe
|
| services.authelia.instances.<name>.group | The name of the group for this authelia instance.
|
| services.transmission.settings.peer-port-random-low | The minimal peer port to listen to for incoming connections
when services.transmission.settings.peer-port-random-on-start is enabled.
|
| services.firewalld.settings.FirewallBackend | The firewall backend implementation
|
| services.cgit.<name>.nginx.location | Location to serve cgit under.
|
| services.rspamd.locals.<name>.source | Path of the source file.
|
| services.spiped.config.<name>.target | Address to which spiped should connect.
|
| services.ndppd.proxies.<name>.interface | Listen for any Neighbor Solicitation messages on this interface,
and respond to them according to a set of rules
|
| services.nginx.virtualHosts.<name>.http3 | Whether to enable the HTTP/3 protocol
|
| services.listmonk.database.settings.messengers | List of messengers, see: https://github.com/knadh/listmonk/blob/master/models/settings.go#L64-L74 for options.
|
| services.engelsystem.settings | Options to be added to config.php, as a nix attribute set
|
| services.sourcehut.settings."builds.sr.ht::worker".buildlogs | Path to write build logs.
|
| services.slskd.settings.directories.downloads | Directory where downloaded files are stored.
|
| services.geth.<name>.metrics.enable | Whether to enable Go Ethereum prometheus metrics.
|
| services.bitcoind.<name>.rpc.users | RPC user information for JSON-RPC connections.
|
| services.redis.servers.<name>.slaveOf | IP and port to which this redis instance acts as a slave.
|
| systemd.user.services.<name>.script | Shell commands executed as the service's main process.
|
| services.sslh.settings.verbose-connections | Where to log connections information
|
| services.grafana.provision.alerting.rules.settings | Grafana rules configuration in Nix
|
| services.anuko-time-tracker.settings.exportDecimalDuration | Defines whether time duration values are decimal in CSV and XML data
exports (1.25 vs 1:15).
|
| services.nextcloud-spreed-signaling.settings.nats.url | URL of one or more NATS backends to use
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.file | Absolute path to the certificate to load
|
| services.redis.servers.<name>.port | The TCP port to accept connections
|
| services.dependency-track.settings."alpine.oidc.issuer" | Defines the issuer URL to be used for OpenID Connect
|
| security.pam.services.<name>.oathAuth | If set, the OATH Toolkit will be used.
|
| services.grafana.settings.server.socket_gid | GID where the socket should be set when protocol=socket
|
| services.grafana-image-renderer.settings.rendering.width | Width of the PNG used to display the alerting graph.
|
| services.slskd.settings.retention.files.incomplete | Lifespan of incomplete downloading files in minutes.
|
| services.suwayomi-server.settings.server.basicAuthPasswordFile | The password file containing the value that you have to provide when authenticating.
|
| systemd.paths.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.units.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.paths.<name>.wants | Start the specified units when this unit is started.
|
| services.matrix-synapse.settings.report_stats | Whether or not to report anonymized homeserver usage statistics.
|
| services.immichframe.settings.Accounts.*.ApiKeyFile | File containing an API key to talk to the Immich server
|
| services.fedimintd.<name>.nginx.config.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.sourcehut.settings."meta.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."todo.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.tlsrpt.reportd.settings.contact_info | Contact information embedded into the reports.
|
| systemd.user.services.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.redis.servers.<name>.slaveOf.ip | IP of the Redis master
|
| containers.<name>.extraVeths.<name>.forwardPorts.*.hostPort | Source port of the external interface on host
|
| services.etebase-server.settings.global.static_root | The directory for static files.
|
| services.ferretdb.settings.FERRETDB_POSTGRESQL_URL | PostgreSQL URL for 'pg' handler
|
| services.listmonk.database.settings."bounce.mailboxes" | List of bounce mailboxes
|
| hardware.alsa.cardAliases.<name>.driver | Name of the kernel module that provides the card.
|
| services.pinnwand.settings.database_uri | Database URI compatible with SQLAlchemy
|
| services.your_spotify.settings.MONGO_ENDPOINT | The endpoint of the Mongo database.
|
| services.geth.<name>.authrpc.enable | Whether to enable Go Ethereum Auth RPC API.
|
| systemd.user.services.<name>.postStart | Shell commands executed after the service's main process
is started.
|
| systemd.services.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.user.services.<name>.reload | Shell commands executed when the service's main process
is reloaded.
|
| systemd.paths.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.transmission.settings.peer-port-random-high | The maximum peer port to listen to for incoming connections
when services.transmission.settings.peer-port-random-on-start is enabled.
|
| systemd.network.networks.<name>.deficitRoundRobinSchedulerClassConfig | Each attribute in this set specifies an option in the
[DeficitRoundRobinSchedulerClass] section of the unit
|
| services.prometheus.exporters.rtl_433.ids.*.name | Name to match.
|
| services.ax25.axports.<name>.kissParams | Kissattach parameters for this interface.
|
| services.drupal.sites.<name>.package | The drupal package to use.
|
| services.autorandr.profiles.<name>.config.<name>.transform | Refer to
xrandr(1)
for the documentation of the transform matrix.
|
| services.h2o.hosts.<name>.tls.policy | add will additionally listen for TLS connections. only will
disable TLS connections. force will redirect non-TLS traffic
to the TLS connection.
|
| services.nginx.virtualHosts.<name>.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.znapzend.zetup.<name>.destinations.<name>.host | Host to use for the destination dataset
|
| services.headscale.settings.tls_key_path | Path to key for already created certificate.
|
| services.swapspace.settings.max_swapsize | Greatest allowed size for individual swapfiles
|
| services.swapspace.settings.min_swapsize | Smallest allowed size for individual swapfiles
|
| services.borgbackup.jobs.<name>.dateFormat | Arguments passed to date
to create a timestamp suffix for the archive name.
|
| systemd.units.<name>.aliases | Aliases of that unit.
|
| systemd.paths.<name>.aliases | Aliases of that unit.
|
| services.tuned.settings.dynamic_tuning | Whether to enable dynamic tuning.
|
| services.nextcloud-spreed-signaling.settings.https.key | Path to the private key used for the HTTPS listener
|
| systemd.user.paths.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.wgautomesh.settings.gossip_port | wgautomesh gossip port, this MUST be the same number on all nodes in
the wgautomesh network.
|
| services.nextcloud.settings.loglevel | Log level value between 0 (DEBUG) and 4 (FATAL).
-
0 (debug): Log all activity.
-
1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
-
2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
-
3 (error): Log failed operations and fatal errors.
-
4 (fatal): Log only fatal errors that cause the server to stop.
|
| services.canaille.settings.CANAILLE_SQL.DATABASE_URI | The SQL server URI
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.setPoint | Set point of the controller in °C.
|
| services.suricata.settings.logging.outputs.console.enable | Whether to enable logging to console.
|
| services.openvpn.servers.<name>.up | Shell commands executed when the instance is starting.
|
| services.tahoe.nodes.<name>.sftpd.enable | Whether to enable SFTP service.
|
| services.sabnzbd.settings.misc.email_endjob | Whether to send emails on job completion
|
| systemd.timers.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.paths.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| users.groups.<name>.members | The user names of the group members, added to the
/etc/group file.
|
| systemd.slices.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.snapserver.settings.tcp-streaming.enabled | Whether to enable streaming via TCP.
|
| users.users.<name>.subGidRanges | Subordinate group ids that user is allowed to use
|
| users.users.<name>.subUidRanges | Subordinate user ids that user is allowed to use
|
| services.netbird.clients.<name>.suffixedName | A systemd service name to use (without .service suffix).
|
| services.netbird.tunnels.<name>.suffixedName | A systemd service name to use (without .service suffix).
|
| systemd.user.services.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.tarsnap.archives.<name>.printStats | Print global archive statistics upon completion
|
| services.olivetin.settings.ListenAddressSingleHTTPFrontend | The address to listen on for the internal "microproxy" frontend.
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.xserver.displayManager.lightdm.greeter.name | The name of a .desktop file in the directory specified
in the 'package' option.
|
| services.kimai.sites.<name>.poolConfig | Options for the Kimai PHP pool
|
| services.fedimintd.<name>.ui.bind | Address to bind on for UI connections
|
| services.jupyter.kernels.<name>.env | Environment variables to set for the kernel.
|
| services.redis.servers.<name>.syslog | Enable logging to the system logger.
|
| services.redis.servers.<name>.enable | Whether to enable Redis server.
|
| services.rspamd.workers.<name>.count | Number of worker instances to run
|
| services.nginx.virtualHosts.<name>.root | The path of the web root directory.
|
| services.libeufin.nexus.settings.nexus-ebics.CLIENT_PRIVATE_KEYS_FILE | Filesystem location where Nexus should store the subscriber private keys.
|
| services.umurmur.settings.max_bandwidth | Maximum bandwidth (in bits per second) that clients may send
speech at.
|
| services.rsync.jobs.<name>.inhibit | Run the rsync process with an inhibition lock taken;
see systemd-inhibit(1) for a list of possible operations.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.h2o.hosts.<name>.acme.enable | Whether to ask Let’s Encrypt to sign a certificate for this
virtual host
|
| systemd.services.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.services.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| users.users.<name>.subUidRanges.*.count | Count of subordinate user ids
|
| users.users.<name>.subGidRanges.*.count | Count of subordinate group ids
|
| services.i2pd.inTunnels.<name>.inbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.reposilite.settings.databaseThreadPool | Maximum amount of concurrent connections to the database. (one per thread)
Embedded databases (sqlite, h2) do not support truly concurrent connections, so the value will always be 1 if they are used.
|
| services.bacula-sd.director.<name>.tls.enable | Specifies if TLS should be enabled
|
| services.bacula-fd.director.<name>.tls.enable | Specifies if TLS should be enabled
|
| services.grafana.settings.security.admin_email | The email of the default Grafana Admin, created on startup.
|
| services.matrix-synapse.settings.listeners.*.resources | List of HTTP resources to serve on this listener.
|
| services.pid-fan-controller.settings.fans.*.wildcardPath | Wildcard path of the hwmon pwm file
|
| hardware.sane.brscan4.netDevices.<name>.nodename | The node name of the device
|
| hardware.sane.brscan5.netDevices.<name>.nodename | The node name of the device
|
| services.borgbackup.jobs.<name>.wrapper | Name of the wrapper that is installed into PATH
|
| services.nsd.keys.<name>.algorithm | Authentication algorithm for this key.
|
| services.omnom.settings.server.secure_cookie | Whether to limit cookies to a secure channel.
|
| services.stash.settings.parallel_tasks | Number of parallel tasks to start during scan/generate
|
| services.firewalld.settings.StrictForwardPorts | If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker
|
| services.immichframe.settings.Accounts.*.ApiKey | API key to talk to the Immich server
|
| services.keepalived.vrrpScripts.<name>.user | Name of user to run the script under.
|
| services.syncthing.settings.options.urAccepted | Whether the user has accepted to submit anonymous usage data
|
| services.tahoe.nodes.<name>.sftpd.port | The port on which the SFTP server will listen
|
| hardware.printers.ensurePrinters.*.name | Name of the printer / printer queue
|
| services.sourcehut.settings."pages.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."paste.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."lists.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.libeufin.bank.settings.libeufin-bank.CURRENCY | The currency under which the libeufin-bank should operate
|
| services.kanidm.provision.systems.oauth2.<name>.claimMaps.<name>.joinType | Determines how multiple values are joined to create the claim value
|
| services.quicktun.<name>.upScript | Run specified command or script after the tunnel device has been opened.
|
| services.redis.servers.<name>.slowLogMaxLen | Maximum number of items to keep in slow log.
|
| services.firewalld.settings.IndividualCalls | Whether to use individual -restore calls to apply changes to the firewall
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".url.host | Your instance's hostname for generating URLs throughout the app
|
| services.grafana.settings.users.hidden_users | This is a comma-separated list of usernames
|
| services.homebridge.settings.platforms.*.platform | Platform type
|
| services.acpid.handlers.<name>.event | Event type.
|
| services.quicktun.<name>.remotePort | Remote UDP port
|
| systemd.user.services.<name>.aliases | Aliases of that unit.
|
| services.matrix-appservice-irc.settings.homeserver.url | The URL to the home server for client-server API calls
|
| services.grafana.settings.server.enable_gzip | Set this option to true to enable HTTP compression, this can improve transfer speed and bandwidth utilization
|
| services.anubis.defaultOptions.settings.DIFFICULTY | The difficulty required for clients to solve the challenge
|
| services.etebase-server.settings.global.secret_file | The path to a file containing the secret
used as django's SECRET_KEY.
|
| services.grafana.settings.database.log_queries | Set to true to log the sql calls and execution times
|
| services.borgbackup.jobs.<name>.postCreate | Shell commands to run after borg create
|
| services.phpfpm.pools.<name>.socket | Path to the unix socket file on which to accept FastCGI requests.
This option is read-only and managed by NixOS.
|
| systemd.services.<name>.startAt | Automatically start this unit at the given date/time, which
must be in the format described in
systemd.time(7)
|
| users.extraUsers.<name>.extraGroups | The user's auxiliary groups.
|
| services.grafana-image-renderer.settings.rendering.height | Height of the PNG used to display the alerting graph.
|
| services.tuned.settings.sleep_interval | Interval in which the TuneD daemon is waken up and checks for events (in seconds).
|
| services.fedimintd.<name>.ui.port | TCP Port to bind on for UI connections
|
| services.nbd.server.exports.<name>.path | File or block device to export.
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.bindPort | Port that the media proxy binds to.
|
| power.ups.users.<name>.actions | Allow the user to do certain things with upsd
|
| security.pam.services.<name>.otpwAuth | If set, the OTPW system will be used (if
~/.otpw exists).
|
| services.openvpn.servers.<name>.authUserPass.username | The username to store inside the credentials file.
|
| services.your_spotify.settings.SPOTIFY_PUBLIC | The public client ID of your Spotify application
|
| services.i2pd.outTunnels.<name>.inbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.netbird.clients.<name>.interface | Name of the network interface managed by this client.
|
| services.netbird.tunnels.<name>.interface | Name of the network interface managed by this client.
|
| hardware.alsa.controls.<name>.device | Name of the PCM device to control (slave).
|
| services.fedimintd.<name>.nginx.config.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| systemd.services.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| security.pam.services.<name>.enable | Whether to enable this PAM service.
|
| services.ax25.axports.<name>.package | The ax25-tools package to use.
|
| services.nylon.<name>.verbosity | Enable verbose output, default is to not be verbose.
|
| services.borgmatic.settings.repositories.*.path | Path to the repository
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.tuned.settings.reapply_sysctl | Whether to enable the reapplying of global sysctls after TuneD sysctls are applied.
|
| systemd.network.networks.<name>.fairQueueingControlledDelayConfig | Each attribute in this set specifies an option in the
[FairQueueingControlledDelay] section of the unit
|
| services.neo4j.ssl.policies.<name>.privateKey | The name of private PKCS #8 key file for this policy to be found
in the baseDirectory, or the absolute path to
the key file
|
| services.fedimintd.<name>.p2p.url | Public address for p2p connections from peers (if TCP is used)
|
| services.bacula-sd.device.<name>.mediaType | The specified name-string names the type of media supported by this
device, for example, DLT7000
|
| services.epgstation.settings.concurrentEncodeNum | The maximum number of encoding jobs that EPGStation would run at the
same time.
|
| services.system76-scheduler.settings.cfsProfiles.enable | Tweak CFS latency parameters when going on/off battery
|
| containers.<name>.extraVeths.<name>.forwardPorts | List of forwarded ports from host to container
|
| services.awstats.configs.<name>.type | The type of log being collected.
|
| services.openssh.knownHosts.<name>.hostNames | A list of host names and/or IP numbers used for accessing
the host's ssh service
|
| services.rspamd.workers.<name>.type | The type of this worker
|
| services.slskd.settings.global.download.speed_limit | Total upload download limit
|
| services.nextcloud-spreed-signaling.settings.grpc.listen | IP and port to listen on for GRPC requests
|
| services.syncthing.settings.options.limitBandwidthInLan | Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
|
| services.dependency-track.settings."alpine.database.driver" | Specifies the JDBC driver class to use.
|
| services.warpgate.settings.sso_providers | Configure OIDC single sign-on providers.
|
| services.h2o.hosts.<name>.tls.identity | Key / certificate pairs for the virtual host.
|
| services.nsd.zones.<name>.dnssecPolicy.zsk | Key policy for zone signing keys
|
| services.nsd.zones.<name>.dnssecPolicy.ksk | Key policy for key signing keys
|
| services.ndppd.proxies.<name>.router | Turns on or off the router flag for Neighbor Advertisement Messages.
|
| users.users.<name>.autoSubUidGidRange | Automatically allocate subordinate user and group ids for this user
|
| services.postsrsd.settings.unprivileged-user | Unprivileged user to drop privileges to.
Our systemd unit never runs postsrsd as a privileged process, so this option is read-only.
|
| services.ghostunnel.servers.<name>.allowCN | Allow client if common name appears in the list.
|
| documentation.man.mandoc.settings | Configuration for man.conf(5)
|
| services.nextcloud.settings.enabledPreviewProviders | The preview providers that should be explicitly enabled.
|
| services.bitcoind.<name>.package | The bitcoind package to use.
|
| services.grafana.provision.dashboards.settings | Grafana dashboard configuration in Nix
|
| security.pam.services.<name>.unixAuth | Whether users can log in with passwords defined in
/etc/shadow.
|
| services.redis.servers.<name>.logLevel | Specify the server verbosity level, options: debug, verbose, notice, warning.
|
| services.suricata.settings.dpdk | Data Plane Development Kit is a framework for fast packet processing in data plane applications running on a wide variety of CPU architectures
|
| users.extraUsers.<name>.enable | If set to false, the user account will not be created
|
| services.beesd.filesystems.<name>.workDir | Name (relative to the root of the filesystem) of the subvolume where
the hash table will be stored.
|
| services.dokuwiki.sites.<name>.acl.*.page | Page or namespace to restrict
|
| services.drupal.sites.<name>.configSyncDir | The location of the Drupal config sync directory.
|
| services.cjdns.UDPInterface.connectTo.<name>.login | (optional) name your peer has for you
|
| services.cjdns.ETHInterface.connectTo.<name>.login | (optional) name your peer has for you
|
| services.public-inbox.inboxes.<name>.newsgroup | NNTP group name for the inbox.
|
| services.omnom.settings.app.disable_signup | Whether to enable restricting user creation.
|
| services.factorio.mods-dat | Mods settings can be changed by specifying a dat file, in the mod
settings file
format.
|
| containers.<name>.extraVeths.<name>.localAddress | The IPv4 address assigned to the interface in the container
|
| systemd.slices.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.timers.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.lidarr.settings.update.automatically | Automatically download and install updates.
|
| services.radarr.settings.update.automatically | Automatically download and install updates.
|
| services.suricata.settings.logging.outputs.syslog.facility | Facility to log to.
|
| services.sonarr.settings.update.automatically | Automatically download and install updates.
|
| services.filesender.settings.admin_email | Email address of FileSender administrator(s)
|
| services.sourcehut.settings.webhooks.private-key | An absolute file path (which should be outside the Nix-store)
to a base64-encoded Ed25519 key for signing webhook payloads
|
| services.jupyter.kernels.<name>.argv | Command and arguments to start the kernel.
|
| services.bacula-sd.director.<name>.tls | TLS Options for the Director in this Configuration.
|
| services.bitcoind.<name>.configFile | The configuration file path to supply bitcoind.
|
| services.bepasty.servers.<name>.bind | Bind address to be used for this server.
|
| services.bacula-fd.director.<name>.tls | TLS Options for the Director in this Configuration.
|
| services.redis.servers.<name>.slaveOf.port | port of the Redis master
|
| services.netbird.tunnels.<name>.port | Port the NetBird client listens on.
|
| services.netbird.clients.<name>.port | Port the NetBird client listens on.
|
| services.tor.settings.ServerTransportPlugin.transports | List of pluggable transports.
|
| services.grafana.settings.paths.provisioning | Folder that contains provisioning config files that grafana will apply on startup and while running
|
| services.ghostunnel.servers.<name>.allowOU | Allow client if organizational unit name appears in the list.
|
| services.nsd.zones.<name>.provideXFR | Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
address range 192.0.2.0/24, 1.2.3.4&255.255.0.0, 3.0.2.20-3.0.2.40
|
| services.grafana.provision.alerting.rules.settings.groups | List of rule groups to import or update.
|
| services.postfix.settings.main.relay_domains | List of domains delivered via the relay transport.
https://www.postfix.org/postconf.5.html#relay_domains
|
| virtualisation.cri-o.settings | Configuration for cri-o, see
https://github.com/cri-o/cri-o/blob/master/docs/crio.conf.5.md.
|
| services.anubis.defaultOptions.settings.WEBMASTER_EMAIL | If set, shows a contact email address when rendering error pages
|
| services.iodine.clients.<name>.relay | DNS server to use as an intermediate relay to the iodined server
|
| services.logind.settings.Login.KillUserProcesses | Specifies whether the processes of a user should be killed
when the user logs out
|
| services.anubis.defaultOptions.settings.METRICS_BIND_NETWORK | The network family that the metrics server should bind to
|
| services.geth.<name>.websocket.apis | APIs to enable over WebSocket
|
| services.dendrite.settings.sync_api.search.language | The language most likely to be used on the server - used when indexing, to
ensure the returned results match expectations
|
| services.nextcloud-spreed-signaling.settings.app.debug | Set to "true" to install pprof debug handlers
|
| services.httpd.virtualHosts.<name>.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| systemd.user.paths.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.sourcehut.settings."builds.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.buffyboard.settings.input.touchscreen | Enable or disable the use of the touchscreen.
|
| services.warpgate.settings.postgres.certificate | Path to PostgreSQL listener certificate.
|
| fileSystems.<name>.label | Label of the device
|
| services.keyd.keyboards.<name>.ids | Device identifiers, as shown by keyd(1).
|
| services.udp-over-tcp.udp2tcp.<name>.fwmark | If given, sets the SO_MARK option on the TCP socket.
|
| services.udp-over-tcp.tcp2udp.<name>.fwmark | If given, sets the SO_MARK option on the TCP socket.
|
| services.borgmatic.settings.repositories.*.label | Label to the repository
|
| services.tor.settings.CookieAuthentication | See torrc manual.
|
| security.acme.certs.<name>.csr | Path to a certificate signing request to apply when fetching the certificate.
|
| users.extraUsers.<name>.cryptHomeLuks | Path to encrypted luks device that contains
the user's home directory.
|
| containers.<name>.extraVeths.<name>.localAddress6 | The IPv6 address assigned to the interface in the container
|
| services.journald.remote.settings.Remote.ServerKeyFile | A path to a SSL secret key file in PEM format
|
| security.pam.services.<name>.pamMount | Enable PAM mount (pam_mount) system to mount filesystems on user login.
|
| services.drupal.sites.<name>.modulesDir | The location for users to install Drupal modules.
|
| services.i2pd.inTunnels.<name>.accessList | I2P nodes that are allowed to connect to this service.
|
| services.openvpn.servers.<name>.down | Shell commands executed when the instance is shutting down.
|
| services.public-inbox.inboxes.<name>.url | URL where this inbox can be accessed over HTTP.
|
| security.pam.u2f.settings.interactive | Set to prompt a message and wait before testing the presence of a U2F device
|
| services.xserver.xkb.extraLayouts.<name>.typesFile | The path to the xkb types file
|
| services.dendrite.settings.global.private_key | The path to the signing private key file, used to sign
requests and events.
nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
|
| services.slskd.settings.directories.incomplete | Directory where incomplete downloading files are stored.
|
| services.netbird.server.management.settings | Configuration of the netbird management server
|
| services.r53-ddns.hostname | Manually specify the hostname
|
| services.immichframe.settings.Accounts.*.ImmichServerUrl | The URL of your Immich server.
|
| services.mackerel-agent.settings.host_status.on_stop | Host status after agent shutdown.
|
| services.nextcloud-spreed-signaling.settings.http.listen | IP and port to listen on for HTTP requests, in the format of ip:port
|
| users.extraUsers.<name>.shell | The path to the user's shell
|
| services.bitcoind.<name>.testnet | Whether to use the testnet instead of mainnet.
|
| systemd.user.services.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.targets.<name>.wants | Start the specified units when this unit is started.
|
| systemd.sockets.<name>.wants | Start the specified units when this unit is started.
|
| systemd.services.<name>.scriptArgs | Arguments passed to the main process script
|
| services.headscale.settings.oidc.extra_params | Custom query parameters to send with the Authorize Endpoint request.
|
| services.your_spotify.settings.CLIENT_ENDPOINT | The endpoint of your web application
|
| services.fedimintd.<name>.p2p.port | Port to bind on for p2p connections from peers (both TCP and UDP)
|
| services.fedimintd.<name>.p2p.bind | Address to bind on for p2p connections from peers (both TCP and UDP)
|
| services.blockbook-frontend.<name>.certFile | To enable SSL, specify path to the name of certificate files without extension
|
| services.prometheus.exporters.fritz.settings.devices | Fritz!-devices to monitor using the exporter.
|
| image.repart.partitions.<name>.contents.<name>.source | Path of the source file.
|
| services.draupnir.settings.managementRoom | The room ID or alias where moderators can use the bot's functionality
|
| systemd.user.paths.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.units.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.httpd.virtualHosts.<name>.hostName | Canonical hostname for the server.
|
| services.asusd.auraConfigs.<name>.source | Path of the source file.
|
| services.caddy.virtualHosts.<name>.hostName | Canonical hostname for the server.
|
| services.rss2email.feeds.<name>.url | The URL at which to fetch the feed.
|
| services.redis.servers.<name>.unixSocket | The path to the socket to bind to.
|
| services.firezone.server.provision.accounts.<name>.actors.<name>.type | The account type
|
| services.rspamd.locals.<name>.enable | Whether this file locals should be generated
|
| services.ghostunnel.servers.<name>.allowURI | Allow client if URI subject alternative name appears in the list.
|
| services.ghostunnel.servers.<name>.allowDNS | Allow client if DNS subject alternative name appears in the list.
|
| services.kanidm.provision.systems.oauth2.<name>.claimMaps.<name>.valuesByGroup | Maps kanidm groups to values for the claim.
|
| services.sympa.domains.<name>.webHost | Domain part of the web interface URL (no web interface for this domain if null)
|
| services.nylon.<name>.deniedIPRanges | Denied client IP ranges, these gets evaluated after the allowed IP ranges, defaults to all IPv4 addresses:
[ "0.0.0.0/0" ]
To block all other access than the allowed.
|
| services.geth.<name>.metrics.address | Listen address of Go Ethereum metrics service.
|
| services.drupal.sites.<name>.phpOptions | Options for PHP's php.ini file for this Drupal site.
|
| services.nginx.proxyCachePath.<name>.enable | Whether to enable this proxy cache path entry.
|
| users.extraUsers.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| services.fedimintd.<name>.enable | Whether to enable fedimintd.
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.publicUrl | URL under which the media proxy is publicly acccessible.
|
| services.firewalld.settings.NftablesFlowtable | This may improve forwarded traffic throughput by enabling nftables flowtable
|
| services.navidrome.settings.EnableInsightsCollector | Enable anonymous usage data collection, see https://www.navidrome.org/docs/getting-started/insights/ for details.
|
| services.znapzend.zetup.<name>.destinations.<name>.plan | The znapzend backup plan to use for the source
|
| services.cjdns.ETHInterface.connectTo.<name>.peerName | (optional) human-readable name for peer
|
| services.cjdns.UDPInterface.connectTo.<name>.peerName | (optional) human-readable name for peer
|
| services.warpgate.settings.ssh.external_port | The SSH listener is reachable via this port externally.
|
| services.openafsServer.cellServDB.<name>.*.ip | IP Address of a database server
|
| services.openafsClient.cellServDB.<name>.*.ip | IP Address of a database server
|
| services.tahoe.nodes.<name>.helper.enable | Whether to enable helper service.
|
| services.nginx.proxyCachePath.<name>.keysZoneSize | Set size to shared memory zone.
|
| services.veilid.settings.core.capabilities.disable | A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).
|
| fileSystems.<name>.encrypted.label | Label of the unlocked encrypted device
|
| services.nextcloud-spreed-signaling.settings.grpc.targets | For target type static: List of GRPC targets to connect to for clustering mode.
|
| systemd.sockets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.targets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.grafana.settings.users.password_hint | Text used as placeholder text on login page for password input.
|
| services.automysqlbackup.settings | automysqlbackup configuration
|
| services.hans.clients.<name>.extraConfig | Additional command line parameters
|
| services.dokuwiki.sites.<name>.stateDir | Location of the DokuWiki state directory.
|
| services.iodine.clients.<name>.server | Hostname of server running iodined
|
| services.restic.backups.<name>.checkOpts | A list of options for 'restic check'.
|
| services.rspamd.workers.<name>.enable | Whether to run the rspamd worker.
|
| services.fedimintd.<name>.api.url | Public URL of the API address of the reverse proxy/tls terminator
|
| services.drupal.sites.<name>.poolConfig | Options for the Drupal PHP pool
|
| services.veilid.settings.core.table_store.directory | The filesystem directory to store your table store within.
|
| services.veilid.settings.core.block_store.directory | The filesystem directory to store blocks for the block store.
|
| services.headscale.settings.dns.base_domain | Defines the base domain to create the hostnames for MagicDNS
|
| services.geth.<name>.authrpc.address | Listen address of Go Ethereum Auth RPC API.
|
| services.restic.backups.<name>.runCheck | Whether to run the check command with the provided checkOpts options.
|
| services.phpfpm.pools.<name>.phpPackage | The PHP package to use for running this PHP-FPM pool.
|
| services.keepalived.vrrpScripts.<name>.group | Name of group to run the script under
|
| fileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| systemd.user.timers.<name>.wants | Start the specified units when this unit is started.
|
| systemd.user.slices.<name>.wants | Start the specified units when this unit is started.
|
| services.nextcloud-spreed-signaling.settings.turn.servers | A list of TURN servers to use
|
| services.mpd.settings.bind_to_address | The address for the daemon to listen on
|
| services.yandex-disk.username | Your yandex.com login name.
|
| services.grafana.settings.users.default_theme | Sets the default UI theme. system matches the user's system theme.
|
| services.grafana.settings.database.ca_cert_path | The path to the CA certificate to use.
|
| services.readarr.settings.update.automatically | Automatically download and install updates.
|
| services.hostapd.radios.<name>.noScan | Disables scan for overlapping BSSs in HT40+/- mode
|
| services.geth.<name>.websocket.port | Port number of Go Ethereum WebSocket API.
|
| services.taler.exchange.settings.exchange.CURRENCY_ROUND_UNIT | Smallest amount in this currency that can be transferred using the underlying RTGS
|
| services.awstats.configs.<name>.webService.hostname | The hostname the web service appears under.
|
| security.pam.services.<name>.p11Auth | If set, keys listed in
~/.ssh/authorized_keys and
~/.eid/authorized_certificates
can be used to log in with the associated PKCS#11 tokens.
|
| services.ndppd.proxies.<name>.rules | This is a rule that the target address is to match against
|
| services.headscale.settings.tls_cert_path | Path to already created certificate.
|
| services.i2pd.inTunnels.<name>.outbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.fedimintd.<name>.api.bind | Address to bind on for API connections relied by the reverse proxy/tls terminator.
|
| services.fedimintd.<name>.api.port | Port to bind on for API connections relied by the reverse proxy/tls terminator.
|
| services.grafana.settings.security.secret_key | Secret key used for signing
|
| services.hercules-ci-agent.settings.staticSecretsDirectory | This is the default directory to look for statically configured secrets like cluster-join-token.key
|
| systemd.timers.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.slices.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.units.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.paths.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.sourcehut.settings."hg.sr.ht".changegroup-script | A changegroup script which is installed in every mercurial repo
|
| services.dendrite.settings.sync_api.search.index_path | The path the search index will be created in.
|
| services.warpgate.settings.http.external_port | The HTTP listener is reachable via this port externally.
|
| services.dokuwiki.sites.<name>.acl.*.actor | User or group to restrict
|
| services.bepasty.servers.<name>.dataDir | Path to the directory where the pastes will be saved to
|
| services.syncthing.settings.options.localAnnounceEnabled | Whether to send announcements to the local LAN, also use such announcements to find other devices.
|
| services.grafana.provision.alerting.rules.settings.apiVersion | Config file version.
|
| services.kanidm.server.settings.online_backup.path | Path to the output directory for backups.
|
| services.tahoe.introducers.<name>.nickname | The nickname of this Tahoe introducer.
|
| services.nghttpx.backends.*.params.dns | Name resolution of a backends host name is done at start up,
or configuration reload
|
| services.fedimintd.<name>.nginx.config.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.your_spotify.settings.API_ENDPOINT | The endpoint of your server
This api has to be reachable from the device you use the website from not from the server
|
| users.extraUsers.<name>.createHome | Whether to create the home directory and ensure ownership as well as
permissions to match the user.
|
| virtualisation.podman.defaultNetwork.settings | Settings for podman's default network.
|
| services.h2o.hosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host
configuration.
|
| systemd.user.services.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.timers.<name>.aliases | Aliases of that unit.
|
| systemd.slices.<name>.aliases | Aliases of that unit.
|
| services.namecoind.rpc.user | User name for RPC connections.
|
| services.bitcoind.<name>.extraConfig | Additional configurations to be appended to bitcoin.conf.
|
| security.pam.services.<name>.limits.*.type | Type of this limit
|
| systemd.user.timers.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.user.slices.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.libeufin.bank.settings.libeufin-bankdb-postgres.CONFIG | The database connection string for the libeufin-bank database.
|
| services.pid-fan-controller.settings.heatSources.*.wildcardPath | Path of the heat source's hwmon temp_input file
|
| services.lldap.settings.ldap_user_email | Admin email.
|
| services.slskd.settings.retention.transfers.upload.errored | Lifespan of errored upload tasks.
|
| security.acme.certs.<name>.csrKey | Path to the private key to the matching certificate signing request.
|
| systemd.timers.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.slices.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.i2pd.outTunnels.<name>.outbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.kubernetes.kubelet.taints.<name>.key | Key of taint.
|
| services.logcheck.ignore.<name>.level | Set the logcheck level.
|
| services.sanoid.datasets.<name>.daily | Number of daily snapshots.
|
| services.znapzend.zetup.<name>.enable | Whether to enable this source.
|
| services.nextcloud.settings.mail_smtpport | This depends on mail_smtpmode
|
| security.pam.services.<name>.mysqlAuth | If set, the pam_mysql module will be used to
authenticate users against a MySQL/MariaDB database.
|
| services.grafana.provision.alerting.muteTimings.settings | Grafana mute timings configuration in Nix
|
| services.nextcloud-spreed-signaling.settings.turn.apikeyFile | The path to the file containing the value for turn.apikey
|
| services.nextcloud-spreed-signaling.settings.turn.secretFile | The path to the file containing the value for turn.secret
|
| services.kanidm.provision.persons.<name>.legalName | Full legal name
|
| users.users.<name>.useDefaultShell | If true, the user's shell will be set to
users.defaultUserShell.
|
| services.nginx.virtualHosts.<name>.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.tor.settings.AuthoritativeDirectory | See torrc manual.
|
| services.grafana.settings.server.read_timeout | Sets the maximum time using a duration format (5s/5m/5ms)
before timing out read of an incoming request and closing idle connections.
0 means there is no timeout for reading the request.
|
| services.grafana.provision.alerting.rules.settings.deleteRules | List of alert rule UIDs that should be deleted.
|
| services.opentelemetry-collector.settings | Specify the configuration for Opentelemetry Collector in Nix
|
| services.sharkey.settings.fulltextSearch.provider | Which provider to use for full text search
|
| nix.settings.trusted-substituters | List of binary cache URLs that non-root users can use (in
addition to those specified using
nix.settings.substituters) by passing
--option binary-caches to Nix commands.
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.sabnzbd.settings.misc.bandwidth_max | Maximum bandwidth in bytes(!)/sec (supports prefixes)
|
| programs.tsmClient.servers.<name>.servername | Local name of the IBM TSM server,
must not contain space or more than 64 chars.
|
| services.chhoto-url.settings.hash_algorithm | The hash algorithm to use for passwords and API keys
|
| systemd.targets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.sockets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| security.pam.services.<name>.limits.*.item | Item this limit applies to
|
| systemd.services.<name>.serviceConfig | Each attribute in this set specifies an option in the
[Service] section of the unit
|
| services.fedimintd.<name>.nginx.config.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.prometheus.alertmanager-ntfy.settings | Configuration of alertmanager-ntfy
|
| services.k3s.autoDeployCharts.<name>.repo | The repo of the Helm chart
|
| security.acme.certs.<name>.group | Group running the ACME client.
|
| environment.etc.<name>.user | User name of file owner
|
| services.metricbeat.modules.<name>.module | The name of the module
|
| services.mackerel-agent.settings.host_status.on_start | Host status after agent startup.
|
| systemd.user.services.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.services.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| networking.networkmanager.settings | Configuration added to the generated NetworkManager.conf, note that you can overwrite settings with this
|
| services.veilid.settings.client_api.ipc_enabled | veilid-server will respond to Python and other JSON client requests.
|
| services.nvme-rs.settings.thresholds.wear_warning | Wear warning threshold (%)
|
| services.bacula-sd.director.<name>.tls.require | Require TLS or TLS-PSK encryption
|
| services.bacula-fd.director.<name>.tls.require | Require TLS or TLS-PSK encryption
|
| services.udp-over-tcp.udp2tcp.<name>.nodelay | Enables TCP_NODELAY on the TCP socket.
|
| services.nsd.zones.<name>.rrlWhitelist | Whitelists the given rrl-types.
|
| services.udp-over-tcp.tcp2udp.<name>.forward | The IP and port to forward all traffic to.
|
| services.udp-over-tcp.udp2tcp.<name>.forward | The IP and port to forward all traffic to.
|
| services.udp-over-tcp.tcp2udp.<name>.nodelay | Enables TCP_NODELAY on the TCP socket.
|
| services.firezone.server.provision.accounts.<name>.actors.<name>.email | The email address used to authenticate as this account
|
| nix.registry.<name>.exact | Whether the from reference needs to match exactly
|
| users.users.<name>.packages | The set of packages that should be made available to the user
|
| services.suricata.settings.logging.stacktrace-on-signal | Requires libunwind to be available when Suricata is configured and built
|
| services.grafana.provision.datasources.settings | Grafana datasource configuration in Nix
|
| services.nextcloud.settings.mail_smtpauth | This depends on mail_smtpmode
|
| services.dependency-track.settings."alpine.data.directory" | Defines the path to the data directory
|
| services.drupal.sites.<name>.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.
|
| services.warpgate.settings.mysql.external_port | The MySQL listener is reachable via this port externally.
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.adapter | The auth adapter type
|
| services.xserver.xkb.extraLayouts.<name>.compatFile | The path to the xkb compat file
|
| services.kimai.sites.<name>.database.user | Database user.
|
| services.logcheck.ignoreCron.<name>.user | User that runs the cronjob.
|
| services.prosody.virtualHosts.<name>.ssl | Paths to SSL files
|
| services.livekit.settings.rtc.port_range_end | End of UDP port range for WebRTC
|
| services.lasuite-docs.collaborationServer.settings | Configuration options of collaboration server
|
| systemd.user.timers.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.slices.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.grafana.provision.alerting.policies.settings | Grafana notification policies configuration in Nix
|
| systemd.network.networks.<name>.stochasticFairnessQueueingConfig | Each attribute in this set specifies an option in the
[StochasticFairnessQueueing] section of the unit
|
| services.tuned.settings.update_interval | Update interval for dynamic tuning (in seconds).
|
| services.lldap.settings.jwt_secret_file | Path to a file containing the JWT secret.
|
| services.nvme-rs.settings.thresholds.temp_warning | Temperature warning threshold (°C)
|
| services.postfix.settings.main.mydestination | List of domain names intended for local delivery using /etc/passwd and /etc/aliases.
Do not include virtual domains in this list.
https://www.postfix.org/postconf.5.html#mydestination
|
| security.pam.services.<name>.makeHomeDir | Whether to try to create home directories for users
with $HOMEs pointing to nonexistent
locations on session login.
|
| security.pam.services.<name>.updateWtmp | Whether to update /var/log/wtmp.
|
| services.bird-lg.frontend.nameFilter | Protocol names to hide in summary tables (RE2 syntax),
|
| services.nylon.<name>.bindInterface | Tell nylon which interface to use as an uplink, default is "enp3s0f0".
|
| systemd.user.services.<name>.startAt | Automatically start this unit at the given date/time, which
must be in the format described in
systemd.time(7)
|
| services.tor.settings.V3AuthoritativeDirectory | See torrc manual.
|
| services.k3s.autoDeployCharts.<name>.hash | The hash of the packaged Helm chart
|
| services.synapse-auto-compressor.settings.levels | Sizes of each new level in the compression algorithm, as a comma-separated list
|
| services.postfix.masterConfig.<name>.type | The type of the service
|
| services.quickwit.settings.listen_address | Listen address of Quickwit.
|
| services.matrix-continuwuity.settings.global.port | The port(s) continuwuity will be running on
|
| systemd.targets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.sockets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.paths.<name>.upholds | Keeps the specified running while this unit is running
|
| security.pam.services.<name>.enableUMask | If enabled, the pam_umask module will be loaded.
|
| services.acpid.handlers.<name>.action | Shell commands to execute when the event is triggered.
|
| services.logcheck.ignore.<name>.regex | Regex specifying which log lines to ignore.
|
| systemd.user.services.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.grafana.settings.users.allow_sign_up | Set to false to prohibit users from being able to sign up / create user accounts
|
| services.redis.servers.<name>.user | User account under which this instance of redis-server runs.
If left as the default value this user will automatically be
created on system activation, otherwise you are responsible for
ensuring the user exists before the redis service starts.
|
| services.buildkite-agents.<name>.tags | Tags for the agent.
|
| services.quicktun.<name>.protocol | Which protocol to use.
|
| services.headscale.settings.dns.extra_records | Extra DNS records to expose to clients.
|
| services.rke2.autoDeployCharts.<name>.repo | The repo of the Helm chart
|
| services.dovecot2.pluginSettings | Plugin settings for dovecot in general, e.g. sieve, sieve_default, etc
|
| services.autosuspend.settings.suspend_cmd | The command to execute in case the host shall be suspended
|
| services.hostapd.radios.<name>.band | Specifies the frequency band to use, possible values are 2g for 2.4 GHz,
5g for 5 GHz, 6g for 6 GHz and 60g for 60 GHz.
|
| services.grafana.provision.alerting.rules.settings.deleteRules.*.uid | Unique identifier for the rule
|
| boot.initrd.extraFiles.<name>.source | The object to make available inside the initrd.
|
| services.ax25.axports.<name>.callsign | The callsign of the physical interface to bind to.
|
| services.kimai.sites.<name>.database.host | Database host address.
|
| services.kimai.sites.<name>.database.port | Database host port.
|
| services.netbird.clients.<name>.logLevel | Log level of the NetBird daemon.
|
| services.netbird.tunnels.<name>.logLevel | Log level of the NetBird daemon.
|
| services.drupal.sites.<name>.extraConfig | Extra configuration values that you want to insert into settings.php
|
| services.quicktun.<name>.timeWindow | Allowed time window for first received packet in seconds (positive number allows packets from history)
|
| services.phpfpm.pools.<name>.phpOptions | "Options appended to the PHP configuration file php.ini used for this PHP-FPM pool."
|
| users.mysql.pam.userColumn | The name of the column that contains a unix login name.
|
| services.listmonk.database.settings."privacy.exportable" | List of fields which can be exported through an automatic export request
|
| services.waagent.settings.Provisioning.Enable | Whether to enable provisioning functionality in the agent
|
| services.nginx.virtualHosts.<name>.quic | Whether to enable the QUIC transport protocol
|
| boot.initrd.systemd.users.<name>.uid | ID of the user in initrd.
|
| systemd.user.paths.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.frp.instances.<name>.enable | Whether to enable frp.
|
| services.akkoma.frontends.<name>.ref | Akkoma frontend reference.
|
| services.redis.servers.<name>.unixSocketPerm | Change permissions for the socket
|
| services.github-runners.<name>.package | The github-runner package to use.
|
| services.filebeat.inputs.<name>.type | The input type
|
| services.tahoe.nodes.<name>.client.helper | The furl for a Tahoe helper node
|
| systemd.services.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.taler.exchange.settings.exchangedb-postgres.CONFIG | Database connection URI.
|
| services.taler.merchant.settings.merchantdb-postgres.CONFIG | Database connection URI.
|
| services.prowlarr.settings.update.automatically | Automatically download and install updates.
|
| services.whisparr.settings.update.automatically | Automatically download and install updates.
|
| services.openssh.settings.AuthorizedPrincipalsFile | Specifies a file that lists principal names that are accepted for certificate authentication
|
| security.pam.services.<name>.nodelay | Whether the delay after typing a wrong password should be disabled.
|
| services.grafana.provision.alerting.rules.settings.deleteRules.*.orgId | Organization ID, default = 1
|
| services.dependency-track.settings."alpine.oidc.teams.default" | Defines one or more team names that auto-provisioned OIDC users shall be added to
|
| systemd.user.units.<name>.aliases | Aliases of that unit.
|
| systemd.user.paths.<name>.aliases | Aliases of that unit.
|
| services.rke2.autoDeployCharts.<name>.hash | The hash of the packaged Helm chart
|
| services.nsd.zones.<name>.maxRefreshSecs | Limit refresh time for secondary zones
|
| users.users.<name>.subUidRanges.*.startUid | Start of the range of subordinate user ids that user is
allowed to use.
|
| users.users.<name>.subGidRanges.*.startGid | Start of the range of subordinate group ids that user is
allowed to use.
|
| services.anubis.defaultOptions.settings.OG_PASSTHROUGH | Whether to enable Open Graph tag passthrough
|
| services.gitea.settings.service.DISABLE_REGISTRATION | By default any user can create an account on this gitea instance
|
| networking.vlans.<name>.id | The vlan identifier
|
| services.znapzend.zetup.<name>.plan | The znapzend backup plan to use for the source
|
| services.httpd.virtualHosts.<name>.adminAddr | E-mail address of the server administrator.
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.keySize | Key size in bits
|
| services.tor.relay.onionServices.<name>.map | See torrc manual.
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.keySize | Key size in bits
|
| services.phpfpm.pools.<name>.extraConfig | Extra lines that go into the pool configuration
|
| services.headscale.settings.oidc.allowed_users | Users allowed to authenticate even if not in allowedDomains.
|
| systemd.user.paths.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.slices.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.user.timers.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.grafana.provision.dashboards.settings.apiVersion | Config file version.
|
| services.nextcloud-spreed-signaling.settings.backend.timeout | Timeout in seconds for requests to the backend
|
| fileSystems.<name>.autoFormat | If the device does not currently contain a filesystem (as
determined by blkid), then automatically
format it with the filesystem type specified in
fsType
|
| services.nginx.virtualHosts.<name>.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.honk.servername | The server name.
|
| security.pam.services.<name>.fprintAuth | If set, fingerprint reader will be used (if exists and
your fingerprints are enrolled).
|
| security.pam.u2f.settings.authfile | By default pam-u2f module reads the keys from
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set)
|
| services.biboumi.settings.xmpp_server_ip | The IP address to connect to the XMPP server on
|
| services.kerberos_server.settings.module | Modules to obtain Kerberos configuration from.
|
| services.kerberos_server.settings.realms | The realm(s) to serve keys for.
|
| systemd.paths.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.paths.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| security.pam.services.<name>.limits.*.value | Value of this limit
|
| services.k3s.manifests.<name>.source | Path of the source .yaml file.
|
| services.k3s.manifests.<name>.enable | Whether this manifest file should be generated.
|
| services.gitwatch.<name>.message | Optional text to use in as commit message; all occurrences of %d will be replaced by formatted date/time
|
| networking.jool.siit | Definitions of SIIT instances of Jool
|
| services.dokuwiki.sites.<name>.aclFile | Location of the dokuwiki acl rules
|
| services.openldap.configDir | Use this config directory instead of generating one from the
settings option
|
| services.fedimintd.<name>.nginx.path | Path to host the API on and forward to the daemon's api port
|
| services.pppd.peers.<name>.autostart | Whether the PPP session is automatically started at boot time.
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.signingKeyPath | Path to the signing key file for authenticated media.
|
| services.prometheus.exporters.script.settings | Free-form configuration for script_exporter, expressed as a Nix attrset and rendered to YAML.
Migration note:
The previous format using script = "sleep 5" is no longer supported
|
| services.opensearch.settings."plugins.security.disabled" | Whether to enable the security plugin,
plugins.security.ssl.transport.keystore_filepath or
plugins.security.ssl.transport.server.pemcert_filepath and
plugins.security.ssl.transport.client.pemcert_filepath
must be set for this plugin to be enabled.
|
| services.firewalld.zones.<name>.short | Short description for the zone.
|
| services.firewalld.zones.<name>.rules | Rich rules for the zone.
|
| services.firewalld.zones.<name>.ports | Ports to allow in the zone.
|
| services.restic.backups.<name>.package | The restic package to use.
|
| services.public-inbox.settings.publicinbox.nntpserver | NNTP URLs to this public-inbox instance
|
| services.public-inbox.settings.publicinbox.pop3server | POP3 URLs to this public-inbox instance
|
| services.public-inbox.settings.publicinbox.imapserver | IMAP URLs to this public-inbox instance
|
| services.xserver.xkb.extraLayouts.<name>.symbolsFile | The path to the xkb symbols file
|
| services.nextcloud-spreed-signaling.settings.https.listen | IP and port to listen on for HTTPS requests, in the format of ip:port
|
| services.dokuwiki.sites.<name>.acl.*.level | Permission level to restrict the actor(s) to
|
| services.bepasty.servers.<name>.workDir | Path to the working directory (used for config and pidfile)
|
| services.spiped.config.<name>.encrypt | Take unencrypted connections from the
source socket and send encrypted
connections to the target socket.
|
| services.spiped.config.<name>.decrypt | Take encrypted connections from the
source socket and send unencrypted
connections to the target socket.
|
| systemd.services.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.grafana-image-renderer.settings.rendering.mode | Rendering mode of grafana-image-renderer:
default: Creates on browser-instance
per rendering request.
reusable: One browser instance
will be started and reused for each rendering request.
clustered: allows to precisely
configure how many browser-instances are supposed to be used
|
| users.users.<name>.description | A short description of the user account, typically the
user's full name
|
| security.pam.services.<name>.rssh | If set, the calling user's SSH agent is used to authenticate
against the configured keys
|
| services.redis.servers.<name>.extraParams | Extra parameters to append to redis-server invocation
|
| services.sabnzbd.settings.misc.bandwidth_perc | Percentage of bandwidth_max that sabnzbd is allowed to use.
0 means no limit.
|
| services.autosuspend.settings.wakeup_cmd | The command to execute for scheduling a wake up of the system
|
| networking.sits.<name>.dev | The underlying network device on which the tunnel resides.
|
| services.fedimintd.<name>.package | The fedimint package to use.
|
| services.rspamd.overrides.<name>.text | Text of the file.
|
| services.minidlna.settings.root_container | Use a different container as the root of the directory tree presented to clients.
|
| services.chhoto-url.settings.redirect_method | The redirect method to use.
|
| services.ndppd.proxies.<name>.timeout | Controls how long to wait for a Neighbor Advertisement Message before
invalidating the entry, in milliseconds.
|
| services.quicktun.<name>.remoteFloat | Whether to allow the remote address and port to change when properly encrypted packets are received.
|
| environment.etc.<name>.group | Group name of file owner
|
| services.redis.servers.<name>.save | The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes
|
| services.tahoe.nodes.<name>.storage.enable | Whether to enable storage service.
|
| services.wyoming.piper.servers.<name>.uri | URI to bind the wyoming server to.
|
| services.headscale.settings.dns.extra_records.*.type | DNS record type.
|
| services.nextcloud-spreed-signaling.settings.etcd.endpoints | List of static etcd endpoints to connect to.
|
| services.lasuite-docs.collaborationServer.settings.PORT | Port used by collaboration server to listen to
|
| services.buildkite-agents.<name>.dataDir | The workdir for the agent
|
| services.suricata.settings.exception-policy | Define a common behavior for all exception policies
|
| security.pam.services.<name>.limits | Attribute set describing resource limits
|
| systemd.user.services.<name>.scriptArgs | Arguments passed to the main process script
|
| services.grafana.provision.alerting.contactPoints.settings | Grafana contact points configuration in Nix
|
| services.h2o.hosts.<name>.acme.useHost | An existing Let’s Encrypt certificate to use for this virtual
host
|
| services.fedimintd.<name>.nginx.fqdn | Public domain of the API address of the reverse proxy/tls terminator.
|
| services.h2o.hosts.<name>.tls.identity.*.key-file | Path to key file
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.ttlSeconds | Lifetime in seconds, that generated URLs stay valid
|
| services.grafana.provision.alerting.muteTimings.settings.muteTimes | List of mute time intervals to import or update.
|
| services.suricata.settings.classification-file | Suricata classification configuration file.
|
| services.jupyter.kernels.<name>.logo64 | Path to 64x64 logo png.
|
| services.jupyter.kernels.<name>.logo32 | Path to 32x32 logo png.
|
| services.nginx.virtualHosts.<name>.listen.*.ssl | Enable SSL.
|
| services.nsd.zones.<name>.dnssecPolicy.keyttl | TTL for dnssec records
|
| services.rke2.manifests.<name>.source | Path of the source .yaml file.
|
| services.rke2.manifests.<name>.enable | Whether this manifest file should be generated.
|
| services.jupyterhub.kernels.<name>.displayName | Name that will be shown to the user.
|
| services.httpd.virtualHosts.<name>.acmeRoot | Directory for the acme challenge which is PUBLIC, don't put certs or keys in here
|
| services.nginx.virtualHosts.<name>.acmeRoot | Directory for the ACME challenge, which is public
|
| services.libeufin.nexus.settings.libeufin-nexusdb-postgres.CONFIG | The database connection string for the libeufin-nexus database.
|
| containers.<name>.extraVeths.<name>.forwardPorts.*.protocol | The protocol specifier for port forwarding between host and container
|
| services.sabnzbd.settings.ntfosd.ntfosd_enable | Whether to enable NotifyOSD alerts
|
| services.fedimintd.<name>.nginx.config.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| systemd.services.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.redis.servers.<name>.appendFsync | How often to fsync the append-only log, options: no, always, everysec.
|
| services.fedimintd.<name>.dataDir | Path to the data dir fedimintd will use to store its data
|
| services.httpd.virtualHosts.<name>.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.nginx.virtualHosts.<name>.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.journald.upload.settings.Upload.NetworkTimeoutSec | When network connectivity to the server is lost, this option
configures the time to wait for the connectivity to get restored
|
| services.sanoid.datasets.<name>.yearly | Number of yearly snapshots.
|
| services.sanoid.datasets.<name>.hourly | Number of hourly snapshots.
|
| services.prometheus.exporters.fritz.settings.log_level | Log level to use for the exporter.
|
| services.sourcehut.settings."lists.sr.ht::worker".reject-mimetypes | Comma-delimited list of Content-Types to reject
|
| boot.initrd.luks.devices.<name>.preLVM | Whether the luksOpen will be attempted before LVM scan or after it.
|
| users.extraGroups.<name>.members | The user names of the group members, added to the
/etc/group file.
|
| services.grafana.provision.alerting.templates.settings | Grafana templates configuration in Nix
|
| services.drupal.sites.<name>.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.i2pd.inTunnels.<name>.crypto.tagsToSend | Number of ElGamal/AES tags to send.
|
| services.httpd.virtualHosts.<name>.listen.*.ip | IP to listen on. 0.0.0.0 for IPv4 only, * for all.
|
| services.firezone.server.provision.accounts.<name>.groups.<name>.members | The members of this group
|
| users.extraUsers.<name>.subUidRanges | Subordinate user ids that user is allowed to use
|
| users.extraUsers.<name>.subGidRanges | Subordinate group ids that user is allowed to use
|
| services.dependency-track.settings."alpine.database.mode" | Defines the database mode of operation
|
| power.ups.upsmon.monitor.<name>.type | The relationship with upsd
|
| services.postfix-tlspol.settings.server.socket-permissions | Permissions to the UNIX socket, if configured.
Due to hardening on the systemd unit the socket can never be created world readable/writable.
|
| services.grafana.provision.datasources.settings.prune | When true, provisioned datasources from this file will be deleted
automatically when removed from
services.grafana.provision.datasources.settings.datasources.
|
| services.wgautomesh.settings.lan_discovery | Enable discovery of peers on the same LAN using UDP broadcast.
|
| services.suricata.settings.dpdk.interfaces.*.interface | See upstream docs: docs/capture-hardware/dpdk and docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk.
|
| networking.sits.<name>.ttl | The time-to-live of the connection to the remote tunnel endpoint.
|
| users.extraUsers.<name>.subGidRanges.*.count | Count of subordinate group ids
|
| users.extraUsers.<name>.subUidRanges.*.count | Count of subordinate user ids
|
| services.kea.dhcp-ddns.configFile | Kea DHCP-DDNS configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html
|
| services.drupal.sites.<name>.privateFilesDir | The location of the Drupal private files directory.
|
| security.pam.services.<name>.failDelay.delay | The delay time (in microseconds) on failure.
|
| services.openvpn.servers.<name>.autoStart | Whether this OpenVPN instance should be started automatically.
|
| services.redis.servers.<name>.appendOnly | By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.
|
| services.spiped.config.<name>.timeout | Timeout, in seconds, after which an attempt to connect to
the target or a protocol handshake will be aborted (and the
connection dropped) if not completed
|
| services.httpd.virtualHosts.<name>.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.nginx.virtualHosts.<name>.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.redis.servers.<name>.group | Group account under which this instance of redis-server runs.
If left as the default value this group will automatically be
created on system activation, otherwise you are responsible for
ensuring the group exists before the redis service starts.
|
| services.public-inbox.settings.publicinbox.wwwlisting | Controls which lists (if any) are listed for when the root
public-inbox URL is accessed over HTTP.
|
| services.crowdsec.settings.console.configuration | Attributes inside the console.yaml file.
|
| services.matrix-synapse.settings.enable_metrics | Enable collection and rendering of performance metrics
|
| services.warpgate.settings.http.cookie_max_age | How long until logged in cookie expires.
|
| services.nsd.zones.<name>.multiMasterCheck | If enabled, checks all masters for the last zone version
|
| services.nylon.<name>.allowedIPRanges | Allowed client IP ranges are evaluated first, defaults to ARIN IPv4 private ranges:
[ "192.168.0.0/16" "127.0.0.0/8" "172.16.0.0/12" "10.0.0.0/8" ]
|
| services.xserver.displayManager.lightdm.greeters.slick.font.name | Name of the font to use.
|
| systemd.paths.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.paths.<name>.pathConfig | Each attribute in this set specifies an option in the
[Path] section of the unit
|
| services.kanidm.provision.systems.oauth2.<name>.preferShortUsername | Use 'name' instead of 'spn' in the preferred_username claim
|
| services.transmission.settings.script-torrent-done-enabled | Whether to run
services.transmission.settings.script-torrent-done-filename
at torrent completion.
|
| services.prometheus.alertmanager-ntfy.settings.http.addr | The address to listen on.
|
| services.quicktun.<name>.localAddress | IP address or hostname of the local end.
|
| services.prosody.virtualHosts.<name>.ssl.key | Path to the key file.
|
| services.bacula-sd.director.<name>.tls.key | The path of a PEM encoded TLS private key
|
| security.pam.services.<name>.yubicoAuth | If set, users listed in
~/.yubico/authorized_yubikeys
are able to log in with the associated Yubikey tokens.
|
| services.bacula-fd.director.<name>.tls.key | The path of a PEM encoded TLS private key
|
| networking.jool.nat64 | Definitions of NAT64 instances of Jool
|
| systemd.user.targets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.sockets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.slices.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.timers.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.xserver.displayManager.lightdm.greeters.gtk.theme.name | Name of the theme to use for the lightdm-gtk-greeter.
|
| services.prometheus.exporters.nginxlog.settings.consul | Consul integration options
|
| services.pgbouncer.settings.pgbouncer.listen_port | Which port to listen on
|
| services.bonsaid.settings.*.delay_duration | Nanoseconds to wait after the previous state change before performing this transition
|
| services.dokuwiki.sites.<name>.package | The dokuwiki package to use.
|
| services.drupal.sites.<name>.database.user | Database user.
|
| services.znapzend.zetup.<name>.dataset | The dataset to use for this source.
|
| services.grafana.settings.database.max_open_conn | The maximum number of open connections to the database.
|
| services.pixelfed.secretFile | A secret file to be sourced for the .env settings
|
| services.transmission.settings.incomplete-dir-enabled | |
| services.headscale.settings.prefixes.allocation | Strategy used for allocation of IPs to nodes, available options:
- sequential (default): assigns the next free IP from the previous given IP.
- random: assigns the next free IP from a pseudo-random IP generator (crypto/rand).
|
| services.tlsrpt.reportd.settings.sender_address | Sender address used for reports.
|
| services.cjdns.ETHInterface.connectTo.<name>.hostname | Optional hostname to add to /etc/hosts; prevents reverse lookup failures.
|
| services.cjdns.UDPInterface.connectTo.<name>.hostname | Optional hostname to add to /etc/hosts; prevents reverse lookup failures.
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.kerberos_server.settings.include | Files to include in the Kerberos configuration.
|
| services.archisteamfarm.settings | The ASF.json file, all the options are documented here
|
| services.i2pd.outTunnels.<name>.crypto.tagsToSend | Number of ElGamal/AES tags to send.
|
| services.tahoe.nodes.<name>.sftpd.hostPublicKeyFile | Path to the SSH host public key.
|
| virtualisation.xen.store.settings | The OCaml-based Xen Store Daemon configuration
|
| services.system76-scheduler.settings.cfsProfiles.default.latency | sched_latency_ns.
|
| services.h2o.hosts.<name>.tls.extraSettings | Additional TLS/SSL-related configuration options
|
| services.public-inbox.inboxes.<name>.watch | Paths for public-inbox-watch(1) to monitor for new mail.
|
| services.matrix-synapse.settings.listeners.*.x_forwarded | Use the X-Forwarded-For (XFF) header as the client IP and not the
actual client IP.
|
| services.grafana.settings.security.cookie_secure | Set to true if you host Grafana behind HTTPS.
|
| services.grafana.settings.database.max_idle_conn | The maximum number of connections in the idle connection pool.
|
| services.slskd.settings.retention.transfers.download.errored | Lifespan of errored download tasks.
|
| services.transmission.settings.incomplete-dir | When enabled with
services.transmission.home
services.transmission.settings.incomplete-dir-enabled,
new torrents will download the files to this directory
|
| services.prometheus.exporters.rtl_433.channels.*.name | Name to match.
|
| services.graylog.rootUsername | Name of the default administrator user
|
| services.maubot.settings.crypto_database | Separate database URL for the crypto database
|
| services.rss2email.feeds.<name>.to | Email address to which to send feed items
|
| services.umurmur.settings.default_channel | The channel in which users will appear in when connecting.
|
| services.postgresql.systemCallFilter.<name>.enable | Whether to enable ‹name› in postgresql's syscall filter.
|
| services.system76-scheduler.settings.cfsProfiles.default.preempt | Preemption mode.
|
| systemd.user.services.<name>.serviceConfig | Each attribute in this set specifies an option in the
[Service] section of the unit
|
| services.drupal.sites.<name>.database.host | Database host address.
|
| services.borgbackup.jobs.<name>.repo | Remote or local repository to back up to.
|
| services.drupal.sites.<name>.database.port | Database host port.
|
| services.httpd.virtualHosts.<name>.listen.*.port | Port to listen on
|
| services.iodine.clients.<name>.extraConfig | Additional command line parameters
|
| services.nginx.virtualHosts.<name>.listen.*.addr | Listen address.
|
| services.matrix-continuwuity.settings.global.address | Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator
|
| services.udp-over-tcp.tcp2udp.<name>.threads | Sets the number of worker threads to use
|
| services.system76-scheduler.settings.cfsProfiles.default.nr-latency | sched_nr_latency.
|
| services.headscale.settings.dns.extra_records.*.value | DNS record value (IP address).
|
| services.matrix-synapse.settings.public_baseurl | The public-facing base URL for the client API (not including _matrix/...)
|
| services.jupyterhub.kernels.<name>.language | Language of the environment
|
| systemd.user.sockets.<name>.wants | Start the specified units when this unit is started.
|
| systemd.user.targets.<name>.wants | Start the specified units when this unit is started.
|
| users.extraUsers.<name>.autoSubUidGidRange | Automatically allocate subordinate user and group ids for this user
|
| services.nginx.virtualHosts.<name>.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.mchprs.settings.block_in_hitbox | Allow placing blocks inside of players
(hitbox logic is simplified)
|
| services.parsedmarc.settings.elasticsearch.ssl | Whether to use an encrypted SSL/TLS connection.
|
| services.httpd.virtualHosts.<name>.listen.*.ssl | Whether to enable SSL (https) support.
|
| services.restic.backups.<name>.exclude | Patterns to exclude when backing up
|
| services.ddclient.username | User name.
|
| services.grafana.provision.alerting.muteTimings.settings.apiVersion | Config file version.
|
| services.hans.clients.<name>.passwordFile | File that contains password
|
| services.nginx.virtualHosts.<name>.default | Makes this vhost the default.
|
| fileSystems.<name>.autoResize | If set, the filesystem is grown to its maximum size before
being mounted. (This is typically the size of the containing
partition.) This is currently only supported for ext2/3/4
filesystems that are mounted during early boot.
|
| virtualisation.qemu.drives.*.name | A name for the drive
|
| services.mpd.settings.music_directory | The directory or URI where MPD reads music from
|
| services.kanidm.provision.persons.<name>.displayName | Display name
|
| services.prometheus.exporters.script.settings.scripts.*.script | Shell script to execute when metrics are requested.
|
| services.nvme-rs.settings.thresholds.wear_critical | Wear critical threshold (%)
|
| services.tor.settings.UseMicrodescriptors | See torrc manual.
|
| services.geth.<name>.websocket.enable | Whether to enable Go Ethereum WebSocket API.
|
| services.udp-over-tcp.tcp2udp.<name>.recvTimeout | An application timeout on receiving data from the TCP socket.
|
| services.udp-over-tcp.udp2tcp.<name>.recvTimeout | An application timeout on receiving data from the TCP socket.
|
| systemd.services.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.sockets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.targets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.firewalld.zones.<name>.ports.*.port | |
| users.mysql.nss | Settings for libnss-mysql
|
| services.frp.instances.<name>.role | The frp consists of client and server
|
| services.nsd.zones.<name>.allowAXFRFallback | If NSD as secondary server should be allowed to AXFR if the primary
server does not allow IXFR.
|
| services.slskd.settings.retention.transfers.upload.cancelled | Lifespan of cancelled upload tasks.
|
| services.slskd.settings.retention.transfers.upload.succeeded | Lifespan of succeeded upload tasks.
|
| services.system76-scheduler.settings.processScheduler.enable | Tweak scheduling of individual processes in real time.
|
| services.nextcloud-spreed-signaling.settings.backend.allowall | Allow any hostname as backend endpoint
|
| services.transmission.settings.trash-original-torrent-files | Whether to delete torrents added from the
services.transmission.settings.watch-dir.
|
| services.firezone.server.provision.accounts.<name>.policies.<name>.group | The group which should be allowed access to the given resource.
|
| systemd.sockets.<name>.aliases | Aliases of that unit.
|
| systemd.targets.<name>.aliases | Aliases of that unit.
|
| services.xserver.displayManager.lightdm.greeters.enso.theme.name | Name of the theme to use for the lightdm-enso-os-greeter
|
| services.httpd.virtualHosts.<name>.sslServerKey | Path to server SSL certificate key.
|
| services.znapzend.zetup.<name>.destinations.<name>.presend | Command to run before sending the snapshot to the destination
|
| services.parsedmarc.settings.elasticsearch.user | Username to use when connecting to Elasticsearch, if
required.
|
| services.znapzend.zetup.<name>.sendDelay | Specify delay (in seconds) before sending snaps to the destination
|
| security.pam.services.<name>.u2fAuth | If set, users listed in
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set) are able to log in with the associated U2F key
|
| services.nvme-rs.settings.thresholds.temp_critical | Temperature critical threshold (°C)
|
| services.nvme-rs.settings.thresholds.spare_warning | Available spare warning threshold (%)
|
| systemd.services.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| power.ups.upsmon.monitor.<name>.user | Username from upsd.users for accessing this UPS
|
| systemd.user.targets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.user.sockets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| security.pam.services.<name>.gnupg.storeOnly | Don't send the password immediately after login, but store for PAM
session.
|
| services.snapper.configs.<name>.FSTYPE | Filesystem type
|
| services.geoclue2.appConfig.<name>.isSystem | Whether the application is a system component or not.
|
| services.errbot.instances.<name>.dataDir | Data directory for errbot instance.
|
| services.prosody.virtualHosts.<name>.ssl.cert | Path to the certificate file.
|
| systemd.timers.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.slices.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.sockets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.targets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.fedimintd.<name>.nginx.config.http3 | Whether to enable the HTTP/3 protocol
|
| services.grafana.provision.alerting.policies.settings.apiVersion | Config file version.
|
| services.nginx.virtualHosts.<name>.kTLS | Whether to enable kTLS support
|
| services.dokuwiki.sites.<name>.phpPackage | The php package to use.
|
| services.sanoid.templates.<name>.daily | Number of daily snapshots.
|
| services.redis.servers.<name>.requirePassFile | File with password for the database.
|
| services.vault-agent.instances.<name>.user | User under which this instance runs.
|
| services.keepalived.vrrpInstances.<name>.vmacInterface | Name of the vmac interface to use. keepalived will come up with a name
if you don't specify one.
|
| services.wstunnel.clients.<name>.tlsSNI | Use this as the SNI while connecting via TLS
|
| services.grafana.provision.datasources.settings.apiVersion | Config file version.
|
| services.warpgate.settings.sso_providers.*.provider | SSO provider configurations.
|
| services.homebridge.settings.accessories.*.accessory | Accessory type
|
| services.pgbouncer.settings.pgbouncer.pool_mode | Specifies when a server connection can be reused by other clients.
session
Server is released back to pool after client disconnects
|
| services.reposilite.settings.compressionStrategy | Compression algorithm used by this instance of Reposilite.
none reduces usage of CPU & memory, but requires transfering more data.
|
| services.agate.hostnames | Domain name of this Gemini server, enables checking hostname and port
in requests. (multiple occurrences means basic vhosts)
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.type | The resource type
|
| networking.ipips.<name>.dev | The underlying network device on which the tunnel resides.
|
| boot.initrd.systemd.groups.<name>.gid | ID of the group in initrd.
|
| services.restic.backups.<name>.paths | Which paths to backup, in addition to ones specified via
dynamicFilesFrom
|
| services.grafana.settings.database.query_retries | This setting applies to sqlite3 only and controls the number of times the system retries a query when the database is locked.
|
| systemd.user.units.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.paths.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.timers.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.user.slices.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| virtualisation.xen.store.settings.pidFile | Path to the Xen Store Daemon PID file.
|
| services.jupyter.kernels.<name>.extraPaths | Extra paths to link in kernel directory
|
| services.ytdl-sub.instances.<name>.enable | Whether to enable ytdl-sub instance.
|
| services.headscale.settings.dns.search_domains | Search domains to inject to Tailscale clients.
|
| services.nginx.virtualHosts.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.geoipupdate.settings.DatabaseDirectory | The directory to store the database files in
|
| services.dokuwiki.sites.<name>.acl | Access Control Lists: see https://www.dokuwiki.org/acl
Mutually exclusive with services.dokuwiki.aclFile
Set this to a value other than null to take precedence over aclFile option
|
| services.xserver.displayManager.lightdm.greeters.gtk.iconTheme.name | Name of the icon theme to use for the lightdm-gtk-greeter.
|
| services.kea.ctrl-agent.configFile | Kea Control Agent configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html
|
| services.kanata.keyboards.<name>.port | Port to run the TCP server on. null will not run the server.
|
| systemd.user.slices.<name>.aliases | Aliases of that unit.
|
| systemd.user.timers.<name>.aliases | Aliases of that unit.
|
| services.github-runners.<name>.enable | Whether to enable GitHub Actions runner
|
| services.stash.settings.preview_segments | Number of segments in a preview file
|
| services.stash.settings.sound_on_preview | Enable sound on mouseover previews
|
| services.xserver.displayManager.lightdm.greeters.slick.theme.name | Name of the theme to use for the lightdm-slick-greeter.
|
| services.fedimintd.<name>.nginx.enable | Whether to configure nginx for fedimintd
|
| services.drupal.sites.<name>.virtualHost.hostName | Canonical hostname for the server.
|
| services.firewalld.zones.<name>.target | Action for packets that doesn't match any rules.
|
| services.httpd.virtualHosts.<name>.sslServerCert | Path to server SSL certificate.
|
| services.syncoid.commands.<name>.service | Systemd configuration specific to this syncoid service.
|
| services.wstunnel.servers.<name>.tlsKey | TLS key to use instead of the hardcoded on in case of HTTPS connections
|
| services.fedimintd.<name>.api_ws.url | Public URL of the API address of the reverse proxy/tls terminator
|
| systemd.user.services.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.nextcloud.settings.mail_smtphost | This depends on mail_smtpmode
|
| services.radicale.config | Radicale configuration, this will set the service
configuration file
|
| services.grafana.settings.server.enforce_domain | Redirect to correct domain if the host header does not match the domain
|
| services.httpd.virtualHosts.<name>.servedDirs | This option provides a simple way to serve static directories.
|
| security.pam.services.<name>.ttyAudit.enable | Enable or disable TTY auditing for specified users
|
| services.hostapd.radios.<name>.wifi6.enable | Enables support for IEEE 802.11ax (WiFi 6, HE)
|
| services.tahoe.nodes.<name>.client.shares.total | The number of shares required to store a file.
|
| services.xserver.xkb.extraLayouts.<name>.keycodesFile | The path to the xkb keycodes file
|
| systemd.user.timers.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.slices.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.vdirsyncer.jobs.<name>.group | group to run vdirsyncer as
|
| services.ergochat.configFile | Path to configuration file
|
| services.akkoma.initDb.username | Name of the database user to initialise the database with
|
| systemd.slices.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.slices.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.timers.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.timers.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.buildkite-agents.<name>.hooks | "Agent" hooks to install
|
| services.ytdl-sub.instances.<name>.config | Configuration for ytdl-sub
|
| services.geoclue2.appConfig.<name>.users | List of UIDs of all users for which this application is allowed location
info access, Defaults to an empty string to allow it for all users.
|
| services.prometheus.exporters.script.settings.scripts.*.timeout | Optional timeout for the script in seconds.
|
| services.nextcloud.settings.mail_smtpdebug | Enable SMTP class debugging.
loglevel will likely need to be adjusted too.
See docs.
|
| services.fedimintd.<name>.api_ws.bind | Address to bind on for API connections relied by the reverse proxy/tls terminator.
|
| services.parsedmarc.settings.elasticsearch.hosts | A list of Elasticsearch hosts to push parsed reports
to.
|
| services.warpgate.settings.postgres.external_port | The PostgreSQL listener is reachable via this port externally.
|
| services.wyoming.piper.servers.<name>.piper | The piper-tts package to use.
|
| services.fedimintd.<name>.nginx.config | Overrides to the nginx vhost section for api
|
| services.tahoe.nodes.<name>.sftpd.accounts.url | URL of the accounts server.
|
| services.sympa.domains.<name>.webLocation | URL path part of the web interface.
|
| services.neo4j.ssl.policies.<name>.clientAuth | The client authentication stance for this policy.
|
| services.grafana.provision.dashboards.settings.providers | List of dashboards to insert/update.
|
| services.mollysocket.settings.allowed_uuids | UUIDs of Signal accounts that may use this server
|
| services.kanidm.server.settings.online_backup.schedule | The schedule for backups in cron format.
|
| services.postfix.masterConfig.<name>.args | Arguments to pass to the command
|
| services.syncoid.commands.<name>.sshKey | SSH private key file to use to login to the remote system
|
| networking.ipips.<name>.ttl | The time-to-live of the connection to the remote tunnel endpoint.
|
| nix.checkAllErrors | If enabled, checks the nix.conf parsing for any kind of error
|
| services.grafana.provision.alerting.rules.settings.groups.*.interval | Interval that the rule group should be evaluated at
|
| services.listmonk.database.settings."app.notify_emails" | Administrator emails for system notifications
|
| security.pam.services.<name>.usshAuth | If set, users with an SSH certificate containing an authorized principal
in their SSH agent are able to log in
|
| services.hostapd.radios.<name>.wifi5.enable | Enables support for IEEE 802.11ac (WiFi 5, VHT)
|
| services.netbird.tunnels.<name>.ui.enable | Controls presence of netbird-ui wrapper for this NetBird client.
|
| services.tarsnap.archives.<name>.maxbw | Abort archival if upstream bandwidth usage in bytes
exceeds this threshold.
|
| services.netbird.clients.<name>.ui.enable | Controls presence of netbird-ui wrapper for this NetBird client.
|
| services.vdirsyncer.jobs.<name>.user | User account to run vdirsyncer as, otherwise as a systemd
dynamic user
|
| services.matrix-appservice-irc.settings.database.connectionString | The database connection string
|
| services.awstats.configs.<name>.logFile | The log file to be scanned
|
| containers.<name>.config | A specification of the desired configuration of this
container, as a NixOS module.
|
| containers.<name>.autoStart | Whether the container is automatically started at boot-time.
|
| services.davis.nginx.locations.<name>.root | Root directory for requests.
|
| services.movim.nginx.locations.<name>.root | Root directory for requests.
|
| services.pgbackrest.repos.<name>.host | Repository host when operating remotely
|
| services.slskd.nginx.locations.<name>.root | Root directory for requests.
|
| services.firefox-syncserver.database.name | Database to use for storage
|
| services.grafana.provision.alerting.muteTimings.settings.deleteMuteTimes | List of mute time intervals that should be deleted.
|
| services.httpd.virtualHosts.<name>.logFormat | Log format for Apache's log files
|
| services.caddy.virtualHosts.<name>.logFormat | Configuration for HTTP request logging (also known as access logs)
|
| hardware.alsa.cardAliases.<name>.id | The ID of the sound card
|
| services.mediagoblin.settings.mediagoblin.plugins | Plugins to enable
|
| systemd.user.services.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| security.pam.services.<name>.limits.*.domain | Username, groupname, or wildcard this limit applies to
|
| services.buildkite-agents.<name>.shell | Command that buildkite-agent 3 will execute when it spawns a shell.
|
| services.nylon.<name>.acceptInterface | Tell nylon which interface to listen for client requests on, default is "lo".
|
| services.wyoming.piper.servers.<name>.useCUDA | Whether to accelerate the underlying onnxruntime library with CUDA.
|
| services.k3s.autoDeployCharts.<name>.extraDeploy | List of extra Kubernetes manifests to deploy with this Helm chart.
|
| services.github-runners.<name>.url | Repository to add the runner to
|
| services.borgbackup.jobs.<name>.appendFailedSuffix | Append a .failed suffix
to the archive name, which is only removed if
borg create has a zero exit status.
|
| services.errbot.instances.<name>.logLevel | Errbot log level
|
| services.sanoid.datasets.<name>.monthly | Number of monthly snapshots.
|
| services.tahoe.nodes.<name>.tub.location | The external location that the node should listen on
|
| security.pam.services.<name>.sshAgentAuth | If set, the calling user's SSH agent is used to authenticate
against the keys in the calling user's
~/.ssh/authorized_keys
|
| services.grafana.settings.server.router_logging | Set to true for Grafana to log all HTTP requests (not just errors)
|
| services.fedimintd.<name>.api_ws.port | TCP Port to bind on for API connections relayed by the reverse proxy/tls terminator.
|
| systemd.services.<name>.requisite | Similar to requires
|
| programs.ssh.knownHosts.<name>.hostNames | A list of host names and/or IP numbers used for accessing
the host's ssh service
|
| services.dokuwiki.sites.<name>.phpOptions | Options for PHP's php.ini file for this dokuwiki site.
|
| services.httpd.virtualHosts.<name>.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.rspamd.workers.<name>.bindSockets | List of sockets to listen, in format acceptable by rspamd
|
| services.xserver.displayManager.lightdm.greeters.enso.iconTheme.name | Name of the icon theme to use for the lightdm-enso-os-greeter
|
| services.netbird.clients.<name>.dir.state | A state directory used by NetBird client to store config.json, state.json & resolv.conf.
|
| services.netbird.tunnels.<name>.dir.state | A state directory used by NetBird client to store config.json, state.json & resolv.conf.
|
| services.syncthing.settings.options.maxFolderConcurrency | This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.label | Each address may be tagged with a label string
|
| services.github-runners.<name>.workDir | Working directory, available as $GITHUB_WORKSPACE during workflow runs
and used as a default for repository checkouts
|
| fileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| systemd.user.targets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.user.sockets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.user.paths.<name>.upholds | Keeps the specified running while this unit is running
|
| services.nginx.proxyCachePath.<name>.levels | The levels parameter defines structure of subdirectories in cache: from
1 to 3, each level accepts values 1 or 2
|
| services.tahoe.nodes.<name>.client.shares.happy | The number of distinct storage nodes required to store
a file.
|
| services.rspamd.workers.<name>.extraConfig | Additional entries to put verbatim into worker section of rspamd config file.
|
| services.nginx.virtualHosts.<name>.extraConfig | These lines go to the end of the vhost verbatim.
|
| services.grafana.provision.alerting.contactPoints.settings.apiVersion | Config file version.
|
| containers.<name>.extraVeths.<name>.forwardPorts.*.containerPort | Target port of container
|
| services.xserver.xkb.extraLayouts.<name>.geometryFile | The path to the xkb geometry file
|
| services.omnom.settings.app.results_per_page | Number of results per page.
|
| services.mobilizon.settings.":mobilizon".":instance".email_from | The email for the From: header in emails
|
| services.znapzend.zetup.<name>.destinations.<name>.postsend | Command to run after sending the snapshot to the destination
|
| systemd.user.services.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.redis.servers.<name>.slowLogLogSlowerThan | Log queries whose execution take longer than X in milliseconds.
|
| containers.<name>.path | As an alternative to specifying
config, you can specify the path to
the evaluated NixOS system configuration, typically a
symlink to a system profile.
|
| users.extraUsers.<name>.useDefaultShell | If true, the user's shell will be set to
users.defaultUserShell.
|
| security.pam.services.<name>.setLoginUid | Set the login uid of the process
(/proc/self/loginuid) for auditing
purposes
|
| services.mailpit.instances.<name>.smtp | SMTP bind interface and port.
|
| services.snipe-it.nginx.locations.<name>.root | Root directory for requests.
|
| services.tarsnap.archives.<name>.nodump | Exclude files with the nodump flag.
|
| services.rspamd.workers.<name>.includes | List of files to include in configuration
|
| services.syncoid.commands.<name>.extraArgs | Extra syncoid arguments for this command.
|
| services.wstunnel.clients.<name>.enable | Whether to enable this wstunnel instance.
|
| services.wstunnel.servers.<name>.enable | Whether to enable this wstunnel instance.
|
| users.extraUsers.<name>.description | A short description of the user account, typically the
user's full name
|
| services.grafana.provision.alerting.policies.settings.policies | List of contact points to import or update.
|
| services.warpgate.settings.config_provider | Source of truth of users
|
| services.dokuwiki.sites.<name>.poolConfig | Options for the DokuWiki PHP pool
|
| services.nntp-proxy.users.<name>.passwordHash | SHA-512 password hash (can be generated by
mkpasswd -m sha-512 <password>)
|
| security.acme.certs.<name>.validMinDays | Minimum remaining validity before renewal in days.
|
| boot.initrd.systemd.users.<name>.shell | The path to the user's shell in initrd.
|
| boot.initrd.systemd.users.<name>.group | Group the user belongs to in initrd.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| security.pam.services.<name>.requireWheel | Whether to permit root access only to members of group wheel.
|
| services.rke2.autoDeployCharts.<name>.extraDeploy | List of extra Kubernetes manifests to deploy with this Helm chart.
|
| services.firefox-syncserver.settings.tokenserver.enabled | Whether to enable the token service as well.
|
| services.veilid.settings.client_api.ipc_directory | IPC directory where file sockets are stored.
|
| services.buildkite-agents.<name>.enable | Whether to enable this buildkite agent
|
| services.vault-agent.instances.<name>.group | Group under which this instance runs.
|
| services.openssh.settings.PasswordAuthentication | Specifies whether password authentication is allowed.
|
| systemd.nspawn.<name>.execConfig | Each attribute in this set specifies an option in the
[Exec] section of this unit
|
| systemd.timers.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.slices.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.matrix-conduit.settings.global.database_path | Path to the conduit database, the directory where conduit will save its data
|
| networking.vswitches.<name>.interfaces.<name>.vlan | Vlan tag to apply to interface
|
| networking.vswitches.<name>.interfaces.<name>.type | Openvswitch type to assign to interface
|
| services.firezone.server.provision.accounts.<name>.groups.<name>.forceMembers | Ensure that only the given members are part of this group at every server start.
|
| services.tahoe.nodes.<name>.sftpd.hostPrivateKeyFile | Path to the SSH host private key.
|
| services.kmonad.keyboards.<name>.config | Keyboard configuration.
|
| services.opkssh.providers.<name>.issuer | Issuer URI
|
| services.chhoto-url.settings.disable_frontend | Whether to disable the frontend.
|
| users.extraUsers.<name>.packages | The set of packages that should be made available to the user
|
| services.icecast.hostname | DNS name or IP address that will be used for the stream directory lookups or possibly the playlist generation if a Host header is not provided.
|
| services.httpd.virtualHosts.<name>.http2 | Whether to enable HTTP 2
|
| services.glitchtip.settings.ENABLE_USER_REGISTRATION | When true, any user will be able to register
|
| services.home-assistant.config.homeassistant.name | Name of the location where Home Assistant is running.
|
| services.grafana.provision.alerting.templates.settings.apiVersion | Config file version.
|
| services.restic.backups.<name>.extraBackupArgs | Extra arguments passed to restic backup.
|
| services.tahoe.nodes.<name>.sftpd.accounts.file | Path to the accounts file.
|
| services.redis.servers.<name>.openFirewall | Whether to open ports in the firewall for the server.
|
| users.users.<name>.expires | Set the date on which the user's account will no longer be
accessible
|
| services.xserver.displayManager.lightdm.greeters.slick.iconTheme.name | Name of the icon theme to use for the lightdm-slick-greeter.
|
| services.grafana.provision.alerting.muteTimings.settings.deleteMuteTimes.*.orgId | Organization ID, default = 1.
|
| services.veilid.settings.core.network.dht.min_peer_count | Minimum number of nodes to keep in the peer table.
|
| systemd.user.paths.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.paths.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| security.pam.services.<name>.sssdStrictAccess | enforce sssd access control
|
| services.udp-over-tcp.tcp2udp.<name>.openFirewall | Open the appropriate ports in the firewall.
|
| services.udp-over-tcp.udp2tcp.<name>.openFirewall | Open the appropriate ports in the firewall.
|
| services.public-inbox.inboxes.<name>.address | The email addresses of the public-inbox.
|
| services.nezha-agent.settings.skip_procs_count | Do not monitor the number of processes.
|
| services.wordpress.sites.<name>.fontsDir | This directory is used to download fonts from a remote location, e.g.
to host google fonts locally.
|
| services.i2pd.ifname | Network interface to bind to.
|
| security.acme.certs.<name>.keyType | Key type to use for private keys
|
| services.kanidm.server.settings.online_backup.versions | Number of backups to keep
|
| services.hickory-dns.configFile | Path to an existing toml file to configure hickory-dns with
|
| services.grafana.provision.dashboards.settings.providers.*.type | Dashboard provider type.
|
| power.ups.ups.<name>.maxStartDelay | This can be set as a global variable above your first UPS
definition and it can also be set in a UPS section
|
| services.kimai.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| security.pam.services.<name>.howdy.control | This option sets the PAM "control" used for this module.
|
| services.borgbackup.jobs.<name>.paths | Path(s) to back up
|
| systemd.services.<name>.restartIfChanged | Whether the service should be restarted during a NixOS
configuration switch if its definition has changed.
|
| services.geoclue2.appConfig.<name>.desktopID | Desktop ID of the application.
|
| services.rspamd.overrides.<name>.source | Path of the source file.
|
| services.sanoid.templates.<name>.hourly | Number of hourly snapshots.
|
| services.sanoid.templates.<name>.yearly | Number of yearly snapshots.
|
| services.matrix-synapse.settings.listeners.*.resources.*.compress | Whether synapse should compress HTTP responses to clients that support it
|
| services.synapse-auto-compressor.settings.chunk_size | The number of state groups to work on at once
|
| services.nginx.proxyCachePath.<name>.useTempPath | Nginx first writes files that are destined for the cache to a temporary
storage area, and the use_temp_path=off directive instructs Nginx to
write them to the same directories where they will be cached
|
| services.matrix-synapse.settings.max_upload_size | The largest allowed upload size in bytes
|
| services.warpgate.settings.http.session_max_age | How long until a logged in session expires.
|
| services.journald.upload.settings.Upload.TrustedCertificateFile | SSL CA certificate
|
| services.gitlab-runner.services.<name>.tagList | Tag list
|
| services.geth.<name>.websocket.address | Listen address of Go Ethereum WebSocket API.
|
| services.borgbackup.jobs.<name>.postInit | Shell commands to run after borg init.
|
| services.geth.<name>.authrpc.jwtsecret | Path to a JWT secret for authenticated RPC endpoint.
|
| services.wstunnel.clients.<name>.autoStart | Whether to enable starting this wstunnel instance automatically.
|
| services.wstunnel.servers.<name>.autoStart | Whether to enable starting this wstunnel instance automatically.
|
| services.prometheus.alertmanagerIrcRelay.settings | Configuration for Alertmanager IRC Relay as a Nix attribute set
|
| services.auto-epp.settings.Settings.epp_state_for_AC | energy_performance_preference when on plugged in
See available epp states by running:
cat /sys/devices/system/cpu/cpu0/cpufreq/energy_performance_available_preferences
|
| services.github-runners.<name>.extraLabels | Extra labels in addition to the default (unless disabled through the noDefaultLabels option)
|
| services.firewalld.zones.<name>.version | Version of the zone.
|
| services.borgmatic.settings.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| virtualisation.xen.store.settings.quota.maxSize | Size limit for transactions.
|
| networking.fooOverUDP.<name>.port | Local port of the encapsulation UDP socket.
|
| power.ups.ups.<name>.directives | List of configuration directives for this UPS.
|
| services.restic.backups.<name>.pruneOpts | A list of options (--keep-* et al.) for 'restic forget
--prune', to automatically prune old snapshots
|
| services.kanidm.server.settings.ldapbindaddress | Address and port the LDAP server is bound to
|
| services.chhoto-url.settings.try_longer_slugs | Whether to try a longer UID upon collision.
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.baseurl | The base URL of the ntfy.sh instance.
|
| services.httpd.virtualHosts.<name>.sslServerChain | Path to server SSL chain file.
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.rollPeriod | How frequently to change keys
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.rollPeriod | How frequently to change keys
|
| services.tarsnap.archives.<name>.maxbwRateUp | Upload bandwidth rate limit in bytes.
|
| security.pam.services.<name>.forwardXAuth | Whether X authentication keys should be passed from the
calling user to the target user (e.g. for
su)
|
| services.borgbackup.jobs.<name>.user | The user borg is run as
|
| services.nginx.virtualHosts.<name>.listen.*.port | Port number to listen on
|
| containers.<name>.extraVeths | Extra veth-pairs to be created for the container.
|
| services.xserver.displayManager.lightdm.greeters.gtk.cursorTheme.name | Name of the cursor theme to use for the lightdm-gtk-greeter.
|
| services.restic.backups.<name>.command | Command to pass to --stdin-from-command
|
| services.borgbackup.repos.<name>.path | Where to store the backups
|
| security.pam.services.<name>.logFailures | Whether to log authentication failures in /var/log/faillog.
|
| systemd.sockets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.targets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.auto-epp.settings.Settings.epp_state_for_BAT | energy_performance_preference when on battery
See available epp states by running:
cat /sys/devices/system/cpu/cpu0/cpufreq/energy_performance_available_preferences
|
| security.wrappers.<name>.group | The group of the wrapper program.
|
| security.wrappers.<name>.owner | The owner of the wrapper program.
|
| services.dokuwiki.sites.<name>.mergedConfig | Read only representation of the final configuration.
|
| services.anubis.instances.<name>.enable | Whether to enable this instance of Anubis.
|
| services.kmonad.keyboards.<name>.device | Path to the keyboard's device file.
|
| services.errbot.instances.<name>.admins | List of identifiers of errbot admins.
|
| services.firewalld.zones.<name>.icmpBlocks | ICMP types to block in the zone.
|
| services.davis.nginx.locations.<name>.index | Adds index directive.
|
| services.davis.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.restic.backups.<name>.progressFps | Controls the frequency of progress reporting.
|
| services.movim.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.slskd.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.slskd.nginx.locations.<name>.index | Adds index directive.
|
| services.movim.nginx.locations.<name>.index | Adds index directive.
|
| services.gitlab-runner.services.<name>.description | Name/description of the runner.
|
| services.slskd.settings.retention.transfers.download.cancelled | Lifespan of cancelled download tasks.
|
| services.slskd.settings.retention.transfers.download.succeeded | Lifespan of succeeded download tasks.
|
| users.extraUsers.<name>.subGidRanges.*.startGid | Start of the range of subordinate group ids that user is
allowed to use.
|
| users.extraUsers.<name>.subUidRanges.*.startUid | Start of the range of subordinate user ids that user is
allowed to use.
|
| virtualisation.xen.store.settings.quota.maxPath | Path limit for the quota system.
|
| environment.etc.<name>.text | Text of the file.
|
| services.tahoe.nodes.<name>.client.shares.needed | The number of shares required to reconstitute a file.
|
| systemd.user.services.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.bluemap.storage.<name>.storage-type | Type of storage config
|
| services.awstats.configs.<name>.hostAliases | List of aliases the site has.
|
| services.opkssh.providers.<name>.clientId | OAuth client ID
|
| services.pgbackrest.repos.<name>.sftp-host | SFTP repository host
|
| services.redis.servers.<name>.databases | Set the number of databases.
|
| services.wordpress.sites.<name>.package | The wordpress package to use.
|
| security.acme.certs.<name>.postRun | Commands to run after new certificates go live
|
| services.taler.merchant.settings.merchant.LEGAL_PRESERVATION | How long to keep data in the database for tax audits after the transaction has completed.
|
| services.nsd.zones.<name>.children | Children zones inherit all options of their parents
|
| services.borgbackup.jobs.<name>.preHook | Shell commands to run before the backup
|
| services.netbird.clients.<name>.config | Additional configuration that exists before the first start and
later overrides the existing values in config.json
|
| services.netbird.tunnels.<name>.config | Additional configuration that exists before the first start and
later overrides the existing values in config.json
|
| services.drupal.sites.<name>.virtualHost.adminAddr | E-mail address of the server administrator.
|
| security.acme.certs.<name>.email | Email address for account creation and correspondence from the CA
|
| services.pingvin-share.hostname | The domain name of your instance
|
| services.httpd.virtualHosts.<name>.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| services.nginx.virtualHosts.<name>.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| systemd.user.services.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.tlsrpt.reportd.settings.sendmail_script | Path to a sendmail-compatible executable for delivery reports.
|
| services.caddy.virtualHosts.<name>.extraConfig | Additional lines of configuration appended to this virtual host in the
automatically generated Caddyfile.
|
| services.jitsi-videobridge.xmppConfigs.<name>.hostName | Hostname of the XMPP server to connect to
|
| services.httpd.virtualHosts.<name>.listen | Listen addresses and ports for this virtual host.
This option overrides addSSL, forceSSL and onlySSL
|
| services.neo4j.ssl.policies.<name>.trustAll | Makes this policy trust all remote parties
|
| boot.initrd.luks.devices.<name>.device | Path of the underlying encrypted block device.
|
| networking.sits.<name>.local | The address of the local endpoint which the remote
side should send packets to.
|
| services.veilid.settings.core.network.routing_table.node_id | Base64-encoded public key for the node, used as the node's ID.
|
| services.slskd.settings.flags.force_share_scan | Force a rescan of shares on every startup.
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".http.port | The port to run the server
|
| systemd.services.<name>.enableDefaultPath | Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
|
| services.wstunnel.clients.<name>.addNetBind | Whether to enable Whether add CAP_NET_BIND_SERVICE to the tunnel service, this should be enabled if you want to bind port < 1024.
|
| services.journald.remote.settings.Remote.ServerCertificateFile | A path to a SSL certificate file in PEM format
|
| services.firewalld.settings.IPv6_rpfilter | Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704
|
| systemd.user.paths.<name>.pathConfig | Each attribute in this set specifies an option in the
[Path] section of the unit
|
| systemd.user.paths.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.anubis.instances.<name>.user | The user under which Anubis is run
|
| security.pam.services.<name>.enableAppArmor | Enable support for attaching AppArmor profiles at the
user/group level, e.g., as part of a role based access
control scheme.
|
| services.k3s.autoDeployCharts.<name>.version | The version of the Helm chart
|
| services.tarsnap.archives.<name>.period | Create archive at this interval
|
| services.firewalld.services.<name>.ports | Ports of the service.
|
| services.fluidd.nginx.locations.<name>.root | Root directory for requests.
|
| services.akkoma.nginx.locations.<name>.root | Root directory for requests.
|
| services.gancio.nginx.locations.<name>.root | Root directory for requests.
|
| services.fedimintd.<name>.bitcoin.rpc.kind | Kind of a bitcoin node.
|
| services.monica.nginx.locations.<name>.root | Root directory for requests.
|
| services.matomo.nginx.locations.<name>.root | Root directory for requests.
|
| services.snipe-it.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.snipe-it.nginx.locations.<name>.index | Adds index directive.
|
| services.vdirsyncer.jobs.<name>.enable | Whether to enable this vdirsyncer job.
|
| services.github-runners.<name>.nodeRuntimes | List of Node.js runtimes the runner should support.
|
| services.dokuwiki.sites.<name>.usersFile | Location of the dokuwiki users file
|
| programs.dms-shell.plugins.<name>.src | Source of the plugin package or path
|
| services.gitlab-runner.services.<name>.limit | Limit how many jobs can be handled concurrently by this service.
0 (default) simply means don't limit.
|
| services.nginx.proxyCachePath.<name>.inactive | Cached data that has not been accessed for the time specified by
the inactive parameter is removed from the cache, regardless of
its freshness.
|
| systemd.user.timers.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.slices.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.parsedmarc.settings.general.save_forensic | Save forensic report data to Elasticsearch and/or Splunk.
|
| services.hercules-ci-agent.settings.concurrentTasks | Number of tasks to perform simultaneously
|
| virtualisation.docker.daemon.settings | Configuration for docker daemon
|
| boot.specialFileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| containers.<name>.bindMounts | An extra list of directories that is bound to the container.
|
| services.restic.backups.<name>.extraOptions | Extra extended options to be passed to the restic --option flag.
|
| services.awstats.configs.<name>.logFormat | The log format being used
|
| services.znapzend.zetup.<name>.presnap | Command to run before snapshots are taken on the source dataset,
e.g. for database locking/flushing
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".http.ip | The IP address to listen on
|
| services.kimai.sites.<name>.database.charset | Database charset.
|
| systemd.paths.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.wstunnel.clients.<name>.soMark | Mark network packets with the SO_MARK sockoption with the specified value
|
| services.udp-over-tcp.udp2tcp.<name>.recvBufferSize | If given, sets the SO_RCVBUF option on the TCP socket to the given number of bytes
|
| services.udp-over-tcp.tcp2udp.<name>.sendBufferSize | If given, sets the SO_SNDBUF option on the TCP socket to the given number of bytes
|
| services.udp-over-tcp.tcp2udp.<name>.recvBufferSize | If given, sets the SO_RCVBUF option on the TCP socket to the given number of bytes
|
| services.udp-over-tcp.udp2tcp.<name>.sendBufferSize | If given, sets the SO_SNDBUF option on the TCP socket to the given number of bytes
|
| services.redis.servers.<name>.requirePass | Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
|
| services.k3s.autoDeployCharts.<name>.values | Override default chart values via Nix expressions
|
| services.neo4j.ssl.policies.<name>.ciphers | Restrict the allowed ciphers of this policy to those defined
here
|
| services.quicktun.<name>.remoteAddress | IP address or hostname of the remote end (use 0.0.0.0 for a floating/dynamic remote endpoint).
|
| services.kanata.keyboards.<name>.extraArgs | Extra command line arguments passed to kanata.
|
| services.netbird.tunnels.<name>.dir.runtime | A runtime directory used by NetBird client.
|
| services.netbird.clients.<name>.dir.runtime | A runtime directory used by NetBird client.
|
| services.wyoming.piper.servers.<name>.extraArgs | Extra arguments to pass to the server commandline.
|
| services.wyoming.piper.servers.<name>.enable | Whether to enable Wyoming Piper server.
|
| services.xserver.displayManager.lightdm.greeters.enso.cursorTheme.name | Name of the cursor theme to use for the lightdm-enso-os-greeter
|
| services.wstunnel.servers.<name>.listen.host | The hostname.
|
| services.wstunnel.servers.<name>.listen.port | The port.
|
| services.grafana.provision.alerting.policies.settings.resetPolicies | List of orgIds that should be reset to the default policy.
|
| services.livekit.settings.rtc.use_external_ip | When set to true, attempts to discover the host's public IP via STUN
|
| services.firezone.server.provision.accounts.<name>.policies.<name>.resource | The resource to which access should be allowed.
|
| services.firewalld.zones.<name>.services | Services to allow in the zone.
|
| services.firewalld.services.<name>.short | Short description for the service.
|
| security.pam.services.<name>.ttyAudit.openOnly | Set the TTY audit flag when opening the session,
but do not restore it when closing the session
|
| services.searx.limiterSettings | Limiter settings for SearXNG.
|
| users.ldap.base | The distinguished name of the search base.
|
| services.fedimintd.<name>.nginx.config.root | The path of the web root directory.
|
| services.bacula-sd.device.<name>.extraDeviceConfig | Extra configuration to be passed in Device directive.
|
| systemd.network.networks.<name>.enhancedTransmissionSelectionConfig | Each attribute in this set specifies an option in the
[EnhancedTransmissionSelection] section of the unit
|
| services.drupal.sites.<name>.virtualHost.acmeRoot | Directory for the acme challenge which is PUBLIC, don't put certs or keys in here
|
| security.pam.services.<name>.failDelay.enable | If enabled, this will replace the FAIL_DELAY setting from login.defs
|
| services.anubis.instances | An attribute set of Anubis instances
|
| systemd.sockets.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.targets.<name>.upholds | Keeps the specified running while this unit is running
|
| services.nextcloud.settings.trusted_proxies | Trusted proxies, to provide if the nextcloud installation is being
proxied to secure against e.g. spoofing.
|
| services.nextcloud.settings.trusted_domains | Trusted domains, from which the nextcloud installation will be
accessible
|
| services.restic.backups.<name>.timerConfig | When to run the backup
|
| services.rke2.autoDeployCharts.<name>.version | The version of the Helm chart
|
| services.fedimintd.<name>.bitcoin.rpc.url | Bitcoin node (bitcoind/electrum/esplora) address to connect to
|
| services.hostapd.radios.<name>.wifi6.require | Require stations (clients) to support WiFi 6 (HE) and disassociate them if they don't.
|
| virtualisation.oci-containers.containers.<name>.networks | Networks to attach the container to
|
| services.drupal.sites.<name>.virtualHost.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| security.pam.services.<name>.howdy.enable | Whether to enable the Howdy PAM module
|
| services.davis.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.iodine.clients.<name>.passwordFile | Path to a file containing the password.
|
| services.slskd.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.movim.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.restic.backups.<name>.passwordFile | Read the repository password from a file.
|
| services.system76-scheduler.settings.cfsProfiles.default.bandwidth-size | sched_cfs_bandwidth_slice_us.
|
| users.users.<name>.isNormalUser | Indicates whether this is an account for a “real” user
|
| power.ups.users.<name>.passwordFile | The full path to a file that contains the user's (clear text)
password
|
| services.borgbackup.jobs.<name>.group | The group borg is run as
|
| services.httpd.virtualHosts.<name>.extraConfig | These lines go to httpd.conf verbatim
|
| services.restic.backups.<name>.rcloneConfig | Configuration for the rclone remote being used for backup
|
| services.geoclue2.appConfig.<name>.isAllowed | Whether the application will be allowed access to location information.
|
| services.anubis.instances.<name>.policy | Anubis policy configuration
|
| services.drupal.sites.<name>.virtualHost.listen.*.ip | IP to listen on. 0.0.0.0 for IPv4 only, * for all.
|
| services.netbird.tunnels.<name>.login.enable | Whether to enable automated login for NetBird client.
|
| services.netbird.clients.<name>.login.enable | Whether to enable automated login for NetBird client.
|
| documentation.man.mandoc.settings.output.style | Path to the file used for an external style-sheet
|
| services.wstunnel.servers.<name>.package | The wstunnel package to use.
|
| services.wstunnel.clients.<name>.package | The wstunnel package to use.
|
| services.h2o.hosts.<name>.tls.redirectCode | HTTP status used by globalRedirect & forceSSL
|
| services.rke2.autoDeployCharts.<name>.values | Override default chart values via Nix expressions
|
| services.spiped.config.<name>.waitForDNS | Wait for DNS
|
| systemd.user.sockets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.slices.<name>.sliceConfig | Each attribute in this set specifies an option in the
[Slice] section of the unit
|
| systemd.nspawn.<name>.filesConfig | Each attribute in this set specifies an option in the
[Files] section of this unit
|
| systemd.user.targets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.borgbackup.jobs.<name>.postPrune | Shell commands to run after borg prune.
|
| virtualisation.xen.store.settings.quota.maxWatch | Maximum number of watches by the Xenstore Watchdog.
|
| services.hostapd.radios.<name>.wifi7.enable | Enables support for IEEE 802.11be (WiFi 7, EHT)
|
| services.drupal.sites.<name>.virtualHost.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.hostapd.radios.<name>.wifi4.enable | Enables support for IEEE 802.11n (WiFi 4, HT)
|
| services.dokuwiki.sites.<name>.plugins | List of path(s) to respective plugin(s) which are copied into the 'plugin' directory.
These plugins need to be packaged before use, see example.
|
| services.bepasty.servers.<name>.extraConfig | Extra configuration for bepasty server to be appended on the
configuration.
see https://bepasty-server.readthedocs.org/en/latest/quickstart.html#configuring-bepasty
for all options.
|
| services.hostapd.radios.<name>.wifi4.require | Require stations (clients) to support WiFi 4 (HT) and disassociate them if they don't.
|
| services.hostapd.radios.<name>.wifi5.require | Require stations (clients) to support WiFi 5 (VHT) and disassociate them if they don't.
|
| security.agnos.settings.accounts.*.certificates | Certificates for agnos to issue or renew.
|
| virtualisation.xen.store.settings.enableMerge | Whether to enable transaction merge support.
|
| services.netbird.clients.<name>.autoStart | Start the service with the system
|
| services.openvpn.servers.<name>.config | Configuration of this OpenVPN instance
|
| services.netbird.tunnels.<name>.autoStart | Start the service with the system
|
| systemd.user.sockets.<name>.aliases | Aliases of that unit.
|
| systemd.user.targets.<name>.aliases | Aliases of that unit.
|
| services.livekit.settings.rtc.port_range_start | Start of UDP port range for WebRTC
|
| services.tarsnap.archives.<name>.maxbwRateDown | Download bandwidth rate limit in bytes.
|
| services.xserver.displayManager.lightdm.greeters.slick.cursorTheme.name | Name of the cursor theme to use for the lightdm-slick-greeter.
|
| services.mpdscribble.endpoints.<name>.username | Username for the scrobble service.
|
| services.firewalld.zones.<name>.sources.*.mac | A MAC address.
|
| services.firewalld.zones.<name>.sourcePorts | Source ports to allow in the zone.
|
| services.snipe-it.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.wyoming.piper.servers.<name>.noiseScale | Generator noise value.
|
| services.gitlab-runner.services.<name>.cloneUrl | Overwrite the URL for the GitLab instance
|
| services.grafana.provision.alerting.contactPoints.settings.contactPoints | List of contact points to import or update.
|
| services.hostapd.radios.<name>.driver | The driver hostapd will use.
nl80211 is used with all Linux mac80211 drivers.
none is used if building a standalone RADIUS server that does
not control any wireless/wired driver
|
| services.redis.servers.<name>.masterAuth | If the master is password protected (using the requirePass configuration)
it is possible to tell the slave to authenticate before starting the replication synchronization
process, otherwise the master will refuse the slave request.
(STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
|
| systemd.user.slices.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.user.targets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.sockets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.timers.<name>.upholds | Keeps the specified running while this unit is running
|
| services.postfix.masterConfig.<name>.wakeup | Automatically wake up the service after the specified number of
seconds
|
| systemd.user.services.<name>.requisite | Similar to requires
|
| users.users.<name>.isSystemUser | Indicates if the user is a system user or not
|
| services.swapspace.settings.lower_freelimit | Lower free-space threshold: if the percentage of free space drops below this number, additional swapspace is allocated
|
| services.adguardhome.settings.schema_version | Schema version for the configuration
|
| services.fedimintd.<name>.nginx.path_ws | Path to host the API on and forward to the daemon's api port
|
| services.drupal.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| systemd.targets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.targets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.sockets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.sockets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.snapper.configs.<name>.ALLOW_USERS | List of users allowed to operate with the config. "root" is always
implicitly included
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.id | IKE identity to use for authentication round
|
| services.buildkite-agents.<name>.package | The buildkite-agent package to use.
|
| virtualisation.xen.store.settings.quota.enable | Whether to enable the quota system.
|
| services.nextcloud-spreed-signaling.settings.sessions.hashkeyFile | The path to the file containing the value for sessions.hashkey
|
| services.znapzend.zetup.<name>.mbuffer.size | The size for mbuffer
|
| services.hostapd.radios.<name>.channel | The channel to operate on
|
| services.glitchtip.settings.ENABLE_ORGANIZATION_CREATION | When false, only superusers will be able to create new organizations after the first
|
| services.maubot.configMutable | Whether maubot should write updated config into extraConfigFile. This will make your Nix module settings have no effect besides the initial config, as extraConfigFile takes precedence over NixOS settings!
|
| services.tuned.settings.recommend_command | Whether to enable recommend functionality.
|
| services.quickwit.settings.grpc_listen_port | The port to listen on for gRPC traffic.
|
| services.nylon.<name>.nrConnections | The number of allowed simultaneous connections to the daemon, default 10.
|
| services.ytdl-sub.instances.<name>.readWritePaths | List of paths that ytdl-sub can write to.
|
| services.borgbackup.repos.<name>.user | The user borg serve is run as
|
| systemd.services.<name>.confinement.mode | The value full-apivfs (the default) sets up
private /dev, /proc,
/sys, /tmp and /var/tmp file systems
in a separate user name space
|
| services.kanidm.provision.systems.oauth2.<name>.displayName | Display name
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert | Section for a certificate candidate to use for
authentication
|
| services.drupal.sites.<name>.virtualHost.listen.*.port | Port to listen on
|
| services.anubis.instances.<name>.extraFlags | A list of extra flags to be passed to Anubis.
|
| services.nginx.upstreams.<name>.extraConfig | These lines go to the end of the upstream verbatim.
|
| services.tarsnap.archives.<name>.verbose | Whether to produce verbose logging output.
|
| services.vault-agent.instances.<name>.enable | Whether to enable this vault-agent instance.
|
| services.wyoming.piper.servers.<name>.noiseWidth | Phoneme width noise value.
|
| networking.sits.<name>.remote | The address of the remote endpoint to forward traffic over.
|
| services.prometheus.exporters.fritz.settings.devices.*.host_info | Enable extended host info for this device. Warning: This will heavily increase scrape time.
|
| services.minidlna.settings.enable_subtitles | Enable subtitle support on unknown clients.
|
| services.anki-sync-server.users.*.username | User name accepted by anki-sync-server.
|
| virtualisation.xen.store.settings.perms.enable | Whether to enable the node permission system.
|
| services.swapspace.settings.upper_freelimit | Upper free-space threshold: if the percentage of free space exceeds this number, swapspace will attempt to free up swapspace
|
| services.nextcloud.config.dbname | Database name.
|
| fileSystems.<name>.encrypted.blkDev | Location of the backing encrypted device.
|
| services.anubis.instances.<name>.group | The group under which Anubis is run
|
| services.wordpress.sites.<name>.themes | Path(s) to respective theme(s) which are copied from the 'theme' directory.
These themes need to be packaged before use, see example.
|
| services.dokuwiki.sites.<name>.extraConfigs | Path(s) to additional configuration files that are then linked to the 'conf' directory.
|
| services.borgbackup.jobs.<name>.extraArgs | Additional arguments for all borg calls the
service has
|
| services.firewalld.zones.<name>.sources | Source addresses, address ranges, MAC addresses or ipsets to bind.
|
| services.fedimintd.<name>.nginx.path_ui | Path to host the built-in UI on and forward to the daemon's api port
|
| services.drupal.sites.<name>.virtualHost.listen.*.ssl | Whether to enable SSL (https) support.
|
| virtualisation.xen.store.settings.quota.maxEntity | Entity limit for transactions.
|
| services.biboumi.settings.policy_directory | A directory that should contain the policy files,
used to customize Botan’s behaviour
when negotiating the TLS connections with the IRC servers.
|
| services.fluidd.nginx.locations.<name>.index | Adds index directive.
|
| services.gancio.nginx.locations.<name>.index | Adds index directive.
|
| services.fluidd.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.akkoma.nginx.locations.<name>.index | Adds index directive.
|
| services.akkoma.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.blockbook-frontend.<name>.rpc.url | URL for JSON-RPC connections.
|
| services.jupyterhub.kernels.<name>.env | Environment variables to set for the kernel.
|
| services.gancio.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.monica.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.monica.nginx.locations.<name>.index | Adds index directive.
|
| services.prosody.virtualHosts.<name>.enabled | Whether to enable the virtual host
|
| services.matomo.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.matomo.nginx.locations.<name>.index | Adds index directive.
|
| services.sanoid.datasets.<name>.autosnap | Whether to automatically take snapshots.
|
| services.webhook.hooks.<name>.execute-command | The command that should be executed when the hook is triggered.
|
| services.wstunnel.clients.<name>.connectTo | Server address and port to connect to.
|
| services.mediagoblin.settings.mediagoblin.sql_engine | Database to use.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.latency | sched_latency_ns.
|
| services.logcheck.ignoreCron.<name>.timeArgs | "min hr dom mon dow" crontab time args, to auto-create a cronjob too
|
| services.tor.relay.onionServices.<name>.path | Path where to store the data files of the hidden service
|
| programs.neovim.runtime.<name>.text | Text of the file.
|
| services.nginx.virtualHosts.<name>.listen | Listen addresses and ports for this virtual host
|
| services.nextcloud-spreed-signaling.settings.https.certificate | Path to the certificate used for the HTTPS listener
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters | A list of filter to restrict traffic
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.interface | Optional interface name to restrict outbound IPsec policies.
|
| documentation.man.mandoc.settings.output.toc | Whether to enable printing a table of contents near the beginning of the HTML output
of mandoc(1) if an input file contains at least two
non-standard sections
.
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.prePublish | How long in advance to publish new keys
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.prePublish | How long in advance to publish new keys
|
| services.akkoma.frontends.<name>.package | Akkoma frontend package.
|
| services.sanoid.templates.<name>.monthly | Number of monthly snapshots.
|
| services.vdirsyncer.jobs.<name>.configFile | existing configuration file
|
| systemd.services.<name>.stopIfChanged | If set, a changed unit is restarted by calling
systemctl stop in the old configuration,
then systemctl start in the new one
|
| services.borgbackup.jobs.<name>.doInit | Run borg init if the
specified repo does not exist
|
| services.nextcloud.settings.mail_smtpmode | Which mode to use for sending mail
|
| services.snapper.configs.<name>.ALLOW_GROUPS | List of groups allowed to operate with the config
|
| services.rspamd.overrides.<name>.enable | Whether this file overrides should be generated
|
| services.undervolt.useTimer | Whether to set a timer that applies the undervolt settings every 30s
|
| services.system76-scheduler.settings.cfsProfiles.responsive.preempt | Preemption mode.
|
| systemd.user.slices.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.timers.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.user.timers.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.slices.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.drupal.sites.<name>.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.dovecot2.mailboxes.<name>.auto | Whether to automatically create or create and subscribe to the mailbox or not.
|
| services.blockbook-frontend.<name>.sync | Synchronizes until tip, if together with zeromq, keeps index synchronized.
|
| services.spiped.config.<name>.resolveRefresh | Resolution refresh time for the target socket, in seconds.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.nr-latency | sched_nr_latency.
|
| services.rsync.jobs.<name>.destination | Destination directory.
|
| services.postfix.masterConfig.<name>.chroot | Whether the service is chrooted to have only access to the
services.postfix.queueDir and the closure of
store paths specified by the program option.
|
| services.syncoid.commands.<name>.target | Target ZFS dataset
|
| security.acme.certs.<name>.profile | The certificate profile to choose if the CA offers multiple profiles.
|
| systemd.paths.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.grafana.provision.alerting.templates.settings.templates | List of templates to import or update.
|
| services.mailpit.instances.<name>.max | Maximum number of emails to keep
|
| services.fedimintd.<name>.nginx.config.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.kerberos_server.settings.includedir | Directories containing files to include in the Kerberos configuration.
|
| services.maubot.settings.plugin_databases.sqlite | The directory where SQLite plugin databases should be stored.
|
| services.nginx.virtualHosts.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.k3s.autoDeployCharts.<name>.enable | Whether to enable the installation of this Helm chart
|
| services.sabnzbd.settings.misc.inet_exposure | Restrictions for access from non-local IP addresses
|
| services.tor.relay.onionServices.<name>.version | See torrc manual.
|
| services.v4l2-relayd.instances.<name>.enable | Whether to enable this v4l2-relayd instance.
|
| networking.ipips.<name>.local | The address of the local endpoint which the remote
side should send packets to.
|
| services.firewalld.services.<name>.ports.*.port | |
| services.firezone.server.provision.accounts.<name>.resources.<name>.address | The address of this resource
|
| systemd.user.services.<name>.restartIfChanged | Whether the service should be restarted during a NixOS
configuration switch if its definition has changed.
|
| services.wstunnel.servers.<name>.enableHTTPS | Use HTTPS for the tunnel server.
|
| services.errbot.instances.<name>.plugins | List of errbot plugin derivations.
|
| services.restic.backups.<name>.inhibitsSleep | Prevents the system from sleeping while backing up.
|
| services.system76-scheduler.settings.processScheduler.useExecsnoop | Use execsnoop (otherwise poll the precess list periodically).
|
| services.kanata.keyboards.<name>.config | Configuration other than defcfg
|
| services.wordpress.sites.<name>.poolConfig | Options for the WordPress PHP pool
|
| hardware.tuxedo-drivers.settings.charging-priority | These options manage the trade-off between battery charging and CPU performance when the USB-C power supply cannot provide sufficient power for both simultaneously:
charge_battery prioritizes battery charging (driver default)
performance prioritizes maximum CPU performance
|
| systemd.targets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.sockets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.wstunnel.servers.<name>.listen | Address and port to listen on
|
| services.snapserver.streams.<name>.type | The type of input stream.
|
| services.nginx.virtualHosts.<name>.http2 | Whether to enable the HTTP/2 protocol
|
| hardware.tuxedo-drivers.settings.charging-profile | The maximum charge level to help reduce battery wear:
high_capacity charges to 100% (driver default)
balanced charges to 90%
stationary charges to 80% (maximum lifespan)
Note: Regardless of the configured charging profile, the operating system will always report the battery as being charged to 100%.
|
| security.wrappers.<name>.enable | Whether to enable the wrapper.
|
| services.openssh.knownHosts.<name>.publicKey | The public key data for the host
|
| services.minidlna.settings.notify_interval | The interval between announces (in seconds)
|
| services.davis.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fedimintd.<name>.api_iroh.bind | Address to bind on for Iroh endpoint for API connections
|
| services.syncoid.commands.<name>.useCommonArgs | Whether to add the configured common arguments to this command.
|
| services.movim.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.slskd.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.gitlab-runner.services.<name>.dockerImage | Docker image to be used.
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.dev | The name of the device to add the address to.
|
| services.firewalld.zones.<name>.sourcePorts.*.port | |
| services.buildkite-agents.<name>.tokenPath | The token from your Buildkite "Agents" page
|
| services.headscale.settings.oidc.allowed_domains | Allowed principal domains. if an authenticated user's domain
is not in this list authentication request will be rejected.
|
| services.spiped.config.<name>.source | Address on which spiped should listen for incoming
connections
|
| services.wordpress.sites.<name>.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.openssh.knownHosts.<name>.extraHostNames | A list of additional host names and/or IP numbers used for
accessing the host's ssh service
|
| services.wstunnel.servers.<name>.useACMEHost | Use a certificate generated by the NixOS ACME module for the given host
|
| services.nbd.server.exports.<name>.extraOptions | Extra options for this export
|
| services.netbird.clients.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.netbird.tunnels.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.nextcloud-spreed-signaling.settings.stats.allowed_ips | List of IP addresses that are allowed to access the debug, stats and metrics endpoints
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.eap_id | Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
|
| services.matrix-conduit.settings.global.trusted_servers | Servers trusted with signing server keys.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert | Section for a certificate candidate to use for
authentication
|
| power.ups.users.<name>.instcmds | Let the user initiate specific instant commands
|
| services.dokuwiki.sites.<name>.pluginsConfig | List of the dokuwiki (un)loaded plugins.
|
| services.drupal.sites.<name>.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.public-inbox.inboxes.<name>.coderepo | Nicknames of a 'coderepo' section associated with the inbox.
|
| services.mailpit.instances.<name>.listen | HTTP bind interface and port for UI.
|
| services.rke2.autoDeployCharts.<name>.enable | Whether to enable the installation of this Helm chart
|
| environment.etc.<name>.gid | GID of created file
|
| environment.etc.<name>.uid | UID of created file
|
| services.snapserver.settings.tcp.bind_to_address | Address to listen on for snapclient connections.
|
| services.firezone.server.settingsSecret.TOKENS_SALT | A file containing a unique base64 encoded secret for the
TOKENS_SALT
|
| services.nextcloud.settings.mail_smtpsecure | This depends on mail_smtpmode
|
| services.warpgate.settings.http.sni_certificates | Certificates for additional domains.
|
| services.nextcloud-spreed-signaling.settings.sessions.blockkeyFile | The path to the file containing the value for sessions.blockkey
|
| services.drupal.sites.<name>.virtualHost.servedDirs | This option provides a simple way to serve static directories.
|
| boot.specialFileSystems.<name>.fsType | Type of the file system
|
| systemd.timers.<name>.timerConfig | Each attribute in this set specifies an option in the
[Timer] section of the unit
|
| virtualisation.containerd.settings | Verbatim lines to add to containerd.toml
|
| services.mbpfan.settings.general.polling_interval | The polling interval.
|
| services.grafana.settings.users.allow_org_create | Set to false to prohibit users from creating new organizations.
|
| services.blockbook-frontend.<name>.rpc.port | Port for JSON-RPC connections.
|
| services.gancio.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.blockbook-frontend.<name>.rpc.user | Username for JSON-RPC connections.
|
| services.buildkite-agents.<name>.extraGroups | Groups the user for this buildkite agent should belong to
|
| services.akkoma.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.jupyterhub.kernels.<name>.argv | Command and arguments to start the kernel.
|
| services.fluidd.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.monica.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.matomo.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.sanoid.datasets.<name>.useTemplate | Names of the templates to use for this dataset.
|
| services.journald.remote.settings.Remote.TrustedCertificateFile | A path to a SSL CA certificate file in PEM format, or all
|
| services.httpd.virtualHosts.<name>.forceSSL | Whether to add a separate nginx server block that permanently redirects (301)
all plain HTTP traffic to HTTPS
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.id | IKE identity to expect for authentication round
|
| security.acme.certs.<name>.extraLegoFlags | Additional global flags to pass to all lego commands.
|
| systemd.paths.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.matrix-appservice-irc.settings.ircService.passwordEncryptionKeyPath | Location of the key with which IRC passwords are encrypted
for storage
|
| services.fedimintd.<name>.api_iroh.port | UDP Port to bind Iroh endpoint for API connections
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.postPublish | How long after deactivation to keep a key in the zone
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.postPublish | How long after deactivation to keep a key in the zone
|
| services.github-runners.<name>.extraPackages | Extra packages to add to PATH of the service to make them available to workflows.
|
| power.ups.ups.<name>.shutdownOrder | When you have multiple UPSes on your system, you usually need to
turn them off in a certain order. upsdrvctl shuts down all the
0s, then the 1s, 2s, and so on
|
| services.autorandr.profiles.<name>.hooks | Profile hook scripts.
|
| services.znapzend.zetup.<name>.recursive | Whether to do recursive snapshots.
|
| services.matrix-synapse.settings.media_store_path | Directory where uploaded images and attachments are stored.
|
| services.matrix-synapse.settings.max_image_pixels | Maximum number of pixels that will be thumbnailed
|
| services.matrix-synapse.settings.signing_key_path | Path to the signing key to sign messages with.
|
| services.maubot.settings.server.plugin_base_path | The base path for plugin endpoints
|
| services.rshim.device | Specify the device name to attach
|
| systemd.user.timers.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.user.slices.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.logcheck.ignoreCron.<name>.cmdline | Command line for the cron job
|
| systemd.services.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.caddy.virtualHosts.<name>.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.filebeat.settings.output.elasticsearch.hosts | The list of Elasticsearch nodes to connect to
|
| security.auditd.plugins.<name>.path | This is the absolute path to the plugin executable.
|
| services.fedimintd.<name>.ui.openFirewall | Opens TCP port in firewall for built-in UI
|
| services.klipper.firmwares.<name>.enable | Whether to enable building of firmware for manual flashing
.
|
| services.snipe-it.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.public-inbox.inboxes.<name>.inboxdir | The absolute path to the directory which hosts the public-inbox.
|
| services.public-inbox.settings.publicinboxmda.spamcheck | If set to spamc, public-inbox-watch(1) will filter spam
using SpamAssassin.
|
| services.grafana.settings.database.client_key_path | The path to the client key
|
| networking.supplicant.<name>.bridge | Name of the bridge interface that wpa_supplicant should listen at.
|
| services.borgbackup.repos.<name>.group | The group borg serve is run as
|
| systemd.user.services.<name>.enableDefaultPath | Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
|
| services.znapzend.zetup.<name>.postsnap | Command to run after snapshots are taken on the source dataset,
e.g. for database unlocking
|
| systemd.units.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.paths.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| security.wrappers.<name>.source | The absolute path to the program to be wrapped.
|
| networking.fooOverUDP.<name>.local.dev | Network device to bind to.
|
| services.wstunnel.clients.<name>.localToRemote | Listen on local and forwards traffic from remote.
|
| services.buildkite-agents.<name>.extraConfig | Extra lines to be added verbatim to the configuration file.
|
| security.pam.services.<name>.kwallet.package | The kwallet-pam package to use.
|
| services.prosody.virtualHosts.<name>.extraConfig | Additional virtual host specific configuration
|
| services.znapzend.zetup.<name>.mbuffer.enable | Whether to use mbuffer.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.round | Optional numeric identifier by which authentication rounds are
sorted
|
| systemd.slices.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.timers.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.bepasty.servers.<name>.secretKey | server secret for safe session cookies, must be set
|
| services.grafana.settings.server.static_root_path | Root path for static assets.
|
| services.snapserver.settings.http.bind_to_address | Address to listen on for snapclient connections.
|
| systemd.services.<name>.reloadIfChanged | Whether the service should be reloaded during a NixOS
configuration switch if its definition has changed
|
| services.drupal.sites.<name>.virtualHost.logFormat | Log format for Apache's log files
|
| services.gitlab-runner.services.<name>.buildsDir | Absolute path to a directory where builds will be stored
in context of selected executor (Locally, Docker, SSH).
|
| services.tor.settings.VersioningAuthoritativeDirectory | See torrc manual.
|
| services.orangefs.server.fileSystems.<name>.id | File system ID (must be unique within configuration).
|
| services.errbot.instances.<name>.extraConfig | String to be appended to the config verbatim
|
| services.wyoming.piper.servers.<name>.lengthScale | Phoneme length value.
|
| services.wordpress.sites.<name>.mergedConfig | Read only representation of the final configuration.
|
| services.parsedmarc.settings.general.save_aggregate | Save aggregate report data to Elasticsearch and/or Splunk.
|
| services.drupal.sites.<name>.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.neo4j.ssl.policies.<name>.tlsVersions | Restrict the TLS protocol versions of this policy to those
defined here.
|
| services.wordpress.sites.<name>.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.
|
| services.wyoming.piper.servers.<name>.speaker | ID of a specific speaker in a multi-speaker model.
|
| services.borgbackup.repos.<name>.quota | Storage quota for the repository
|
| services.firewalld.zones.<name>.forwardPorts | Ports to forward in the zone.
|
| services.firewalld.zones.<name>.sources.*.ipset | An ipset.
|
| services.nginx.virtualHosts.<name>.locations | Declarative location config
|
| services.vdirsyncer.jobs.<name>.timerConfig | systemd timer configuration
|
| services.vault-agent.instances.<name>.package | The vault package to use.
|
| services.nvme-rs.settings.thresholds.error_threshold | Error count warning threshold
|
| services.swapspace.settings.cache_elasticity | Percentage of cache space considered to be "free"
|
| networking.fooOverUDP.<name>.local | Local address (and optionally device) to bind to using the given port.
|
| services.nginx.virtualHosts.<name>.forceSSL | Whether to add a separate nginx server block that redirects (defaults
to 301, configurable with redirectCode) all plain HTTP traffic to
HTTPS
|
| services.wstunnel.clients.<name>.extraArgs | Extra command line arguments to pass to wstunnel
|
| services.wstunnel.servers.<name>.extraArgs | Extra command line arguments to pass to wstunnel
|
| services.borgbackup.jobs.<name>.postHook | Shell commands to run just before exit
|
| services.blockbook-frontend.<name>.cssDir | Location of the dir with main.css CSS file
|
| services.nginx.virtualHosts.<name>.rejectSSL | Whether to listen for and reject all HTTPS connections to this vhost
|
| services.fedimintd.<name>.api.openFirewall | Opens port in firewall for fedimintd's api port
|
| services.pgbackrest.stanzas.<name>.jobs | Backups jobs to schedule for this stanza as described in:
https://pgbackrest.org/user-guide.html#quickstart/schedule-backup
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.id | A unique identifier for this authentication token
|
| services.nginx.upstreams.<name>.servers | Defines the address and other parameters of the upstream servers
|
| services.grafana.settings.users.auto_assign_org | Set to true to automatically add new users to the main organization (id 1)
|
| security.acme.certs.<name>.extraLegoRunFlags | Additional flags to pass to lego run.
|
| services.grafana.provision.alerting.contactPoints.settings.deleteContactPoints | List of receivers that should be deleted.
|
| services.system76-scheduler.settings.processScheduler.refreshInterval | Process list poll interval, in seconds
|
| services.matrix-synapse.settings.listeners.*.bind_addresses | IP addresses to bind the listener to.
|
| services.warpgate.settings.http.sni_certificates.*.key | Path to private key.
|
| services.jibri.xmppEnvironments.<name>.call.login.username | User part of the JID for the recorder.
|
| networking.ipips.<name>.remote | The address of the remote endpoint to forward traffic over.
|
| boot.initrd.luks.devices.<name>.gpgCard | The option to use this LUKS device with a GPG encrypted luks password by the GPG Smartcard
|
| services.fedimintd.<name>.nginx.config.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.tarsnap.archives.<name>.keyfile | Set a specific keyfile for this archive
|
| power.ups.upsmon.monitor.<name>.system | Identifier of the UPS to monitor, in this form: <upsname>[@<hostname>[:<port>]]
See upsmon.conf for details.
|
| systemd.user.sockets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.targets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.firezone.server.settingsSecret.TOKENS_KEY_BASE | A file containing a unique base64 encoded secret for the
TOKENS_KEY_BASE
|
| services.firezone.server.settingsSecret.SECRET_KEY_BASE | A file containing a unique base64 encoded secret for the
SECRET_KEY_BASE
|
| services.klipper.firmwares.<name>.serial | Path to serial port this printer is connected to
|
| services.dependency-track.oidc.usernameClaim | Defines the name of the claim that contains the username in the provider's userinfo endpoint
|
| services.grafana.settings.users.default_language | This setting configures the default UI language, which must be a supported IETF language tag, such as en-US.
|
| services.atalkd.interfaces.<name>.config | Optional configuration string for this interface.
|
| services.searx.faviconsSettings | Favicons settings for SearXNG.
|
| containers.<name>.privateNetwork | Whether to give the container its own private virtual
Ethernet interface
|
| services.wordpress.sites.<name>.uploadsDir | This directory is used for uploads of pictures
|
| containers.<name>.extraFlags | Extra flags passed to the systemd-nspawn command
|
| services.wstunnel.clients.<name>.remoteToLocal | Listen on remote and forwards traffic from local
|
| services.blockbook-frontend.<name>.debug | Debug mode, return more verbose errors, reload templates on each request.
|
| services.openafsServer.roles.backup.cellServDB.<name>.*.ip | IP Address of a database server
|
| services.grafana.settings.security.admin_password | Default admin password
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.ports.*.to | The end of the port range, inclusive.
|
| services.grafana.settings.users.viewers_can_edit | Viewers can access and use Explore and perform temporary edits on panels in dashboards they have access to
|
| services.parsedmarc.settings.elasticsearch.cert_path | The path to a TLS certificate bundle used to verify
the server's certificate.
|
| services.ghostunnel.servers.<name>.key | Path to certificate private key (PEM with private key)
|
| services.davis.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.davis.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.movim.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.slskd.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.movim.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.slskd.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.certs | List of certificates to accept for authentication
|
| systemd.services.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.parsedmarc.settings.elasticsearch.password | The password to use when connecting to Elasticsearch,
if required
|
| services.drupal.sites.<name>.virtualHost.http2 | Whether to enable HTTP 2
|
| systemd.paths.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.units.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.ports | Either a single port or port range to allow
|
| users.extraUsers.<name>.expires | Set the date on which the user's account will no longer be
accessible
|
| services.i2pd.ifname4 | IPv4 interface to bind to.
|
| services.i2pd.ifname6 | IPv6 interface to bind to.
|
| services.v4l2-relayd.instances.<name>.input.width | The width to read from input-stream.
|
| services.strongswan-swanctl.swanctl.secrets.rsa.<name>.file | File name in the rsa folder for which this passphrase
should be used.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.round | Optional numeric identifier by which authentication rounds are
sorted
|
| services.jitsi-videobridge.xmppConfigs.<name>.mucNickname | Videobridges use the same XMPP account and need to be distinguished by the
nickname (aka resource part of the JID)
|
| services.ghostunnel.servers.<name>.cert | Path to certificate (PEM with certificate chain)
|
| services.httpd.virtualHosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.httpd.virtualHosts.<name>.robotsEntries | Specification of pages to be ignored by web crawlers
|
| services.fedimintd.<name>.p2p.openFirewall | Opens port in firewall for fedimintd's p2p port (both TCP and UDP)
|
| services.caddy.virtualHosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.nginx.virtualHosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.fedimintd.<name>.nginx.config.quic | Whether to enable the QUIC transport protocol
|
| services.wordpress.sites.<name>.plugins | Path(s) to respective plugin(s) which are copied from the 'plugins' directory.
These plugins need to be packaged before use, see example.
|
| services.snapserver.streams.<name>.codec | Default audio compression method.
|
| services.vdirsyncer.jobs.<name>.config.pairs | vdirsyncer pair configurations
|
| security.wrappers.<name>.setuid | Whether to add the setuid bit the wrapper program.
|
| security.wrappers.<name>.setgid | Whether to add the setgid bit the wrapper program.
|
| networking.wlanInterfaces | Creating multiple WLAN interfaces on top of one physical WLAN device (NIC)
|
| services.openafsServer.cellServDB.*.dnsname | DNS full-qualified domain name of a database server
|
| services.openafsClient.cellServDB.*.dnsname | DNS full-qualified domain name of a database server
|
| containers.<name>.enableTun | Allows the container to create and setup tunnel interfaces
by granting the NET_ADMIN capability and
enabling access to /dev/net/tun.
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.enable | Boost Pipewire client priorities.
|
| services.fedimintd.<name>.bitcoin.network | Bitcoin network to participate in.
|
| systemd.services.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.grafana.settings.database.isolation_level | Only the MySQL driver supports isolation levels in Grafana
|
| systemd.user.paths.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert | Section for a CA certificate to accept for authentication
|
| services.snipe-it.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.snipe-it.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.allAccess | Grants all permissions in the associated organization.
|
| services.firezone.server.provision.accounts.<name>.auth | All authentication providers to provision
|
| services.postgresql.settings.log_line_prefix | A printf-style string that is output at the beginning of each log line
|
| services.drupal.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.akkoma.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.gancio.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fluidd.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.httpd.virtualHosts.<name>.locations | Declarative location config
|
| services.monica.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.matomo.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| containers.<name>.hostBridge | Put the host-side of the veth-pair into the named bridge
|
| services.k3s.manifests.<name>.content | Content of the manifest file
|
| power.ups.ups.<name>.description | Description of the UPS.
|
| services.easytier.instances.<name>.enable | Enable the instance.
|
| services.opkssh.providers.<name>.lifetime | Token lifetime
|
| services.github-runners.<name>.noDefaultLabels | Disables adding the default labels
|
| services.firewalld.services.<name>.version | Version of the service.
|
| services.firewalld.services.<name>.helpers | Helpers for the service.
|
| services.veilid.settings.core.protected_store.directory | The filesystem directory to store your protected store in.
|
| services.ytdl-sub.instances.<name>.schedule | How often to run ytdl-sub
|
| services.hickory-dns.settings.listen_addrs_ipv4 | List of ipv4 addresses on which to listen for DNS queries.
|
| services.hickory-dns.settings.listen_addrs_ipv6 | List of ipv6 addresses on which to listen for DNS queries.
|
| services.grafana.provision.datasources.settings.datasources | List of datasources to insert/update.
|
| services.jibri.xmppEnvironments.<name>.control.muc.roomName | The room name of the MUC to connect to for control.
|
| services.tahoe.introducers.<name>.tub.port | The port on which the introducer will listen.
|
| services.tarsnap.archives.<name>.excludes | Exclude files and directories matching these patterns.
|
| services.headscale.settings.derp.update_frequency | Frequency to update DERP maps.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.ports.*.from | The start of the port range, inclusive.
|
| systemd.user.targets.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.user.sockets.<name>.upholds | Keeps the specified running while this unit is running
|
| services.grafana.provision.alerting.contactPoints.settings.deleteContactPoints.*.uid | Unique identifier for the receiver
|
| services.bitcoind.<name>.prune | Reduce storage requirements by enabling pruning (deleting) of old
blocks
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.tokenFile | The token value
|
| services.blockbook-frontend.<name>.enable | Whether to enable blockbook-frontend application.
|
| services.klipper.firmwares.<name>.package | Path to the built firmware package.
|
| services.nsd.zones.<name>.dnssecPolicy.algorithm | Which algorithm to use for DNSSEC
|
| systemd.services.<name>.environment | Environment variables passed to the service's processes.
|
| services.healthchecks.settings.REGISTRATION_OPEN | A boolean that controls whether site visitors can create new accounts
|
| systemd.timers.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.slices.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.user.services.<name>.stopIfChanged | If set, a changed unit is restarted by calling
systemctl stop in the old configuration,
then systemctl start in the new one
|
| services.borgbackup.jobs.<name>.extraInitArgs | Additional arguments for borg init
|
| services.mosquitto.bridges.<name>.topics | Topic patterns to be shared between the two brokers
|
| services.tarsnap.archives.<name>.lowmem | Reduce memory consumption by not caching small files
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.xauth_id | Client XAuth username used in the XAuth exchange.
|
| services.errbot.instances.<name>.identity | Errbot identity configuration
|
| services.postfix.masterConfig.<name>.maxproc | The maximum number of processes to spawn for this service
|
| services.drupal.sites.<name>.virtualHost.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| services.snapserver.settings.stream.bind_to_address | Address to listen on for snapclient connections.
|
| services.httpd.virtualHosts.<name>.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.nginx.virtualHosts.<name>.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.grafana.provision.dashboards.settings.providers.*.options.path | Path grafana will watch for dashboards
|
| security.acme.certs.<name>.enableDebugLogs | Whether to enable debug logging for this certificate.
|
| services.grafana.provision.alerting.contactPoints.settings.deleteContactPoints.*.orgId | Organization ID, default = 1.
|
| systemd.user.slices.<name>.sliceConfig | Each attribute in this set specifies an option in the
[Slice] section of the unit
|
| services.drupal.sites.<name>.virtualHost.listen | Listen addresses and ports for this virtual host.
This option overrides addSSL, forceSSL and onlySSL
|
| programs.openvpn3.log-service.settings.log_dbus_details | Add D-Bus details in log file/syslog
|
| services.grafana.provision.alerting.templates.settings.deleteTemplates | List of alert rule UIDs that should be deleted.
|
| services.tahoe.nodes.<name>.storage.reservedSpace | The amount of filesystem space to not use for storage.
|
| services.redis.servers.<name>.maxclients | Set the max number of connected clients at the same time.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.eap_id | Identity to use as peer identity during EAP authentication
|
| services.firewalld.zones.<name>.forwardPorts.*.port | |
| services.rke2.manifests.<name>.content | Content of the manifest file
|
| networking.bridges.<name>.rstp | Whether the bridge interface should enable rstp.
|
| networking.greTunnels.<name>.dev | The underlying network device on which the tunnel resides.
|
| services.davis.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.slskd.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.movim.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.gatewayGroups | A list of gateway groups (sites) which can reach the resource and may be used to connect to it.
|
| systemd.network.links.<name>.enable | Whether to enable this .link unit
|
| services.grafana.provision.datasources.settings.datasources.*.url | Url of the datasource.
|
| services.blockbook-frontend.<name>.coinName | See https://github.com/trezor/blockbook/blob/master/bchain/coins/blockchain.go#L61
for current of coins supported in master (Note: may differ from release).
|
| services.borgbackup.jobs.<name>.prune.keep | Prune a repository by deleting all archives not matching any of the
specified retention options
|
| virtualisation.xen.store.settings.quota.maxWatchEvents | Maximum number of outstanding watch events per watch.
|
| services.wstunnel.servers.<name>.restrictTo | Accepted traffic will be forwarded only to this service.
|
| services.keepalived.vrrpScripts.<name>.fall | Required number of failures for KO transition.
|
| services.fedimintd.<name>.nginx.config.listen.*.ssl | Enable SSL.
|
| services.keepalived.vrrpScripts.<name>.rise | Required number of successes for OK transition.
|
| services.blockbook-frontend.<name>.public | Public http server binding [address]:port.
|
| services.fedimintd.<name>.nginx.config.acmeRoot | Directory for the ACME challenge, which is public
|
| environment.etc.<name>.mode | If set to something else than symlink,
the file is copied instead of symlinked, with the given
file mode.
|
| power.ups.upsmon.monitor.<name>.powerValue | Number of power supplies that the UPS feeds on this system
|
| systemd.paths.<name>.requisite | Similar to requires
|
| environment.etc.<name>.source | Path of the source file.
|
| services.nginx.virtualHosts.<name>.reuseport | Create an individual listening socket
|
| services.nsd.zones.<name>.dnssecPolicy.coverage | The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time.
|
| services.autorandr.profiles.<name>.config | Per output profile configuration.
|
| services.authelia.instances.<name>.enable | Whether to enable Authelia instance.
|
| services.sanoid.templates.<name>.autosnap | Whether to automatically take snapshots.
|
| services.matomo.webServerUser | Name of the web server user that forwards requests to services.phpfpm.pools.<name>.socket the fastcgi socket for Matomo if the nginx
option is not used
|
| services.fedimintd.<name>.nginx.config.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.firewalld.zones.<name>.forward | Whether to enable intra-zone forwarding
|
| services.vmalert.instances.<name>.rules | A list of the given alerting or recording rules against configured "datasource.url" compatible with
Prometheus HTTP API for vmalert to execute
|
| services.github-runners.<name>.group | Group under which to run the service
|
| systemd.user.sockets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.sockets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.user.targets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.targets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.snapserver.streams.<name>.query | Key-value pairs that convey additional parameters about a stream.
|
| services.klipper.firmwares.<name>.configFile | Path to firmware config which is generated using klipper-genconf
|
| services.wordpress.sites.<name>.database.user | Database user.
|
| services.nextcloud.settings.mail_smtptimeout | This depends on mail_smtpmode
|
| services.movim.h2o.serverName | Server name to be used for this virtual host
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.present | Whether to ensure that this user is present or absent.
|
| networking.fooOverUDP.<name>.local.address | Local address to bind to
|
| systemd.services.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.firewalld.zones.<name>.forwardPorts.*.to-port | |
| services.restic.backups.<name>.repository | repository to backup to.
|
| systemd.slices.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| containers.<name>.hostAddress | The IPv4 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| systemd.timers.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.snipe-it.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.openssh.settings.KbdInteractiveAuthentication | Specifies whether keyboard-interactive authentication is allowed.
|
| services.postfix.masterConfig.<name>.private | Whether the service's sockets and storage directory is restricted to
be only available via the mail system
|
| services.fedimintd.<name>.nginx.config.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.restic.backups.<name>.dynamicFilesFrom | A script that produces a list of files to back up
|
| systemd.shutdown | Definition of systemd shutdown executables
|
| boot.initrd.luks.devices.<name>.gpgCard.publicKey | Path to the Public Key.
|
| services.sanoid.datasets.<name>.autoprune | Whether to automatically prune old snapshots.
|
| services.wyoming.faster-whisper.servers.<name>.uri | URI to bind the wyoming server to.
|
| services.slurm.nodeName | Name that SLURM uses to refer to a node (or base partition for BlueGene
systems)
|
| services.drupal.sites.<name>.virtualHost.extraConfig | These lines go to httpd.conf verbatim
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.updown | Updown script to invoke on CHILD_SA up and down events.
|
| users.extraUsers.<name>.isNormalUser | Indicates whether this is an account for a “real” user
|
| systemd.network.links.<name>.extraConfig | Extra configuration append to unit
|
| networking.wlanInterfaces.<name>.device | The name of the underlying hardware WLAN device as assigned by udev.
|
| services.headscale.settings.database.postgres.password_file | A file containing the password corresponding to
database.user.
|
| services.mautrix-meta.instances.<name>.dataDir | Path to the directory with database, registration, and other data for the bridge service
|
| services.kanboard.nginx.locations.<name>.root | Root directory for requests.
|
| services.dolibarr.nginx.locations.<name>.root | Root directory for requests.
|
| services.fediwall.nginx.locations.<name>.root | Root directory for requests.
|
| services.librenms.nginx.locations.<name>.root | Root directory for requests.
|
| services.agorakit.nginx.locations.<name>.root | Root directory for requests.
|
| services.mainsail.nginx.locations.<name>.root | Root directory for requests.
|
| services.pixelfed.nginx.locations.<name>.root | Root directory for requests.
|
| services.wordpress.sites.<name>.database.port | Database host port.
|
| services.wordpress.sites.<name>.database.host | Database host address.
|
| programs.dms-shell.plugins.<name>.enable | Whether to enable this plugin
|
| boot.initrd.systemd.contents.<name>.text | Text of the file.
|
| services.grafana.provision.datasources.settings.datasources.*.type | Datasource type
|
| virtualisation.xen.store.settings.quota.maxRequests | Maximum number of requests per transaction.
|
| services.hylafax.modems.<name>.config | Attribute set of values for the given modem
|
| systemd.user.services.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.firewalld.services.<name>.sourcePorts | Source ports for the service.
|
| services.netbird.tunnels.<name>.hardened | Hardened service:
- runs as a dedicated user with minimal set of permissions (see caveats),
- restricts daemon configuration socket access to dedicated user group
(you can grant access to it with
users.users."<user>".extraGroups = [ netbird-‹name› ]),
Even though the local system resources access is restricted:
CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
- older kernels don't have
CAP_BPF and use CAP_SYS_ADMIN instead,
Known security features that are not (yet) integrated into the module:
- 2024-02-14:
rosenpass is an experimental feature configurable solely
through --enable-rosenpass flag on the netbird up command,
see the docs
|
| services.netbird.clients.<name>.hardened | Hardened service:
- runs as a dedicated user with minimal set of permissions (see caveats),
- restricts daemon configuration socket access to dedicated user group
(you can grant access to it with
users.users."<user>".extraGroups = [ netbird-‹name› ]),
Even though the local system resources access is restricted:
CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
- older kernels don't have
CAP_BPF and use CAP_SYS_ADMIN instead,
Known security features that are not (yet) integrated into the module:
- 2024-02-14:
rosenpass is an experimental feature configurable solely
through --enable-rosenpass flag on the netbird up command,
see the docs
|
| services.maubot.settings.plugin_databases.postgres | The connection URL for plugin database
|
| systemd.nspawn.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.timers.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.slices.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.peertube-runner.instancesToRegister.<name>.runnerName | Runner name declared to the PeerTube instance.
|
| services.gitlab-runner.services.<name>.preBuildScript | Runner-specific command script executed after code is pulled,
just before build executes.
|
| services.prefect.workerPools.<name>.installPolicy | install policy for the worker (always, if-not-present, never, prompt)
|
| services.strongswan-swanctl.swanctl.connections.<name>.pools | List of named IP pools to allocate virtual IP addresses
and other configuration attributes from
|
| services.restic.backups.<name>.initialize | Create the repository if it doesn't exist.
|
| services.matrix-conduit.settings.global.allow_federation | Whether this server federates with other servers.
|
| services.matrix-tuwunel.settings.global.allow_federation | Whether this server federates with other servers.
|
| services.kanata.keyboards.<name>.devices | Paths to keyboard devices
|
| services.httpd.virtualHosts.<name>.documentRoot | The path of Apache's document root directory
|
| virtualisation.emptyDiskImages.*.driveConfig.name | A name for the drive
|
| services.grafana.provision.alerting.templates.settings.deleteTemplates.*.orgId | Organization ID, default = 1.
|
| containers.<name>.tmpfs | Mounts a set of tmpfs file systems into the container
|
| services.fluidd.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fluidd.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.akkoma.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.akkoma.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.gancio.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.gancio.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.matomo.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.matomo.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.monica.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.monica.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| console.useXkbConfig | If set, configure the virtual console keymap from the xserver
keyboard settings.
|
| services.strongswan-swanctl.swanctl.secrets.ecdsa.<name>.file | File name in the ecdsa folder for which this
passphrase should be used.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs8.<name>.file | File name in the pkcs8 folder for which this
passphrase should be used.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.bandwidth-size | sched_cfs_bandwidth_slice_us.
|
| services.jibri.xmppEnvironments.<name>.control.muc.nickname | The nickname for this Jibri instance in the MUC.
|
| services.awstats.configs.<name>.webService.enable | Whether to enable awstats web service.
|
| services.easytier.instances.<name>.extraArgs | Extra args append to the easytier command-line.
|
| services.davis.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.slskd.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.movim.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.firewalld.zones.<name>.ports.*.protocol | |
| systemd.user.services.<name>.reloadIfChanged | Whether the service should be reloaded during a NixOS
configuration switch if its definition has changed
|
| systemd.user.paths.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.spiped.config.<name>.weakHandshake | Use fast/weak handshaking: This reduces the CPU time spent
in the initial connection setup, at the expense of losing
perfect forward secrecy.
|
| services.fedimintd.<name>.nginx.config.listen.*.addr | Listen address.
|
| services.v4l2-relayd.instances.<name>.input.height | The height to read from input-stream.
|
| services.syncoid.commands.<name>.sendOptions | Advanced options to pass to zfs send
|
| services.syncoid.commands.<name>.recvOptions | Advanced options to pass to zfs recv
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.certs | List of certificate candidates to use for
authentication
|
| services.kanata.keyboards.<name>.extraDefCfg | Configuration of defcfg other than linux-dev (generated
from the devices option) and
linux-continue-if-no-devs-found (hardcoded to be yes)
|
| services.keyd.keyboards.<name>.extraConfig | Extra configuration that is appended to the end of the file.
Do not write ids section here, use a separate option for it
|
| services.headscale.settings.noise.private_key_path | Path to noise private key file, generated automatically if it does not exist.
|
| security.pam.services.<name>.startSession | If set, the service will register a new session with
systemd's login manager
|
| networking.greTunnels.<name>.ttl | The time-to-live/hoplimit of the connection to the remote tunnel endpoint.
|
| containers.<name>.hostAddress6 | The IPv6 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| services.netbird.tunnels.<name>.dns-resolver.port | A port to serve DNS entries on when dns-resolver.address is enabled.
|
| services.netbird.clients.<name>.dns-resolver.port | A port to serve DNS entries on when dns-resolver.address is enabled.
|
| services.maubot.settings.plugin_directories | Plugin directory paths
|
| users.extraUsers.<name>.isSystemUser | Indicates if the user is a system user or not
|
| services.vmalert.instances.<name>.enable | Wether to enable VictoriaMetrics's vmalert.
vmalert evaluates alerting and recording rules against a data source, sends notifications via Alertmanager.
|
| services.jupyterhub.kernels.<name>.logo64 | Path to 64x64 logo png.
|
| services.fedimintd.<name>.nginx.config.default | Makes this vhost the default.
|
| services.jupyterhub.kernels.<name>.logo32 | Path to 32x32 logo png.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.readBuckets | The organization's buckets which should be allowed to be read
|
| boot.initrd.luks.devices.<name>.yubikey.slot | Which slot on the YubiKey to challenge.
|
| services.borgbackup.jobs.<name>.extraPruneArgs | Additional arguments for borg prune
|
| systemd.user.targets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.user.sockets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.ghostunnel.servers.<name>.allowAll | If true, allow all clients, do not check client cert subject.
|
| services.wstunnel.servers.<name>.restrictTo.*.port | The port.
|
| services.wstunnel.servers.<name>.restrictTo.*.host | The hostname.
|
| services.firewalld.zones.<name>.protocols | Protocols to allow in the zone.
|
| services.blockbook-frontend.<name>.configFile | Location of the blockbook configuration file.
|
| services.zeronsd.servedNetworks.<name>.package | The zeronsd package to use.
|
| security.agnos.settings.accounts.*.certificates.*.domains | Domains the certificate represents
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.nice | Niceness.
|
| services.autorandr.profiles.<name>.fingerprint | Output name to EDID mapping
|
| services.pgbackrest.stanzas.<name>.instances | An attribute set of database instances as described in:
https://pgbackrest.org/configuration.html#section-stanza
Each instance defaults to set pg-host to the attribute's name
|
| services.grafana.settings.database.client_cert_path | The path to the client cert
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacerts | List of CA certificates to accept for
authentication
|
| services.snipe-it.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.v4l2-relayd.instances.<name>.input.format | The video-format to read from input-stream.
|
| services.blockbook-frontend.<name>.package | The blockbook package to use.
|
| services.gitlab-runner.services.<name>.dockerExtraHosts | Add a custom host-to-IP mapping.
|
| documentation.man.mandoc.settings.output.width | The ASCII and UTF-8 output width, default is 78
|
| systemd.sockets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.targets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| openstack.zfs.datasets.<name>.mount | Where to mount this dataset.
|
| services.firezone.server.provision.accounts.<name>.policies.<name>.description | The description of this policy
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.operator | Grants all permissions in all organizations.
|
| services.nextcloud-spreed-signaling.settings.backend.backendtype | Type of backend configuration
|
| services.firewalld.zones.<name>.forwardPorts.*.to-addr | Destination IP address.
|
| services.snapserver.settings.tcp-control.bind_to_address | Address to listen on for snapclient connections.
|
| services.borgbackup.jobs.<name>.privateTmp | Set the PrivateTmp option for
the systemd-service
|
| services.grafana.settings.security.disable_gravatar | Set to true to disable the use of Gravatar for user profile images.
|
| services.matrix-conduit.settings.global.max_request_size | Max request size in bytes
|
| services.matrix-tuwunel.settings.global.max_request_size | Max request size in bytes
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.protocol | The protocol to allow
|
| services.system76-scheduler.settings.cfsProfiles.default.wakeup-granularity | sched_wakeup_granularity_ns.
|
| boot.loader.grub.users.<name>.password | Specifies the clear text password for the account
|
| systemd.timers.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.slices.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.timers.<name>.timerConfig | Each attribute in this set specifies an option in the
[Timer] section of the unit
|
| services.ax25.axports.<name>.description | Free format description of this interface.
|
| services.wordpress.sites.<name>.virtualHost.hostName | Canonical hostname for the server.
|
| security.acme.certs.<name>.server | ACME Directory Resource URI
|
| services.gitlab-runner.services.<name>.postBuildScript | Runner-specific command script executed after code is pulled
and just after build executes.
|
| systemd.user.paths.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.bitcoind.<name>.extraCmdlineOptions | Extra command line options to pass to bitcoind
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.prio | CPU scheduler priority.
|
| systemd.user.services.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.firezone.server.settingsSecret.RELEASE_COOKIE | A file containing a unique secret identifier for the Erlang
cluster
|
| services.httpd.virtualHosts.<name>.globalRedirect | If set, all requests for this host are redirected permanently to
the given URL.
|
| services.kimai.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.fedimintd.<name>.nginx.config.kTLS | Whether to enable kTLS support
|
| services.consul-template.instances.<name>.user | User under which this instance runs.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.pubkeys | List of raw public keys to accept for
authentication
|
| services.omnom.settings.smtp.connection_timeout | Connection timeout duration in seconds.
|
| services.matrix-tuwunel.settings.global.trusted_servers | Servers listed here will be used to gather public keys of other servers
(notary trusted key servers)
|
| services.borgbackup.jobs.<name>.dumpCommand | Backup the stdout of this program instead of filesystem paths
|
| security.acme.certs.<name>.extraLegoRenewFlags | Additional flags to pass to lego renew.
|
| services.grafana.provision.datasources.settings.datasources.*.jsonData | Extra data for datasource plugins.
|
| services.ghostunnel.servers.<name>.target | Address to forward connections to (can be HOST:PORT or unix:PATH).
|
| services.kimai.sites.<name>.database.createLocally | Create the database and database user locally.
|
| services.awstats.configs.<name>.webService.urlPrefix | The URL prefix under which the awstats pages appear.
|
| services.ghostunnel.servers.<name>.listen | Address and port to listen on (can be HOST:PORT, unix:PATH).
|
| services.gitlab-runner.services.<name>.dockerPullPolicy | Default pull-policy for Docker images
|
| services.firezone.server.provision.accounts.<name>.actors | All actors (users) to provision
|
| security.acme.certs.<name>.ocspMustStaple | Turns on the OCSP Must-Staple TLS extension
|
| services.gancio.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.fedimintd.<name>.nginx.config.basicAuth | Basic Auth protection for a vhost
|
| services.fluidd.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.akkoma.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.matomo.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.monica.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.writeBuckets | The organization's buckets which should be allowed to be written
|
| services.grafana.provision.datasources.settings.datasources.*.uid | Custom UID which can be used to reference this datasource in other parts of the configuration, if not specified will be generated automatically.
|
| virtualisation.xen.store.settings.persistent | Whether to activate the filed base backend.
|
| services.nipap.settings.auth.auth_cache_timeout | Seconds to store cached auth entries for.
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.ioPrio | IO scheduler priority.
|
| systemd.user.paths.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.units.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.grafana.settings.security.allow_embedding | When false, the HTTP header X-Frame-Options: deny will be set in Grafana HTTP responses
which will instruct browsers to not allow rendering Grafana in a <frame>, <iframe>, <embed> or <object>
|
| services.gitea-actions-runner.instances.<name>.url | Base URL of your Gitea/Forgejo instance.
|
| services.radicle.httpd.nginx.locations.<name>.root | Root directory for requests.
|
| services.prosody.virtualHosts.<name>.ssl.extraOptions | Extra SSL configuration options.
|
| systemd.user.slices.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.nspawn.<name>.networkConfig | Each attribute in this set specifies an option in the
[Network] section of this unit
|
| systemd.sockets.<name>.socketConfig | Each attribute in this set specifies an option in the
[Socket] section of the unit
|
| systemd.user.timers.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.nvme-rs.settings.email.smtp_password_file | File containing SMTP password
|
| services.swapspace.settings.buffer_elasticity | Percentage of buffer space considered to be "free"
|
| programs.neovim.runtime.<name>.source | Path of the source file.
|
| services.github-runners.<name>.tokenType | Type of token to use for runner registration
|
| virtualisation.xen.store.settings.ringScanInterval | Perodic scanning for all the rings as a safenet for lazy clients
|
| fileSystems.<name>.device | The device as passed to mount
|
| services.tarsnap.archives.<name>.includes | Include only files and directories matching these
patterns (the empty list includes everything)
|
| services.mautrix-meta.instances.<name>.enable | Whether to enable Mautrix-Meta, a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge.
|
| services.sftpgo.settings.httpd.bindings.*.enable_web_admin | Enable the built-in web admin for this interface binding.
|
| services.dnscrypt-proxy2.configFile | Path to TOML config file
|
| security.acme.certs.<name>.listenHTTP | Interface and port to listen on to solve HTTP challenges
in the form [INTERFACE]:PORT
|
| services.agorakit.nginx.locations.<name>.index | Adds index directive.
|
| services.kanboard.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.dolibarr.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.fediwall.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.librenms.nginx.locations.<name>.index | Adds index directive.
|
| services.kanboard.nginx.locations.<name>.index | Adds index directive.
|
| services.agorakit.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.fediwall.nginx.locations.<name>.index | Adds index directive.
|
| services.librenms.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.dolibarr.nginx.locations.<name>.index | Adds index directive.
|
| services.pixelfed.nginx.locations.<name>.index | Adds index directive.
|
| services.mainsail.nginx.locations.<name>.index | Adds index directive.
|
| services.mainsail.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.pixelfed.nginx.locations.<name>.alias | Alias directory for requests.
|
| systemd.user.services.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| boot.loader.grub.extraFiles | A set of files to be copied to /boot
|
| services.matrix-conduit.settings.global.database_backend | The database backend for the service
|
| services.omnom.settings.smtp.tls_allow_insecure | Whether to enable Whether to allow insecure TLS..
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.groups | Authorization group memberships to require
|
| security.pam.services.<name>.ttyAudit.enablePattern | For each user matching one of comma-separated
glob patterns, enable TTY auditing
|
| services.grafana.provision.datasources.settings.deleteDatasources | List of datasources that should be deleted from the database.
|
| services.authelia.instances.<name>.package | The authelia package to use.
|
| services.tor.relay.onionServices.<name>.secretKey | Secret key of the onion service
|
| services.znapzend.zetup.<name>.mbuffer.port | Port to use for mbuffer
|
| services.firewalld.services.<name>.sourcePorts.*.port | |
| services.influxdb2.provision.organizations.<name>.auths.<name>.description | Optional description for the API token
|
| services.strongswan-swanctl.swanctl.secrets.pkcs12.<name>.file | File name in the pkcs12 folder for which this
passphrase should be used.
|
| services.jibri.xmppEnvironments.<name>.control.login.username | User part of the JID.
|
| services.snipe-it.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.gitlab-runner.services.<name>.executor | Select executor, eg. shell, docker, etc
|
| services.matrix-tuwunel.settings.global.allow_encryption | Whether new encrypted rooms can be created
|
| services.matrix-conduit.settings.global.allow_encryption | Whether new encrypted rooms can be created
|
| services.wstunnel.clients.<name>.customHeaders | Custom HTTP headers to send during the upgrade request.
|
| fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.livekit.ingress.settings.rtc_config.port_range_end | End of UDP port range for WebRTC
|
| virtualisation.docker.daemon.settings.live-restore | Allow dockerd to be restarted without affecting running container
|
| documentation.man.mandoc.settings.manpath | Override the default search path for man(1),
apropos(1), and makewhatis(8)
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.class | CPU scheduler class.
|
| services.nezha-agent.settings.disable_send_query | Disable sending TCP/ICMP/HTTP requests.
|
| services.openssh.knownHosts.<name>.certAuthority | This public key is an SSH certificate authority, rather than an
individual host's key.
|
| services.woodpecker-agents.agents.<name>.path | Additional packages that should be added to the agent's PATH
|
| services.dokuwiki.sites.<name>.templates | List of path(s) to respective template(s) which are copied into the 'tpl' directory.
These templates need to be packaged before use, see example.
|
| services.snapper.configs.<name>.TIMELINE_CREATE | Defines whether hourly snapshots should be created.
|
| systemd.user.services.<name>.environment | Environment variables passed to the service's processes.
|
| services.openvpn.servers.<name>.authUserPass | This option can be used to store the username / password credentials
with the "auth-user-pass" authentication method
|
| boot.loader.systemd-boot.windows.<name>.title | The title of the boot menu entry.
|
| virtualisation.xen.store.settings.xenstored.log.file | Path to the Xen Store log file.
|
| services.gerrit.plugins | List of plugins to add to Gerrit
|
| services.restic.backups.<name>.createWrapper | Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service
|
| services.drupal.sites.<name>.virtualHost.forceSSL | Whether to add a separate nginx server block that permanently redirects (301)
all plain HTTP traffic to HTTPS
|
| services.firewalld.services.<name>.includes | Services to include for the service.
|
| services.influxdb2.provision.organizations.<name>.buckets.<name>.present | Whether to ensure that this bucket is present or absent.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.ca_id | Identity in CA certificate to accept for authentication
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.reqid | Fixed reqid to use for this CHILD_SA
|
| services.davis.nginx.serverName | Name of this virtual host
|
| services.slskd.nginx.serverName | Name of this virtual host
|
| services.movim.nginx.serverName | Name of this virtual host
|
| hardware.alsa.controls.<name>.maxVolume | The maximum volume in dB.
|
| virtualisation.containers.storage.settings | storage.conf configuration
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.ioClass | IO scheduler class.
|
| virtualisation.docker.rootless.daemon.settings | Configuration for docker daemon
|
| services.restic.backups.<name>.rcloneConfigFile | Path to the file containing rclone configuration
|
| services.bepasty.servers.<name>.secretKeyFile | A file that contains the server secret for safe session cookies, must be set.
secretKeyFile takes precedence over secretKey
|
| networking.macvlans.<name>.mode | The mode of the macvlan device.
|
| services.firezone.server.settingsSecret.LIVE_VIEW_SIGNING_SALT | A file containing a unique base64 encoded secret for the
LIVE_VIEW_SIGNING_SALT
|
| systemd.slices.<name>.requisite | Similar to requires
|
| systemd.timers.<name>.requisite | Similar to requires
|
| security.pam.services.<name>.duoSecurity.enable | If set, use the Duo Security pam module
pam_duo for authentication
|
| services.grafana.provision.alerting.templates.settings.templates.*.template | Alerting with a custom text template
|
| services.mpd.settings.playlist_directory | The directory where MPD stores playlists
|
| services.tahoe.nodes.<name>.client.introducer | The furl for a Tahoe introducer node
|
| services.nginx.virtualHosts.<name>.globalRedirect | If set, all requests for this host are redirected (defaults to 301,
configurable with redirectCode) to the given hostname.
|
| services.netbird.clients.<name>.openFirewall | Opens up firewall port for communication between NetBird peers directly over LAN or public IP,
without using (internet-hosted) TURN servers as intermediaries.
|
| services.netbird.tunnels.<name>.openFirewall | Opens up firewall port for communication between NetBird peers directly over LAN or public IP,
without using (internet-hosted) TURN servers as intermediaries.
|
| services.mediagoblin.settings.mediagoblin.email_debug_mode | Disable email debug mode to start sending outgoing mails
|
| services.akkoma.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.fluidd.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.fedimintd.<name>.nginx.config.extraConfig | These lines go to the end of the vhost verbatim.
|
| services.gancio.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.monica.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.matomo.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.nntp-proxy.users.<name>.maxConnections | Maximum number of concurrent connections to the proxy for this user
|
| systemd.user.units.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.paths.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.jupyterhub.kernels.<name>.extraPaths | Extra paths to link in kernel directory
|
| services.syncoid.commands.<name>.recursive | Whether to enable the transfer of child datasets.
|
| services.github-runners.<name>.serviceOverrides | Modify the systemd service
|
| systemd.sockets.<name>.listenStreams | For each item in this list, a ListenStream
option in the [Socket] section will be created.
|
| services.gitlab-runner.services.<name>.dockerVolumes | Bind-mount a volume and create it
if it doesn't exist prior to mounting.
|
| services.borgbackup.jobs.<name>.exclude | Exclude paths matching any of the given patterns
|
| boot.initrd.luks.devices.<name>.yubikey | The options to use for this LUKS device in YubiKey-PBA
|
| systemd.sockets.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.targets.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.nominatim.database.dbname | Name of the postgresql database.
|
| services.roundcube.database.dbname | Name of the postgresql database
|
| networking.bonds.<name>.mode | DEPRECATED, use driverOptions
|
| services.dolibarr.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.agorakit.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.kanboard.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.anuko-time-tracker.nginx.locations.<name>.root | Root directory for requests.
|
| services.librenms.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.fediwall.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.mainsail.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.pixelfed.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.vdirsyncer.jobs.<name>.config.statusPath | vdirsyncer's status path
|
| boot.specialFileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| security.auditd.plugins.<name>.args | This allows you to pass arguments to the child program
|
| virtualisation.xen.store.settings.xenstored.log.level | Logging level for the Xen Store.
|
| services.openvpn.servers.<name>.updateResolvConf | Use the script from the update-resolv-conf package to automatically
update resolv.conf with the DNS information provided by openvpn
|
| services.matrix-continuwuity.settings.global.database_path | Path to the continuwuity database, the directory where continuwuity will save its data
|
| services.borgbackup.jobs.<name>.extraCreateArgs | Additional arguments for borg create
|
| services.zitadel.extraSettingsPaths | A list of paths to extra settings files
|
| security.auditd.plugins.<name>.active | Whether to enable Whether to enable this plugin.
|
| services.fedimintd.<name>.api_ws.openFirewall | Opens TCP port in firewall for fedimintd's Websocket API
|
| systemd.user.services.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.consul-template.instances.<name>.group | Group under which this instance runs.
|
| services.tahoe.introducers.<name>.package | The tahoelafs package to use.
|
| services.orangefs.server.fileSystems.<name>.troveSyncData | Sync data.
|
| services.vdirsyncer.jobs.<name>.config.general | general configuration
|
| systemd.network.links.<name>.linkConfig | Each attribute in this set specifies an option in the
[Link] section of the unit
|
| security.pam.services.<name>.gnupg.enable | If enabled, pam_gnupg will attempt to automatically unlock the
user's GPG keys with the login password via
gpg-agent
|
| security.pam.services.<name>.kwallet.enable | If enabled, pam_wallet will attempt to automatically unlock the
user's default KDE wallet upon login
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.ipcomp | Enable IPComp compression before encryption
|
| services.bacula-sd.director.<name>.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.bacula-fd.director.<name>.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.grafana.provision.datasources.settings.deleteDatasources.*.orgId | Organization ID of the datasource to delete.
|
| containers.<name>.specialArgs | A set of special arguments to be passed to NixOS modules
|
| services.openvpn.servers.<name>.authUserPass.password | The password to store inside the credentials file.
|
| services.fcgiwrap.instances.<name>.socket.user | User to be set as owner of the UNIX socket.
|
| services.fcgiwrap.instances.<name>.socket.type | Socket type: 'unix', 'tcp' or 'tcp6'.
|
| services.v4l2-relayd.instances.<name>.output.format | The video-format to write to output-stream.
|
| ec2.zfs.datasets.<name>.properties | Properties to set on this dataset.
|
| services.grafana.provision.datasources.settings.datasources.*.access | Access mode. proxy or direct (Server or Browser in the UI)
|
| services.snipe-it.nginx.serverName | Name of this virtual host
|
| services.firezone.server.settingsSecret.COOKIE_SIGNING_SALT | A file containing a unique base64 encoded secret for the
COOKIE_SIGNING_SALT
|
| services.wordpress.sites.<name>.languages | List of path(s) to respective language(s) which are copied from the 'languages' directory.
|
| services.borgbackup.jobs.<name>.prune.prefix | Only consider archive names starting with this prefix for pruning
|
| networking.interfaces.<name>.useDHCP | Whether this interface should be configured with DHCP
|
| services.keepalived.vrrpScripts.<name>.weight | Following a failure, adjust the priority by this weight.
|
| services.radicle.httpd.nginx.locations.<name>.index | Adds index directive.
|
| services.radicle.httpd.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.k3s.autoDeployCharts.<name>.createNamespace | Whether to create the target namespace if not present.
|
| services.kanidm.provision.persons.<name>.groups | List of groups this person should belong to.
|
| services.k3s.autoDeployCharts.<name>.targetNamespace | The namespace in which the Helm chart gets installed.
|
| services.wstunnel.servers.<name>.listen.enableHTTPS | Use HTTPS for the tunnel server.
|
| services.headscale.settings.derp.server.private_key_path | Path to derp private key file, generated automatically if it does not exist.
|
| security.agnos.settings.dns_listen_addr | Address for agnos to listen on
|
| services.firezone.server.provision.accounts.<name>.groups | All groups to provision
|
| services.buildkite-agents.<name>.privateSshKeyPath | OpenSSH private key
A run-time path to the key file, which is supposed to be provisioned
outside of Nix store.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.pubkeys | List of raw public key candidates to use for
authentication
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.aaa_id | Server side EAP-Identity to expect in the EAP method
|
| services.nextcloud.settings.mail_from_address | FROM address that overrides the built-in sharing-noreply and lostpassword-noreply FROM addresses
|
| services.restic.backups.<name>.rcloneOptions | Options to pass to rclone to control its behavior
|
| documentation.man.mandoc.settings.output.includes | A string of relative path used as a template for the output path of
linked header files (usually via the In macro) in HTML output
|
| services.orangefs.server.fileSystems.<name>.troveSyncMeta | Sync meta data.
|
| security.acme.certs.<name>.extraDomainNames | A list of extra domain names, which are included in the one certificate to be issued.
|
| services.snapper.configs.<name>.SUBVOLUME | Path of the subvolume or mount point
|
| systemd.user.timers.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.user.slices.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.module | Optional PKCS#11 module name to access the token.
|
| services.ghostunnel.servers.<name>.cacert | Path to CA bundle file (PEM/X509)
|
| services.kimai.sites.<name>.environmentFile | Securely pass environment variabels to Kimai
|
| services.i2pd.inTunnels.<name>.destination | Remote endpoint, I2P hostname or b32.i2p address.
|
| services.drupal.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.mosquitto.listeners.*.users.<name>.acl | Control client access to topics on the broker.
|
| systemd.services.<name>.notSocketActivated | If set, a changed unit is never assumed to be
socket-activated on configuration switch, even if
it might have associated socket units
|
| services.maubot.settings.plugin_directories.load | The directories from which plugins should be loaded
|
| services.simplesamlphp.<name>.libDir | Path to the SimpleSAMLphp library directory.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_DAILY | Limits for timeline cleanup.
|
| services.anubis.instances.<name>.botPolicy | Anubis policy configuration in Nix syntax
|
| systemd.targets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.sockets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.murmur.registerHostname | DNS hostname where your server can be reached
|
| services.nvme-rs.settings.check_interval_secs | Check interval in seconds
|
| services.dependency-track.settings."alpine.oidc.user.provisioning" | Specifies if mapped OpenID Connect accounts are automatically created upon successful
authentication
|
| services.drupal.sites.<name>.database.createLocally | Create the database and database user locally.
|
| services.restic.backups.<name>.repositoryFile | Path to the file containing the repository location to backup to.
|
| services.moodle.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.nagios.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.moodle.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.nagios.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.wordpress.sites.<name>.virtualHost.adminAddr | E-mail address of the server administrator.
|
| services.kanidm.provision.groups.<name>.present | Whether to ensure that this group is present or absent.
|
| services.displayManager.dms-greeter.compositor.name | The Wayland compositor to run the greeter in
|
| services.fedimintd.<name>.nginx.config.listen.*.port | Port number to listen on
|
| security.acme.certs.<name>.directory | Directory where certificate and other state is stored.
|
| services.drupal.sites.<name>.virtualHost.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.drupal.sites.<name>.virtualHost.robotsEntries | Specification of pages to be ignored by web crawlers
|
| services.wstunnel.servers.<name>.loggingLevel | Passed to --log-lvl
Control the log verbosity. i.e: TRACE, DEBUG, INFO, WARN, ERROR, OFF
For more details, checkout [EnvFilter](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct
|
| services.wstunnel.clients.<name>.loggingLevel | Passed to --log-lvl
Control the log verbosity. i.e: TRACE, DEBUG, INFO, WARN, ERROR, OFF
For more details, checkout [EnvFilter](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct
|
| services.public-inbox.settings.publicinboxwatch.watchspam | If set, mail in this maildir will be trained as spam and
deleted from all watched inboxes
|
| services.sanoid.templates.<name>.autoprune | Whether to automatically prune old snapshots.
|
| services.orangefs.server.fileSystems.<name>.rootHandle | File system root ID.
|
| services.rke2.autoDeployCharts.<name>.createNamespace | Whether to create the target namespace if not present.
|
| services.rke2.autoDeployCharts.<name>.targetNamespace | The namespace in which the Helm chart gets installed.
|
| systemd.user.paths.<name>.requisite | Similar to requires
|
| services.btrbk.instances.<name>.onCalendar | How often this btrbk instance is started
|
| services.strongswan-swanctl.swanctl.secrets.private.<name>.file | File name in the private folder for which this passphrase should be used.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.help | A human-readable description of this metric.
|
| services.borgbackup.jobs.<name>.inhibitsSleep | Prevents the system from sleeping while backing up.
|
| services.bookstack.nginx.locations.<name>.root | Root directory for requests.
|
| security.pam.services.<name>.gnupg.noAutostart | Don't start gpg-agent if it is not running
|
| services.nextcloud.settings.skeletondirectory | The directory where the skeleton files are located
|
| services.mobilizon.settings.":mobilizon".":instance".email_reply_to | The email for the Reply-To: header in emails
|
| systemd.sockets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.targets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.buffyboard.configFile | Path to an INI format configuration file to provide Buffyboard
|
| environment.etc.<name>.enable | Whether this /etc file should be generated
|
| networking.greTunnels.<name>.type | Whether the tunnel routes layer 2 (tap) or layer 3 (tun) traffic.
|
| boot.initrd.luks.devices.<name>.keyFileTimeout | The amount of time in seconds for a keyFile to appear before
timing out and trying passwords.
|
| services.drupal.sites.<name>.virtualHost.locations | Declarative location config
|
| services.i2pd.outTunnels.<name>.destination | Remote endpoint, I2P hostname or b32.i2p address.
|
| services.bacula-sd.director.<name>.monitor | If Monitor is set to no, this director will have
full access to this Storage daemon
|
| services.bacula-fd.director.<name>.monitor | If Monitor is set to no, this director will have
full access to this Storage daemon
|
| services.fedimintd.<name>.nginx.config.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| services.grafana.settings.security.cookie_samesite | Sets the SameSite cookie attribute and prevents the browser from sending this cookie along with cross-site requests
|
| security.dhparams.params.<name>.bits | The bit size for the prime that is used during a Diffie-Hellman
key exchange.
|
| services.cjdns.ETHInterface.connectTo.<name>.publicKey | Public key at the opposite end of the tunnel.
|
| services.cjdns.UDPInterface.connectTo.<name>.publicKey | Public key at the opposite end of the tunnel.
|
| services.printing.cups-pdf.instances.<name>.enable | Whether to enable this cups-pdf instance.
|
| services.postfix.settings.main.message_size_limit | Maximum size of an email message in bytes.
https://www.postfix.org/postconf.5.html#message_size_limit
|
| systemd.user.timers.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.user.slices.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.borgbackup.jobs.<name>.readWritePaths | By default, borg cannot write anywhere on the system but
$HOME/.config/borg and $HOME/.cache/borg
|
| services.davis.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.movim.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.slskd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fcgiwrap.instances.<name>.socket.mode | Mode to be set on the UNIX socket
|
| networking.greTunnels.<name>.local | The address of the local endpoint which the remote
side should send packets to.
|
| services.headscale.settings.database.sqlite.write_ahead_log | Enable WAL mode for SQLite
|
| services.nginx.virtualHosts.<name>.listen.*.proxyProtocol | Enable PROXY protocol.
|
| services.radicle.httpd.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.wordpress.sites.<name>.virtualHost.acmeRoot | Directory for the acme challenge which is PUBLIC, don't put certs or keys in here
|
| services.public-inbox.settings.publicinboxwatch.spamcheck | If set to spamc, public-inbox-watch(1) will filter spam
using SpamAssassin.
|
| fileSystems.<name>.options | Options used to mount the file system
|
| fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.mautrix-meta.instances.<name>.serviceUnit | The systemd unit (a service or a target) for other services to depend on if they
need to be started after matrix-synapse
|
| services.kanidm.provision.groups.<name>.members | List of kanidm entities (persons, groups, ...) which are part of this group.
|
| services.bacula-sd.autochanger.<name>.devices | |
| services.nginx.virtualHosts.<name>.redirectCode | HTTP status used by globalRedirect and forceSSL
|
| services.anuko-time-tracker.nginx.locations.<name>.index | Adds index directive.
|
| services.anuko-time-tracker.nginx.locations.<name>.alias | Alias directory for requests.
|
| networking.interfaces.<name>.virtualType | The type of interface to create
|
| services.honk.username | The admin account username.
|
| services.maubot.settings.plugin_directories.upload | The directory where uploaded new plugins should be stored.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.query | The SQL query to run.
|
| security.pam.services.<name>.ttyAudit.disablePattern | For each user matching one of comma-separated
glob patterns, disable TTY auditing
|
| services.nbd.server.exports.<name>.allowAddresses | IPs and subnets that are authorized to connect for this device
|
| services.wordpress.sites.<name>.virtualHost.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.firezone.server.provision.accounts.<name>.relayGroups | All relay groups to provision
|
| services.wyoming.piper.servers.<name>.streaming | Whether to enable audio streaming on sentence boundaries.
|
| services.firewalld.zones.<name>.egressPriority | Priority for outbound traffic
|
| services.wordpress.sites.<name>.virtualHost.listen.*.ip | IP to listen on. 0.0.0.0 for IPv4 only, * for all.
|
| services.snapserver.settings.tcp-streaming.bind_to_address | Address to listen on for snapclient connections.
|
| services.kubernetes.kubelet.taints.<name>.value | Value of taint.
|
| systemd.user.slices.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.timers.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.drupal.sites.<name>.virtualHost.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.kanata.keyboards.<name>.configFile | The config file
|
| services.invoiceplane.sites.<name>.cron.key | Cron key taken from the administration page.
|
| services.caddy.virtualHosts.<name>.listenAddresses | A list of host interfaces to bind to for this virtual host.
|
| services.agorakit.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.dolibarr.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fediwall.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.librenms.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fcgiwrap.instances.<name>.socket.group | Group to be set as owner of the UNIX socket.
|
| services.kanboard.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.pixelfed.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.restic.backups.<name>.backupPrepareCommand | A script that must run before starting the backup process.
|
| services.mainsail.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.restic.backups.<name>.backupCleanupCommand | A script that must run after finishing the backup process.
|
| services.firewalld.zones.<name>.interfaces | Interfaces to bind.
|
| services.matrix-tuwunel.settings.global.unix_socket_perms | The default permissions (in octal) to create the UNIX socket with.
|
| fileSystems.<name>.encrypted.enable | The block device is backed by an encrypted one, adds this device as a initrd luks entry.
|
| services.snipe-it.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| documentation.man.mandoc.settings.output.indent | Number of blank characters at the left margin for normal text,
default of 5 for mdoc(7) and 7 for
man(7)
|
| services.stash.settings.gallery_cover_regex | Regex used to identify images as gallery covers
|
| services.stash.settings.preview_exclude_end | Duration of start of video to exclude when generating previews
|
| services.gitlab-runner.services.<name>.preGetSourcesScript | Runner-specific command script executed before code is pulled.
|
| services.keepalived.vrrpScripts.<name>.script | (Path of) Script command to execute followed by args, i.e. cmd [args]...
|
| services.neo4j.ssl.policies.<name>.publicCertificate | The name of public X.509 certificate (chain) file in PEM format
for this policy to be found in the baseDirectory,
or the absolute path to the certificate file
|
| services.etebase-server.settings.allowed_hosts.allowed_host1 | The main host that is allowed access.
|
| services.gitlab-runner.services.<name>.dockerDisableCache | Disable all container caching.
|
| services.tarsnap.archives.<name>.followSymlinks | Whether to follow all symlinks in archive trees.
|
| services.kmonad.keyboards.<name>.defcfg.enable | Whether to enable automatic generation of the defcfg block
|
| services.syncoid.commands.<name>.localSourceAllow | Permissions granted for the services.syncoid.user user
for local source datasets
|
| services.wordpress.sites.<name>.virtualHost.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| systemd.sockets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.targets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| security.acme.certs.<name>.webroot | Where the webroot of the HTTP vhost is located.
.well-known/acme-challenge/ directory
will be created below the webroot if it doesn't exist.
http://example.org/.well-known/acme-challenge/ must also
be available (notice unencrypted HTTP).
|
| boot.initrd.luks.devices.<name>.fido2.gracePeriod | Time in seconds to wait for the FIDO2 key.
|
| boot.initrd.luks.devices.<name>.gpgCard.gracePeriod | Time in seconds to wait for the GPG Smartcard.
|
| services.maubot.settings.plugin_directories.trash | The directory where old plugin versions and conflicting plugins should be moved
|
| services.drupal.sites.<name>.database.tablePrefix | The $table_prefix is the value placed in the front of your database tables
|
| services.postfix.masterConfig.<name>.privileged | |
| services.i2pd.outTunnels.<name>.destinationPort | Connect to particular port at destination.
|
| services.xray.enable | Whether to run xray server
|
| services.gitea-actions-runner.instances.<name>.token | Plain token to register at the configured Gitea/Forgejo instance.
|
| services.vdirsyncer.jobs.<name>.forceDiscover | Run yes | vdirsyncer discover prior to vdirsyncer sync
|
| services.wordpress.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| security.pam.services.<name>.enableGnomeKeyring | If enabled, pam_gnome_keyring will attempt to automatically unlock the
user's default Gnome keyring upon login
|
| services.gitlab-runner.services.<name>.runUntagged | Register to run untagged builds; defaults to
true when tagList is empty
|
| fileSystems.<name>.neededForBoot | If set, this file system will be mounted in the initial ramdisk
|
| containers.<name>.macvlans | The list of host interfaces from which macvlans will be
created
|
| documentation.man.mandoc.settings.output.fragment | Whether to omit the declaration and the , , and
elements and only emit the subtree below the element in HTML
output of mandoc(1)
|
| services.anubis.instances.<name>.policy.extraBots | Additional bot rules appended to the policy
|
| services.ttyd.username | Username for basic http authentication.
|
| services.nextcloud.settings.mail_sendmailmode | For smtp, the sendmail binary is started with the parameter -bs: Use the SMTP protocol on standard input and output
|
| services.kmonad.keyboards.<name>.defcfg.compose.key | The (optional) compose key to use.
|
| services.wyoming.faster-whisper.servers.<name>.extraArgs | Extra arguments to pass to the server commandline.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_df | Whether to copy the DF bit to the outer IPv4 header in tunnel mode
|
| hardware.display.outputs.<name>.edid | An EDID filename to be used for configured display, as in edid/<filename>
|
| systemd.user.targets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.user.sockets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| boot.initrd.systemd.contents.<name>.target | Path of the symlink.
|
| services.monica.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.davis.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.slskd.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.movim.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.matrix-tuwunel.settings.global.unix_socket_path | Listen on a UNIX socket at the specified path
|
| services.blockbook-frontend.<name>.internal | Internal http server binding [address]:port.
|
| services.orangefs.server.fileSystems.<name>.extraConfig | Extra config for <FileSystem> section.
|
| services.wordpress.sites.<name>.virtualHost.listen.*.port | Port to listen on
|
| services.grafana.provision.datasources.settings.datasources.*.editable | Allow users to edit datasources from the UI.
|
| services.warpgate.settings.ssh.inactivity_timeout | How long can user be inactive until Warpgate terminates the connection.
|
| services.firezone.server.provision.accounts.<name>.policies | All policies to provision
|
| services.firewalld.services.<name>.ports.*.protocol | |
| services.firewalld.services.<name>.protocols | Protocols for the service.
|
| security.pam.services.<name>.kwallet.forceRun | The force_run option is used to tell the PAM module for KWallet
to forcefully run even if no graphical session (such as a GUI
display manager) is detected
|
| systemd.user.timers.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.slices.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.wordpress.sites.<name>.virtualHost.listen.*.ssl | Whether to enable SSL (https) support.
|
| services.firewalld.zones.<name>.masquerade | Whether to enable masquerading in the zone.
|
| services.anuko-time-tracker.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.bookstack.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.autosuspend.checks.<name>.enabled | Whether to enable this activity check.
|
| services.bookstack.nginx.locations.<name>.index | Adds index directive.
|
| services.keepalived.vrrpScripts.<name>.timeout | Seconds after which script is considered to have failed.
|
| services.drupal.sites.<name>.virtualHost.documentRoot | The path of Apache's document root directory
|
| hardware.sane.brscan5.netDevices.<name>.ip | The ip address of the device
|
| hardware.sane.brscan4.netDevices.<name>.ip | The ip address of the device
|
| services.borgbackup.jobs.<name>.extraCompactArgs | Additional arguments for borg compact
|
| services.dovecot2.mailboxes.<name>.specialUse | Null if no special use flag is set
|
| services.strongswan-swanctl.swanctl.connections.<name>.children | CHILD_SA configuration sub-section
|
| services.snapper.configs.<name>.TIMELINE_CLEANUP | Defines whether the timeline cleanup algorithm should be run for the config.
|
| services.wyoming.faster-whisper.servers.<name>.enable | Whether to enable Wyoming faster-whisper server.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_YEARLY | Limits for timeline cleanup.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_WEEKLY | Limits for timeline cleanup.
|
| services.mosquitto.bridges.<name>.addresses | Remote endpoints for the bridge.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_HOURLY | Limits for timeline cleanup.
|
| services.fluidd.nginx.serverName | Name of this virtual host
|
| services.akkoma.nginx.serverName | Name of this virtual host
|
| services.gancio.nginx.serverName | Name of this virtual host
|
| services.matomo.nginx.serverName | Name of this virtual host
|
| services.monica.nginx.serverName | Name of this virtual host
|
| services.sftpgo.settings.httpd.bindings.*.enable_web_client | Enable the built-in web client for this interface binding.
|
| services.mollysocket.settings.allowed_endpoints | List of UnifiedPush servers
|
| services.wordpress.sites.<name>.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.grafana.settings.security.x_xss_protection | Set to true to enable the X-XSS-Protection header,
which tells browsers to stop pages from loading when they detect reflected cross-site scripting (XSS) attacks.
Note: this is the default in Grafana, it's turned off here
since it's recommended to not use this header anymore.
|
| security.acme.certs.<name>.dnsProvider | DNS Challenge provider
|
| services.gitlab-runner.services.<name>.postGetSourcesScript | Runner-specific command script executed after code is pulled.
|
| services.snipe-it.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.bacula-sd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.bacula-fd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.matchers | Process matchers.
|
| systemd.user.sockets.<name>.socketConfig | Each attribute in this set specifies an option in the
[Socket] section of the unit
|
| services.openssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.consul-template.instances.<name>.enable | Whether to enable this consul-template instance.
|
| networking.greTunnels.<name>.remote | The address of the remote endpoint to forward traffic over.
|
| boot.initrd.systemd.contents.<name>.source | Path of the source file.
|
| services.fedimintd.<name>.environment | Extra Environment variables to pass to the fedimintd.
|
| services.jirafeau.nginxConfig.locations.<name>.root | Root directory for requests.
|
| services.fedimintd.<name>.nginx.config.listen | Listen addresses and ports for this virtual host
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.policies | Whether to install IPsec policies or not
|
| programs.neovim.runtime.<name>.enable | Whether this runtime directory should be generated
|
| systemd.paths.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.targets.<name>.requisite | Similar to requires
|
| systemd.sockets.<name>.requisite | Similar to requires
|
| services.prometheus.exporters.fritz.settings.devices.*.password_file | Path to a file which contains the password to authenticate with the target device
|
| services.warpgate.settings.ssh.keepalive_interval | If nothing is received from the client for this amount of time, server will send a keepalive message.
|
| services.kimai.sites.<name>.database.serverVersion | MySQL exact version string
|
| services.radicle.httpd.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.moodle.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.nagios.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.snapserver.streams.<name>.sampleFormat | Default sample format.
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".socket_dir | Path to the postgres socket directory
|
| virtualisation.xen.store.settings.xenstored.accessLog.file | Path to the Xen Store access log file.
|
| services.nsd.zones.<name>.outgoingInterface | This address will be used for zone-transfer requests if configured
as a secondary server or notifications in case of a primary server
|
| users.mysql.pam.logging.userColumn | The name of the column in the log table to which the name of the
user being authenticated is stored.
|
| users.mysql.pam.logging.hostColumn | The name of the column in the log table to which the name of the user
being authenticated is stored.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.labels | A set of columns that will be used as Prometheus labels.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.values | A set of columns that will be used as values of this metric.
|
| services.stash.settings.sequential_scanning | Modifies behaviour of the scanning functionality to generate support files (previews/sprites/phash) at the same time as fingerprinting/screenshotting
|
| services.dolibarr.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.librenms.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.dolibarr.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.librenms.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.kanboard.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.kanboard.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.fediwall.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fediwall.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.agorakit.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.agorakit.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.pgbackrest.repos.<name>.sftp-private-key-file | SFTP private key file
|
| services.mainsail.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.pixelfed.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.pixelfed.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.mainsail.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.xserver.cmt.models | Which models to enable cmt for
|
| services.kanidm.provision.persons.<name>.present | Whether to ensure that this person is present or absent.
|
| services.v4l2-relayd.instances.<name>.extraPackages | Extra packages to add to GST_PLUGIN_PATH for the instance.
|
| services.firewalld.zones.<name>.sourcePorts.*.protocol | |
| services.akkoma.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fluidd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fedimintd.<name>.nginx.config.basicAuthFile | Basic Auth password file for a vhost
|
| services.gancio.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.monica.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.matomo.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| programs.rush.global | The global statement defines global settings.
|
| services.wyoming.faster-whisper.servers.<name>.beamSize | The number of beams to use in beam search
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.tags | Tags to add to ntfy.sh messages
|
| services.minio.configDir | The config directory, for the access keys and other settings.
|
| services.invoiceplane.sites.<name>.enable | Whether to enable InvoicePlane web application.
|
| services.armagetronad.servers.<name>.dns | DNS address to use for this server
|
| services.wordpress.sites.<name>.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.nextcloud.settings.overwriteprotocol | Force Nextcloud to always use HTTP or HTTPS i.e. for link generation
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_ecn | Whether to copy the ECN (Explicit Congestion Notification) header field
to/from the outer IP header in tunnel mode
|
| services.stargazer.certOrg | The name of the organization responsible for the X.509
certificate's /O name.
|
| services.influxdb2.provision.organizations.<name>.buckets.<name>.retention | The duration in seconds for which the bucket will retain data (0 is infinite).
|
| services.drupal.sites.<name>.virtualHost.globalRedirect | If set, all requests for this host are redirected permanently to
the given URL.
|
| services.wordpress.sites.<name>.virtualHost.servedDirs | This option provides a simple way to serve static directories.
|
| systemd.user.services.<name>.notSocketActivated | If set, a changed unit is never assumed to be
socket-activated on configuration switch, even if
it might have associated socket units
|
| services.bookstack.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.vdirsyncer.jobs.<name>.config.storages | vdirsyncer storage configurations
|
| services.woodpecker-agents.agents.<name>.package | The woodpecker-agent package to use.
|
| services.listmonk.database.settings."privacy.domain_blocklist" | E-mail addresses with these domains are disallowed from subscribing.
|
| security.auditd.plugins.<name>.type | This tells the dispatcher how the plugin wants to be run
|
| systemd.network.netdevs.<name>.enable | Whether to manage network configuration using systemd-network
|
| systemd.network.netdevs.<name>.extraConfig | Extra configuration append to unit
|
| services.matrix-synapse.settings.turn_shared_secret | The shared secret used to compute passwords for the TURN server
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.enable | Boost foreground process priorities.
(And de-boost background ones)
|
| services.httpd.virtualHosts.<name>.listenAddresses | Listen addresses for this virtual host
|
| services.kubernetes.kubelet.taints.<name>.effect | Effect of taint.
|
| containers.<name>.allowedDevices | A list of device nodes to which the containers has access to.
|
| systemd.user.slices.<name>.requisite | Similar to requires
|
| systemd.user.timers.<name>.requisite | Similar to requires
|
| services.system76-scheduler.settings.cfsProfiles.responsive.wakeup-granularity | sched_wakeup_granularity_ns.
|
| services.nextcloud-spreed-signaling.backends.<name>.secretFile | The path to the file containing the value for backends.<name>.secret
|
| services.fedimintd.<name>.nginx.config.http2 | Whether to enable the HTTP/2 protocol
|
| services.gitea-actions-runner.instances.<name>.enable | Whether to enable Gitea Actions Runner instance.
|
| services.wyoming.piper.servers.<name>.zeroconf.enable | Whether to enable zeroconf discovery.
|
| services.v4l2-relayd.instances.<name>.input.pipeline | The gstreamer-pipeline to use for the input-stream.
|
| services.gitlab-runner.services.<name>.dockerAllowedImages | Whitelist allowed images.
|
| services.neo4j.ssl.policies.<name>.revokedDir | Path to directory of CRLs (Certificate Revocation Lists) in
PEM format
|
| services.tor.relay.onionServices.<name>.authorizeClient.clientNames | Only clients that are listed here are authorized to access the hidden service
|
| networking.wg-quick.interfaces.<name>.listenPort | 16-bit port for listening
|
| security.acme.certs.<name>.renewInterval | Systemd calendar expression when to check for renewal
|
| programs.ssh.knownHosts.<name>.extraHostNames | A list of additional host names and/or IP numbers used for
accessing the host's ssh service
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.remote_ts | List of remote selectors to include in CHILD_SA
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rand_time | Time range from which to choose a random value to subtract from
rekey_time
|
| services.sanoid.datasets.<name>.processChildrenOnly | Whether to only snapshot child datasets if recursing.
|
| services.spiped.config.<name>.disableKeepalives | Disable transport layer keep-alives.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.root | Root directory for requests.
|
| virtualisation.xen.store.settings.quota.transaction | Maximum number of transactions.
|
| systemd.user.sockets.<name>.listenStreams | For each item in this list, a ListenStream
option in the [Socket] section will be created.
|
| services.wstunnel.clients.<name>.httpProxy | Proxy to use to connect to the wstunnel server (USER:PASS@HOST:PORT).
Passwords specified here will be world-readable in the Nix store!
To pass a password to the service, point the environmentFile option
to a file containing PROXY_PASSWORD=<your-password-here> and set
this option to <user>:$PROXY_PASSWORD@<host>:<port>
|
| services.wordpress.sites.<name>.virtualHost.logFormat | Log format for Apache's log files
|
| systemd.user.sockets.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.user.targets.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.reposilite.database.dbname | Database name.
|
| services.cross-seed.useGenConfigDefaults | Whether to use the option defaults from the configuration generated by
cross-seed gen-config
|
| services.armagetronad.servers.<name>.host | Host to listen on
|
| services.armagetronad.servers.<name>.port | Port to listen on
|
| services.keepalived.vrrpInstances.<name>.useVmac | Use VRRP Virtual MAC.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.priority | Optional fixed priority for IPsec policies
|
| services.borgbackup.jobs.<name>.failOnWarnings | Fail the whole backup job if any borg command returns a warning
(exit code 1), for example because a file changed during backup.
|
| boot.initrd.systemd.contents.<name>.enable | Whether to enable copying of this file and symlinking it.
|
| programs.uwsm.waylandCompositors.<name>.prettyName | The full name of the desktop entry file.
|
| services.dendrite.settings.mscs.database.connection_string | Database for exerimental MSC's.
|
| services.blockbook-frontend.<name>.templateDir | Location of the HTML templates
|
| services.firewalld.zones.<name>.ingressPriority | Priority for inbound traffic
|
| services.wordpress.sites.<name>.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| containers.<name>.forwardPorts.*.hostPort | Source port of the external interface on host
|
| security.pam.services.<name>.setEnvironment | Whether the service should set the environment variables
listed in environment.sessionVariables
using pam_env.so.
|
| hardware.sane.brscan4.netDevices.<name>.model | The model of the network device.
|
| hardware.sane.brscan5.netDevices.<name>.model | The model of the network device.
|
| services.fcgiwrap.instances.<name>.process.group | Group as which this instance of fcgiwrap will be run.
|
| services.anuko-time-tracker.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.keepalived.vrrpScripts.<name>.extraConfig | Extra lines to be added verbatim to the vrrp_script section.
|
| services.borgmatic.settings.source_directories | List of source directories and files to backup
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.tags.*.tag | The tag to add
|
| services.akkoma.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.fediwall.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.kanboard.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.librenms.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.dolibarr.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.fluidd.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.gancio.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.agorakit.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.matomo.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.mainsail.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.monica.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.pixelfed.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.grafana.settings.database.conn_max_lifetime | Sets the maximum amount of time a connection may be reused
|
| services.librenms.database.username | Name of the user on the MySQL/MariaDB server
|
| services.grafana.settings.users.auto_assign_org_id | Set this value to automatically add new users to the provided org
|
| boot.initrd.luks.devices.<name>.keyFileSize | The size of the key file
|
| services.maddy.hostname | Hostname to use
|
| programs.ssh.knownHosts.<name>.publicKey | The public key data for the host
|
| services.fedimintd.<name>.nginx.config.locations | Declarative location config
|
| services.buildkite-agents.<name>.runtimePackages | Add programs to the buildkite-agent environment
|
| services.jirafeau.nginxConfig.locations.<name>.alias | Alias directory for requests.
|
| services.woodpecker-agents.agents.<name>.extraGroups | Additional groups for the systemd service.
|
| services.jirafeau.nginxConfig.locations.<name>.index | Adds index directive.
|
| services.kmonad.keyboards.<name>.extraGroups | Extra permission groups to attach to the KMonad instance for
this keyboard
|
| services.gitlab-runner.services.<name>.protected | When set to true Runner will only run on pipelines
triggered on protected branches
|
| services.radicle.httpd.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.radicle.httpd.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| systemd.user.sockets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.user.targets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.fedimintd.<name>.nginx.config.rejectSSL | Whether to listen for and reject all HTTPS connections to this vhost
|
| services.fedimintd.<name>.nginx.config.forceSSL | Whether to add a separate nginx server block that redirects (defaults
to 301, configurable with redirectCode) all plain HTTP traffic to
HTTPS
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.hostaccess | Hostaccess variable to pass to updown script
|
| services.xserver.xkb.extraLayouts.<name>.languages | A list of languages provided by the layout.
(Use ISO 639-2 codes, for example: "eng" for english)
|
| containers.<name>.timeoutStartSec | Time for the container to start
|
| services.wordpress.sites.<name>.virtualHost.http2 | Whether to enable HTTP 2
|
| services.mpdscribble.endpoints.<name>.url | The url endpoint where the scrobble API is listening.
|
| services.gitlab-runner.services.<name>.debugTraceDisabled | When set to true Runner will disable the possibility of
using the CI_DEBUG_TRACE feature.
|
| services.headscale.settings.oidc.strip_email_domain | Whether the domain part of the email address should be removed when generating namespaces.
|
| systemd.network.netdevs.<name>.tapConfig | Each attribute in this set specifies an option in the
[Tap] section of the unit
|
| systemd.network.netdevs.<name>.tunConfig | Each attribute in this set specifies an option in the
[Tun] section of the unit
|
| services.invoiceplane.sites.<name>.stateDir | This directory is used for uploads of attachments and cache
|
| security.auditd.settings.space_left | If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by
space_left_action
|
| services.doh-server.settings.ecs_use_precise_ip | If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask
|
| services.consul-template.instances.<name>.package | The consul-template package to use.
|
| services.autosuspend.wakeups.<name>.enabled | Whether to enable this wake-up check.
|
| services.nginx.virtualHosts.<name>.sslCertificate | Path to server SSL certificate.
|
| services.firezone.server.provision.accounts.<name>.resources | All resources to provision
|
| services.nginx.virtualHosts.<name>.listenAddresses | Listen addresses for this virtual host
|
| services.crab-hole.settings.blocklist.include_subdomains | Whether to enable Include subdomains.
|
| systemd.user.targets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.sockets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.tmpfiles.users.<name>.rules | Per-user rules for creation, deletion and cleaning of volatile and
temporary files automatically
|
| services.kmonad.keyboards.<name>.defcfg.compose.delay | The delay (in milliseconds) between compose key sequences.
|
| services.simplesamlphp.<name>.configDir | Path to the SimpleSAMLphp config directory.
|
| services.keepalived.vrrpScripts.<name>.interval | Seconds between script invocations.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_MONTHLY | Limits for timeline cleanup.
|
| services.firezone.server.provision.accounts.<name>.gatewayGroups | All gateway groups (sites) to provision
|
| services.wyoming.faster-whisper.servers.<name>.device | Determines the platform faster-whisper is run on
|
| boot.specialFileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| boot.initrd.clevis.devices.<name>.secretFile | Clevis JWE file used to decrypt the device at boot, in concert with the chosen pin (one of TPM2, Tang server, or SSS).
|
| services.bookstack.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fediwall.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.dolibarr.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.agorakit.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.librenms.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.kanboard.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.pixelfed.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.mainsail.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.networkd-dispatcher.rules.<name>.script | Shell commands executed on specified operational states.
|
| services.wordpress.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.wstunnel.clients.<name>.upgradePathPrefix | Use a specific HTTP path prefix that will show up in the upgrade
request to the wstunnel server
|
| services.matrix-synapse.workers.<name>.worker_app | Type of this worker
|
| boot.loader.grub.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the account
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.auth | Authentication to perform locally.
- The default
pubkey uses public key authentication
using a private key associated to a usable certificate.
psk uses pre-shared key authentication.
- The IKEv1 specific
xauth is used for XAuth or Hybrid
authentication,
- while the IKEv2 specific
eap keyword defines EAP
authentication.
- For
xauth, a specific backend name may be appended,
separated by a dash
|
| services.fcgiwrap.instances.<name>.process.user | User as which this instance of fcgiwrap will be run
|
| services.invidious.extraSettingsFile | A file including Invidious settings
|
| boot.initrd.luks.devices.<name>.postOpenCommands | Commands that should be run right after we have mounted our LUKS device.
|
| services.fedimintd.<name>.nginx.config.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.alias | Alias directory for requests.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.index | Adds index directive.
|
| networking.bonds.<name>.miimon | DEPRECATED, use driverOptions
|
| users.users.<name>.ignoreShellProgramCheck | By default, nixos will check that programs
|
| systemd.paths.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.movim.secretFile | The secret file to be sourced for the .env settings.
|
| systemd.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.livekit.ingress.settings.rtc_config.use_external_ip | When set to true, attempts to discover the host's public IP via STUN
|
| services.jirafeau.nginxConfig.locations.<name>.tryFiles | Adds try_files directive.
|
| services.headscale.settings.oidc.client_secret_path | Path to OpenID Connect client secret file
|
| services.davis.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.movim.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.slskd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.tarsnap.archives.<name>.cachedir | The cache allows tarsnap to identify previously stored data
blocks, reducing archival time and bandwidth usage
|
| image.repart.partitions.<name>.storePaths | The store paths to include in the partition.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert_policy | List of certificate policy OIDs the peer's certificate
must have
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_time | Maximum lifetime before CHILD_SA gets closed
|
| services.radicle.httpd.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.wordpress.sites.<name>.virtualHost.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| virtualisation.xen.store.settings.quota.maxOutstanding | Maximum outstanding requests, i.e. in-flight requests / domain.
|
| security.acme.certs.<name>.dnsResolver | Set the resolver to use for performing recursive DNS queries
|
| systemd.network.links.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| services.anuko-time-tracker.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.anuko-time-tracker.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fedimintd.<name>.bitcoin.rpc.secretFile | If set the URL specified in bitcoin.rpc.url will get the content of this file added
as an URL password, so http://user@example.com will turn into http://user:SOMESECRET@example.com
|
| security.pam.services.<name>.allowNullPassword | Whether to allow logging into accounts that have no password
set (i.e., have an empty password field in
/etc/passwd or
/etc/group)
|
| services.cloudflared.tunnels.<name>.default | Catch-all service if no ingress matches
|
| services.cjdns.UDPInterface.connectTo.<name>.password | Authorized password to the opposite end of the tunnel.
|
| services.cjdns.ETHInterface.connectTo.<name>.password | Authorized password to the opposite end of the tunnel.
|
| services.cloudflared.tunnels.<name>.ingress | Ingress rules
|
| services.mosquitto.bridges.<name>.addresses.*.port | Port of the remote MQTT broker.
|
| services.matrix-conduit.settings.global.allow_registration | Whether new users can register on this server.
|
| services.firewalld.zones.<name>.forwardPorts.*.protocol | |
| systemd.shutdownRamfs.contents.<name>.text | Text of the file.
|
| systemd.slices.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.timers.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.bcg.mqtt.username | MQTT server access username.
|
| services.blockbook-frontend.<name>.extraConfig | Additional configurations to be appended to coin.conf
|
| services.wordpress.sites.<name>.virtualHost.listen | Listen addresses and ports for this virtual host.
This option overrides addSSL, forceSSL and onlySSL
|
| systemd.services.<name>.confinement.enable | If set, all the required runtime store paths for this service are
bind-mounted into a tmpfs-based
chroot(2).
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.addressDescription | An optional description for resource address, usually a full link to the resource including a schema.
|
| services.tor.relay.onionServices.<name>.authorizeClient | See torrc manual.
|
| services.github-runners.<name>.extraEnvironment | Extra environment variables to set for the runner, as an attrset.
|
| systemd.user.sockets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.targets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.borgbackup.repos.<name>.allowSubRepos | Allow clients to create repositories in subdirectories of the
specified path
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rand_bytes | Byte range from which to choose a random value to subtract from
rekey_bytes
|
| security.acme.certs.<name>.reloadServices | The list of systemd services to call systemctl try-reload-or-restart
on.
|
| services.fedimintd.<name>.api_iroh.openFirewall | Opens UDP port in firewall for fedimintd's API Iroh endpoint
|
| services.nextcloud-spreed-signaling.settings.clients.internalsecretFile | The path to the file containing the value for clients.internalsecret
|
| services.livekit.ingress.settings.rtc_config.port_range_start | Start of UDP port range for WebRTC
|
| services.public-inbox.inboxes.<name>.description | User-visible description for the repository.
|
| services.snipe-it.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| systemd.services.<name>.confinement.binSh | The program to make available as /bin/sh inside
the chroot
|
| services.warpgate.settings.http.sni_certificates.*.certificate | Path to certificate.
|
| services.woodpecker-agents.agents.<name>.enable | Whether to enable this Woodpecker-Agent
|
| containers.<name>.restartIfChanged | Whether the container should be restarted during a NixOS
configuration switch if its definition has changed.
|
| systemd.paths.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.netbird.tunnels.<name>.environment | Environment for the netbird service, used to pass configuration options.
|
| services.netbird.clients.<name>.environment | Environment for the netbird service, used to pass configuration options.
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.jitsi-videobridge.xmppConfigs.<name>.userName | User part of the JID.
|
| services.jellyfin.forceEncodingConfig | Whether to overwrite Jellyfin's encoding.xml configuration file on each service start
|
| services.beesd.filesystems.<name>.extraOptions | Extra command-line options passed to the daemon
|
| services.moodle.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.strongswan-swanctl.swanctl.pools.<name>.dns | Address or CIDR subnets
StrongSwan default: []
|
| services.nagios.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.fedimintd.<name>.nginx.config.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.simplesamlphp.<name>.package | The simplesamlphp package to use.
|
| services.firewalld.zones.<name>.description | Description for the zone.
|
| systemd.network.netdevs.<name>.wlanConfig | Each attribute in this set specifies an option in the [WLAN] section of the unit
|
| systemd.network.netdevs.<name>.l2tpConfig | Each attribute in this set specifies an option in the
[L2TP] section of the unit
|
| systemd.network.netdevs.<name>.xfrmConfig | Each attribute in this set specifies an option in the
[Xfrm] section of the unit
|
| systemd.network.netdevs.<name>.vlanConfig | Each attribute in this set specifies an option in the
[VLAN] section of the unit
|
| systemd.network.netdevs.<name>.bondConfig | Each attribute in this set specifies an option in the
[Bond] section of the unit
|
| systemd.network.netdevs.<name>.peerConfig | Each attribute in this set specifies an option in the
[Peer] section of the unit
|
| services.lldap.settings.ldap_user_pass_file | Path to a file containing the default admin password
|
| containers.<name>.allowedDevices.*.node | Path to device node
|
| services.fedimintd.<name>.nginx.config.reuseport | Create an individual listening socket
|
| systemd.services.<name>.enableStrictShellChecks | Enable running shellcheck on the generated scripts for this unit
|
| services.nginx.virtualHosts.<name>.sslCertificateKey | Path to server SSL certificate key.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.tryFiles | Adds try_files directive.
|
| containers.<name>.forwardPorts | List of forwarded ports from host to container
|
| services.grafana.provision.datasources.settings.datasources.*.secureJsonData | Datasource specific secure configuration
|
| services.matrix-synapse.settings.enable_registration | Enable registration for new users.
|
| containers.<name>.interfaces | The list of interfaces to be moved into the container.
|
| services.tarsnap.archives.<name>.verylowmem | Reduce memory consumption by a factor of 2 beyond what
lowmem does, at the cost of significantly
slowing down the archiving process.
|
| services.wordpress.sites.<name>.virtualHost.extraConfig | These lines go to httpd.conf verbatim
|
| services.tahoe.introducers.<name>.tub.location | The external location that the introducer should listen on
|
| boot.initrd.luks.devices.<name>.yubikey.twoFactor | Whether to use a passphrase and a YubiKey (true), or only a YubiKey (false).
|
| boot.initrd.luks.devices.<name>.yubikey.keyLength | Length of the LUKS slot key derived with PBKDF2 in byte.
|
| services.matrix-synapse.settings.trusted_key_servers | The trusted servers to download signing keys from.
|
| services.radicle.httpd.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.jibri.xmppEnvironments.<name>.xmppDomain | The base XMPP domain.
|
| services.neo4j.ssl.policies.<name>.trustedDir | Path to directory of X.509 certificates in PEM format for
trusted parties
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.if_id_in | XFRM interface ID set on inbound policies/SA
|
| services.gitea-actions-runner.instances.<name>.tokenFile | Path to an environment file, containing the TOKEN environment
variable, that holds a token to register at the configured
Gitea/Forgejo instance.
|
| services.bookstack.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.bookstack.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.acme-dns.settings.api.disable_registration | Whether to disable the HTTP registration endpoint.
|
| services.anuko-time-tracker.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.influxdb2.provision.organizations.<name>.buckets.<name>.description | Optional description for the bucket.
|
| services.simplesamlphp.<name>.phpfpmPool | The PHP-FPM pool that serves SimpleSAMLphp instance.
|
| services.v4l2-relayd.instances.<name>.input.framerate | The framerate to read from input-stream.
|
| services.libeufin.bank.settings.libeufin-bank.SUGGESTED_WITHDRAWAL_EXCHANGE | Exchange that is suggested to wallets when withdrawing
|
| services.netbird.tunnels.<name>.dns-resolver.address | An explicit address that NetBird will serve *.netbird.cloud. (usually) entries on
|
| services.netbird.clients.<name>.dns-resolver.address | An explicit address that NetBird will serve *.netbird.cloud. (usually) entries on
|
| services.matrix-synapse.settings.dynamic_thumbnails | Whether to generate new thumbnails on the fly to precisely match
the resolution requested by the client
|
| services.firewalld.zones.<name>.icmpBlockInversion | Whether to invert the icmp block handling
|
| containers.<name>.localAddress | The IPv4 address assigned to the interface in the container
|
| services.fcgiwrap.instances.<name>.socket.address | Socket address
|
| services.jitsi-videobridge.xmppConfigs.<name>.mucJids | JID of the MUC to join
|
| systemd.user.targets.<name>.requisite | Similar to requires
|
| systemd.user.paths.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.requisite | Similar to requires
|
| security.dhparams.params.<name>.path | The resulting path of the generated Diffie-Hellman parameters
file for other services to reference
|
| services.restic.backups.<name>.environmentFile | file containing the credentials to access the repository, in the
format of an EnvironmentFile as described by systemd.exec(5)
|
| services.postfix.settings.main.recipient_delimiter | Set of characters used as the delimiters for address extensions
|
| services.netbird.tunnels.<name>.openInternalFirewall | Opens up internal firewall ports for the NetBird's network interface.
|
| services.netbird.clients.<name>.openInternalFirewall | Opens up internal firewall ports for the NetBird's network interface.
|
| services.armagetronad.servers.<name>.enable | Whether to enable armagetronad.
|
| services.parsedmarc.provision.localMail.hostname | The hostname to use when configuring Postfix
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.nice | Niceness.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.nice | Niceness.
|
| services.blockbook-frontend.<name>.rpc.password | RPC password for JSON-RPC connections
|
| programs.tsmClient.servers.<name>.tcpport | TCP port of the IBM TSM server
|
| services.borgbackup.jobs.<name>.removableDevice | Whether the repo (which must be local) is a removable device.
|
| services.influxdb2.provision.users.<name>.present | Whether to ensure that this user is present or absent.
|
| services.strongswan-swanctl.swanctl.pools.<name>.nbns | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.dhcp | Address or CIDR subnets
StrongSwan default: []
|
| services.jirafeau.nginxConfig.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.grafana.settings.analytics.reporting_enabled | When enabled Grafana will send anonymous usage statistics to stats.grafana.org
|
| services.icecream.daemon.netName | Network name to connect to
|
| security.pam.services | This option defines the PAM services
|
| services.gitlab-runner.services.<name>.maximumTimeout | What is the maximum timeout (in seconds) that will be set for
job when using this Runner. 0 (default) simply means don't limit
|
| networking.vlans | This option allows you to define vlan devices that tag packets
on top of a physical interface
|
| services.hostapd.radios.<name>.wifi6.multiUserBeamformer | HE multi user beamformee support
|
| services.beesd.filesystems.<name>.verbosity | Log verbosity (syslog keyword/level).
|
| services.tarsnap.archives.<name>.explicitSymlinks | Whether to follow symlinks specified as archives.
|
| systemd.services.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.chhoto-url.settings.cache_control_header | The Cache-Control header to send.
|
| services.networkd-dispatcher.rules.<name>.onState | List of names of the systemd-networkd operational states which
should trigger the script
|
| services.authelia.instances.<name>.secrets | It is recommended you keep your secrets separate from the configuration
|
| services.mailpit.instances.<name>.database | Specify the local database filename to store persistent data
|
| systemd.services.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| virtualisation.containers.containersConf.settings | containers.conf configuration
|
| networking.bonds.<name>.driverOptions | Options for the bonding driver
|
| security.apparmor.policies.<name>.path | A path of a profile file to include
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mode | IPsec Mode to establish CHILD_SA with.
tunnel negotiates the CHILD_SA in IPsec Tunnel Mode,
- whereas
transport uses IPsec Transport Mode.
transport_proxy signifying the special Mobile IPv6
Transport Proxy Mode.
beet is the Bound End to End Tunnel mixture mode,
working with fixed inner addresses without the need to include them in
each packet.
- Both
transport and beet modes are
subject to mode negotiation; tunnel mode is
negotiated if the preferred mode is not available.
pass and drop are used to install
shunt policies which explicitly bypass the defined traffic from IPsec
processing or drop it, respectively
|
| services.github-runners.<name>.tokenFile | The full path to a file which contains either
- a fine-grained personal access token (PAT),
- a classic PAT
- or a runner registration token
Changing this option or the tokenFile’s content triggers a new runner registration
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.prio | CPU scheduler priority.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.prio | CPU scheduler priority.
|
| services.ghostunnel.servers.<name>.unsafeTarget | If set, does not limit target to localhost, 127.0.0.1, [::1], or UNIX sockets
|
| services.gancio.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fluidd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.akkoma.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.matomo.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.monica.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| boot.initrd.luks.devices.<name>.keyFileOffset | The offset of the key file
|
| security.acme.certs.<name>.inheritDefaults | Whether to inherit values set in security.acme.defaults or not.
|
| services.firewalld.zones.<name>.sources.*.address | An IP address or a network IP address with a mask for IPv4 or IPv6
|
| services.matrix-continuwuity.settings.global.allow_federation | Whether this server federates with other servers.
|
| services.invoiceplane.sites.<name>.poolConfig | Options for the InvoicePlane PHP pool
|
| services.kmonad.keyboards.<name>.defcfg.allowCommands | Whether to enable keys to run shell commands.
|
| services.firezone.server.settingsSecret.COOKIE_ENCRYPTION_SALT | A file containing a unique base64 encoded secret for the
COOKIE_ENCRYPTION_SALT
|
| networking.vlans.<name>.interface | The interface the vlan will transmit packets through.
|
| containers.<name>.localAddress6 | The IPv6 address assigned to the interface in the container
|
| services.strongswan-swanctl.swanctl.authorities.<name>.module | Optional PKCS#11 module name.
|
| security.apparmor.policies.<name>.state | How strictly this policy should be enforced
|
| services.firewalld.services.<name>.sourcePorts.*.protocol | |
| services.blockbook-frontend.<name>.rpc.passwordFile | File containing password of the RPC user
|
| boot.loader.grub.users.<name>.hashedPassword | Specifies the password hash for the account,
generated with grub-mkpasswd-pbkdf2
|
| services.anuko-time-tracker.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.hostapd.radios.<name>.wifi7.multiUserBeamformer | EHT multi user beamformee support
|
| services.wyoming.faster-whisper.servers.<name>.language | The language used to to parse words and sentences.
|
| services.znapzend.zetup.<name>.destinations | Additional destinations.
|
| services.stash.username | Username for login.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.ioPrio | IO scheduler priority.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.ioPrio | IO scheduler priority.
|
| programs.xfs_quota.projects.<name>.id | Project ID.
|
| services.bookstack.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.dovecot2.mailPlugins.perProtocol.<name>.enable | mail plugins to enable as a list of strings to append to the corresponding per-protocol $mail_plugins configuration variable
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.username | If empty string mailaddress value is used
|
| services.pcscd.extendReaderNames | String to append to every reader name
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.inactivity | Timeout before closing CHILD_SA after inactivity
|
| boot.initrd.luks.devices.<name>.yubikey.saltLength | Length of the new salt in byte (64 is the effective maximum).
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.sha256_96 | HMAC-SHA-256 is used with 128-bit truncation with IPsec
|
| services.openafsServer.roles.backup.cellServDB.*.dnsname | DNS full-qualified domain name of a database server
|
| services.fcgiwrap.instances.<name>.process.prefork | Number of processes to prefork.
|
| services.tarsnap.archives.<name>.directories | List of filesystem paths to archive.
|
| fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_bytes | Maximum bytes processed before CHILD_SA gets closed
|
| services.blockbook-frontend.<name>.extraCmdLineOptions | Extra command line options to pass to Blockbook
|
| hardware.display.outputs.<name>.mode | A video kernel parameter (framebuffer mode) configuration for the specific output:
<xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m][eDd]
See for more information:
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.local_ts | List of local traffic selectors to include in CHILD_SA
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.borgbackup.jobs.<name>.patterns | Include/exclude paths matching the given patterns
|
| systemd.timers.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.slices.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.pgbouncer.settings.pgbouncer.default_pool_size | How many server connections to allow per user/database pair
|
| boot.initrd.luks.devices.<name>.yubikey.gracePeriod | Time in seconds to wait for the YubiKey.
|
| networking.domain | The system domain name
|
| services.matrix-synapse.settings.url_preview_enabled | Is the preview URL API enabled? If enabled, you must specify an
explicit url_preview_ip_range_blacklist of IPs that the spider is
denied from accessing.
|
| systemd.timers.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.slices.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.kanidm.provision.systems.oauth2.<name>.public | Whether this is a public client (enforces PKCE, doesn't use a basic secret)
|
| services.monica.hostname | The hostname to serve monica on.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.class | CPU scheduler class.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.class | CPU scheduler class.
|
| services.btrbk.instances.<name>.snapshotOnly | Whether to run in snapshot only mode
|
| systemd.network.netdevs.<name>.vxlanConfig | Each attribute in this set specifies an option in the
[VXLAN] section of the unit
|
| services.klipper.firmwares.<name>.klipperFlashPackage | Path to the built klipper-flash package.
|
| services.orangefs.server.fileSystems.<name>.extraStorageHints | Extra config for <StorageHints> section.
|
| services.matrix-continuwuity.settings.global.max_request_size | Max request size in bytes
|
| services.drupal.sites.<name>.virtualHost.listenAddresses | Listen addresses for this virtual host
|
| services.syncoid.commands.<name>.localTargetAllow | Permissions granted for the services.syncoid.user user
for local target datasets
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.ioClass | IO scheduler class.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.ioClass | IO scheduler class.
|
| services.dependency-track.database.type | h2 database is not recommended for a production setup.
postgresql this settings it recommended for production setups.
manual the module doesn't handle database settings.
|
| services.dendrite.settings.sync_api.database.connection_string | Database for the Sync API.
|
| fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| services.maubot.settings.plugin_databases.postgres_opts | Overrides for the default database_opts when using a non-default postgres connection URL.
|
| services.quorum.genesis | Blockchain genesis settings.
|
| services.wordpress.sites.<name>.virtualHost.forceSSL | Whether to add a separate nginx server block that permanently redirects (301)
all plain HTTP traffic to HTTPS
|
| services.matrix-continuwuity.settings.global.trusted_servers | Servers listed here will be used to gather public keys of other servers
(notary trusted key servers)
|
| boot.loader.systemd-boot.windows.<name>.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.jirafeau.nginxConfig.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.jirafeau.nginxConfig.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.bookstack.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| systemd.sockets.<name>.listenDatagrams | For each item in this list, a ListenDatagram
option in the [Socket] section will be created.
|
| services.dolibarr.h2o.serverName | Server name to be used for this virtual host
|
| services.slurm.partitionName | Name by which the partition may be referenced
|
| systemd.timers.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.slices.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.dolibarr.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.kanboard.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.librenms.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.agorakit.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fediwall.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.mainsail.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.pixelfed.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.keepalived.vrrpInstances.<name>.vmacXmitBase | Send/Recv VRRP messages from base interface instead of VMAC interface.
|
| services.gitlab-runner.services.<name>.dockerPrivileged | Give extended privileges to container.
|
| services.headscale.settings.derp.auto_update_enabled | Whether to automatically update DERP maps on a set frequency.
|
| services.public-inbox.inboxes.<name>.watchheader | If specified, public-inbox-watch(1) will only process
mail containing a matching header.
|
| services.ghostunnel.servers.<name>.keystore | Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
|
| systemd.network.netdevs.<name>.fooOverUDPConfig | Each attribute in this set specifies an option in the
[FooOverUDP] section of the unit
|
| services.simplesamlphp.<name>.authSources | Auth sources options used by SimpleSAMLphp.
|
| services.gitlab-runner.services.<name>.dockerAllowedServices | Whitelist allowed services.
|
| services.lasuite-docs.collaborationServer.settings.COLLABORATION_SERVER_ORIGIN | Origins allowed to connect to the collaboration server
|
| services.lasuite-docs.collaborationServer.settings.COLLABORATION_BACKEND_BASE_URL | URL to the backend server base
|
| services.fedimintd.<name>.nginx.config.globalRedirect | If set, all requests for this host are redirected (defaults to 301,
configurable with redirectCode) to the given hostname.
|
| services.simplesamlphp.<name>.localDomain | The domain serving your SimpleSAMLphp instance
|
| services.jitsi-videobridge.xmppConfigs.<name>.domain | Domain part of JID of the XMPP user, if it is different from hostName.
|
| services.peertube-runner.instancesToRegister.<name>.url | URL of the PeerTube instance.
|
| systemd.targets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.sockets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.matrix-continuwuity.settings.global.allow_encryption | Whether new encrypted rooms can be created
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.revocation | Certificate revocation policy for CRL or OCSP revocation.
- A
strict revocation policy fails if no revocation information is
available, i.e. the certificate is not known to be unrevoked.
ifuri fails only if a CRL/OCSP URI is available, but certificate
revocation checking fails, i.e. there should be revocation information
available, but it could not be obtained.
- The default revocation policy
relaxed fails only if a certificate is
revoked, i.e. it is explicitly known that it is bad
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.priority | The ntfy.sh message priority (see https://docs.ntfy.sh/publish/#message-priority for more information)
|
| services.nginx.virtualHosts.<name>.listen.*.extraParameters | Extra parameters of this listen directive.
|
| systemd.user.services.<name>.enableStrictShellChecks | Enable running shellcheck on the generated scripts for this unit
|
| services.hostapd.radios.<name>.dynamicConfigScripts | All of these scripts will be executed in lexicographical order before hostapd
is started, right after the global segment was generated and may dynamically
append global options the generated configuration file
|
| services.cloud-init.config | raw cloud-init configuration
|
| boot.initrd.luks.devices.<name>.preOpenCommands | Commands that should be run right before we try to mount our LUKS device
|
| services.matrix-tuwunel.settings.global.allow_registration | Whether new users can register on this server
|
| services.kanidm.provision.systems.oauth2.<name>.scopeMaps | Maps kanidm groups to returned oauth scopes
|
| services.hostapd.radios.<name>.wifi6.singleUserBeamformee | HE single user beamformee support
|
| services.hostapd.radios.<name>.wifi6.singleUserBeamformer | HE single user beamformer support
|
| services.grafana.settings.analytics.check_for_updates | When set to false, disables checking for new versions of Grafana from Grafana's GitHub repository
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.topic | Note: when using ntfy.sh and other public instances
it is recommended to set this option to an empty string and set the actual topic via
services.prometheus.alertmanager-ntfy.extraConfigFiles since
the topic in ntfy.sh is essentially a password
|
| systemd.user.paths.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.user.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.h2o.hosts.<name>.tls.identity.*.certificate-file | Path to certificate file
|
| services.fedimintd.<name>.consensus.finalityDelay | Consensus peg-in finality delay.
|
| services.taskserver.fqdn | The fully qualified domain name of this server, which is also used
as the common name in the certificates.
|
| services.matrix-synapse.settings.macaroon_secret_key | Secret key for authentication tokens
|
| services.peertube.settings.video_transcription.enabled | Enable automatic transcription of videos.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.kanidm.provision.systems.oauth2.<name>.originUrl | The redirect URL of the service
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.wyoming.faster-whisper.servers.<name>.model | Name of the voice model to use
|
| virtualisation.xen.store.settings.conflict.burstLimit | Limits applied to domains whose writes cause other domains' transaction
commits to fail
|
| services.authelia.instances.<name>.secrets.jwtSecretFile | Path to your JWT secret used during identity verificaton.
|
| services.wordpress.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.keepalived.vrrpInstances.<name>.virtualIps | Declarative vhost config
|
| services.beesd.filesystems.<name>.spec | Description of how to identify the filesystem to be duplicated by this
instance of bees
|
| services.kmonad.keyboards.<name>.enableHardening | Whether to enable systemd hardening.
If KMonad is used to execute shell commands, hardening may make some of them fail.
|
| services.dawarich.sidekiqProcesses.<name>.threads | Number of threads this process should use for executing jobs
|
| services.mastodon.sidekiqProcesses.<name>.threads | Number of threads this process should use for executing jobs
|
| services.hostapd.radios.<name>.wifi7.singleUserBeamformer | EHT single user beamformer support
|
| services.hostapd.radios.<name>.wifi7.singleUserBeamformee | EHT single user beamformee support
|
| services.wordpress.sites.<name>.database.createLocally | Create the database and database user locally.
|
| systemd.user.slices.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.timers.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.if_id_out | XFRM interface ID set on outbound policies/SA
|
| services.kanboard.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.agorakit.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.dolibarr.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.librenms.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.fediwall.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.pixelfed.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.mainsail.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.jirafeau.nginxConfig.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| programs.xfs_quota.projects.<name>.path | Project directory.
|
| networking.bonds | This option allows you to define bond devices that aggregate multiple,
underlying networking interfaces together
|
| services.k3s.nodeName | Node name.
|
| services.wordpress.sites.<name>.virtualHost.robotsEntries | Specification of pages to be ignored by web crawlers
|
| services.wordpress.sites.<name>.virtualHost.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| programs.openvpn3.netcfg.settings.systemd_resolved | Whether to use systemd-resolved integration
|
| services.invoiceplane.sites.<name>.cron.enable | Enable cron service which periodically runs Invoiceplane tasks
|
| programs.ssh.knownHosts.<name>.certAuthority | This public key is an SSH certificate authority, rather than an
individual host's key.
|
| services.keepalived.vrrpInstances.<name>.state | Initial state
|
| services.xserver.xkb.extraLayouts.<name>.description | A short description of the layout.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.dpd_action | Action to perform for this CHILD_SA on DPD timeout
|
| services.nextcloud.settings.mail_template_class | Replaces the default mail template layout
|
| systemd.user.paths.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.wordpress.sites.<name>.virtualHost.locations | Declarative location config
|
| services.blockbook-frontend.<name>.messageQueueBinding | Message Queue Binding address:port.
|
| services.znapzend.zetup.<name>.timestampFormat | The timestamp format to use for constructing snapshot names
|
| services.tarsnap.archives | Tarsnap archive configurations
|
| systemd.network.netdevs.<name>.vrfConfig | Each attribute in this set specifies an option in the
[VRF] section of the unit
|
| users.extraUsers.<name>.ignoreShellProgramCheck | By default, nixos will check that programs
|
| services.radicle.httpd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| systemd.user.services.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.gatus.configFile | Path to the Gatus configuration file
|
| services.samba-wsdd.hostname | Override (NetBIOS) hostname to be used (default hostname).
|
| services.icingaweb2.modules.monitoring.backends.<name>.resource | Name of the IDO resource
|
| systemd.user.services.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.dendrite.settings.media_api.database.connection_string | Database for the Media API.
|
| services.dendrite.settings.relay_api.database.connection_string | Database for the Relay Server.
|
| services.kanidm.provision.systems.oauth2.<name>.present | Whether to ensure that this oauth2 resource server is present or absent.
|
| services.roundcube.database.username | Username for the postgresql connection
|
| services.davis.hostname | Domain of the host to serve davis under
|
| services.stash.settings.notifications_enabled | If we should send notifications to the desktop
|
| services.grafana.settings.plugins.preinstall_disabled | When set to true, disables the Background Plugin Installer, which runs before Grafana starts
|
| services.jibri.xmppEnvironments.<name>.xmppServerHosts | Hostnames of the XMPP servers to connect to.
|
| services.sanoid.datasets.<name>.use_template | Names of the templates to use for this dataset.
|
| systemd.shutdownRamfs.contents.<name>.target | Path of the symlink.
|
| services.kmscon.useXkbConfig | Whether to configure keymap from xserver keyboard settings.
|
| services.grafana.settings.users.verify_email_enabled | Require email validation before sign up completes.
|
| services.firewalld.services.<name>.destination | Destinations for the service.
|
| services.firewalld.services.<name>.description | Description for the service.
|
| services.invoiceplane.sites.<name>.database.user | Database user.
|
| security.auditd.plugins.<name>.format | Binary passes the data exactly as the audit event dispatcher gets it from
the audit daemon
|
| networking.fooOverUDP.<name>.protocol | Protocol number of the encapsulated packets
|
| services.borgbackup.jobs.<name>.createCommand | Borg command to use for archive creation
|
| services.rmfakecloud.extraSettings | Extra settings in the form of a set of key-value pairs
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| containers.<name>.nixpkgs | A path to the nixpkgs that provide the modules, pkgs and lib for evaluating the container
|
| services.keepalived.vrrpInstances.<name>.extraConfig | Extra lines to be added verbatim to the vrrp_instance section.
|
| services.autorandr.profiles.<name>.hooks.preswitch | Preswitch hook executed before mode switch.
|
| services.fedimintd.<name>.nginx.config.listen.*.proxyProtocol | Enable PROXY protocol.
|
| services.strongswan-swanctl.swanctl.pools.<name>.server | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.subnet | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.p_cscf | Address or CIDR subnets
StrongSwan default: []
|
| services.jirafeau.nginxConfig.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.kanidm.provision.systems.oauth2.<name>.claimMaps | Adds additional claims (and values) based on which kanidm groups an authenticating party belongs to
|
| services.borgbackup.jobs.<name>.encryption.mode | Encryption mode to use
|
| services.nagios.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.moodle.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.zabbixWeb.hostname | Hostname for either nginx or httpd.
|
| services.neo4j.ssl.policies.<name>.baseDirectory | The mandatory base directory for cryptographic objects of this
policy
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in | Netfilter mark and mask for input traffic
|
| services.wordpress.sites.<name>.virtualHost.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.xonotic.settings.sv_termsofservice_url | URL for the Terms of Service for playing on your server.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rand_packets | Packet range from which to choose a random value to subtract from
rekey_packets
|
| services.murmur.registerName | Public server registration name, and also the name of the
Root channel
|
| boot.initrd.luks.devices.<name>.yubikey.storage.fsType | The filesystem of the unencrypted device.
|
| services.ghostunnel.servers.<name>.extraArguments | Extra arguments to pass to ghostunnel server
|
| services.vdirsyncer.jobs.<name>.additionalGroups | additional groups to add the dynamic user to
|
| services.fedimintd.<name>.nginx.config.redirectCode | HTTP status used by globalRedirect and forceSSL
|
| services.gitea-actions-runner.instances.<name>.labels | Labels used to map jobs to their runtime environment
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_out | Netfilter mark and mask for output traffic
|
| power.ups.upsmon.monitor.<name>.passwordFile | The full path to a file containing the password from
upsd.users for accessing this UPS
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.adapter_config.clientSecretFile | A file containing a the client secret for an openid_connect adapter
|
| services.grafana.settings.database.transaction_retries | This setting applies to sqlite3 only and controls the number of times the system retries a transaction when the database is locked.
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.tags.*.condition | The condition under which this tag should be added
|
| services.mosquitto.listeners.*.users.<name>.password | Specifies the (clear text) password for the MQTT User.
|
| services.invoiceplane.sites.<name>.database.host | Database host address.
|
| services.invoiceplane.sites.<name>.database.port | Database host port.
|
| services.stash.settings.preview_exclude_start | Duration of end of video to exclude when generating previews
|
| image.repart.partitions.<name>.contents | The contents to end up in the filesystem image.
|
| systemd.network.netdevs.<name>.tunnelConfig | Each attribute in this set specifies an option in the
[Tunnel] section of the unit
|
| systemd.network.netdevs.<name>.bridgeConfig | Each attribute in this set specifies an option in the
[Bridge] section of the unit
|
| systemd.network.netdevs.<name>.netdevConfig | Each attribute in this set specifies an option in the
[Netdev] section of the unit
|
| systemd.network.netdevs.<name>.ipvlanConfig | Each attribute in this set specifies an option in the [IPVLAN] section of the unit
|
| systemd.network.netdevs.<name>.ipvtapConfig | Each attribute in this set specifies an option in the [IPVTAP] section of the unit
|
| systemd.shutdownRamfs.contents.<name>.source | Path of the source file.
|
| services.agorakit.nginx.serverName | Name of this virtual host
|
| services.dolibarr.nginx.serverName | Name of this virtual host
|
| services.librenms.nginx.serverName | Name of this virtual host
|
| services.kanboard.nginx.serverName | Name of this virtual host
|
| services.fediwall.nginx.serverName | Name of this virtual host
|
| services.pixelfed.nginx.serverName | Name of this virtual host
|
| services.mainsail.nginx.serverName | Name of this virtual host
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.templates.title | The ntfy.sh message title template.
|
| services.radicle.httpd.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.namecoind.rpc.key | Key file for securing RPC connections.
|
| services.rke2.nodeName | Node name.
|
| services.anuko-time-tracker.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| networking.jool.nat64.<name>.global.pool6 | The prefix used for embedding IPv4 into IPv6 addresses
|
| programs.schroot.profiles.<name>.fstab | A file in the format described in fstab(5), used to mount filesystems inside the chroot
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.brd | The broadcast address on the interface.
|
| services.synapse-auto-compressor.settings.chunks_to_compress | chunks_to_compress chunks of size chunk_size will be compressed
|
| services.dependency-track.settings."alpine.oidc.team.synchronization" | This option will ensure that team memberships for OpenID Connect users are dynamic and
synchronized with membership of OpenID Connect groups or assigned roles
|
| services.dawarich.sidekiqProcesses.<name>.jobClasses | If not empty, which job classes should be executed by this process.
If left empty, all job classes will be executed by this process.
|
| services.davis.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.autorandr.profiles.<name>.hooks.predetect | Predetect hook executed before autorandr attempts to run xrandr.
|
| services.slskd.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.movim.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_dscp | Whether to copy the DSCP (Differentiated Services Field Codepoint)
header field to/from the outer IP header in tunnel mode
|
| systemd.sockets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.targets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| boot.initrd.luks.devices.<name>.gpgCard.encryptedPass | Path to the GPG encrypted passphrase.
|
| services.wordpress.sites.<name>.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_QUARTERLY | Limits for timeline cleanup.
|
| systemd.sockets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.targets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.icingaweb2.modules.monitoring.transports.<name>.username | Username for the api or remote transport
|
| services.matrix-continuwuity.settings.global.unix_socket_perms | The default permissions (in octal) to create the UNIX socket with.
|
| services.grafana.settings.users.auto_assign_org_role | The role new users will be assigned for the main organization (if the auto_assign_org setting is set to true).
|
| services.borgbackup.jobs.<name>.compression | Compression method to use
|
| services.mosquitto.bridges.<name>.addresses.*.address | Address of the remote MQTT broker.
|
| services.hostapd.radios.<name>.countryCode | Country code (ISO/IEC 3166-1)
|
| services.wordpress.sites.<name>.database.tablePrefix | The $table_prefix is the value placed in the front of your database tables
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.matchers | Process matchers.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.matchers | Process matchers.
|
| systemd.network.netdevs.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| networking.bonds.<name>.interfaces | The interfaces to bond together
|
| services.wstunnel.servers.<name>.tlsCertificate | TLS certificate to use instead of the hardcoded one in case of HTTPS connections
|
| services.grafana.settings.server.serve_from_sub_path | Serve Grafana from subpath specified in the root_url setting
|
| services.snipe-it.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| virtualisation.xen.store.settings.conflict.maxHistorySeconds | Limits applied to domains whose writes cause other domains' transaction
commits to fail
|
| networking.interfaces.<name>.mtu | MTU size for packets leaving the interface
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.hw_offload | Enable hardware offload for this CHILD_SA, if supported by the IPsec
implementation
|
| services.borgbackup.jobs.<name>.environment | Environment variables passed to the backup script
|
| boot.initrd.luks.devices.<name>.fido2.passwordLess | Defines whatever to use an empty string as a default salt
|
| systemd.user.slices.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.user.timers.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.nezha-agent.settings.skip_connection_count | Do not monitor the number of connections.
|
| systemd.user.slices.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.timers.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.sockets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.targets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.jibri.xmppEnvironments.<name>.call.login.domain | The domain part of the JID for the recorder.
|
| services.matrix-synapse.settings.tls_private_key_path | PEM encoded private key for TLS
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in_sa | Whether to set mark_in on the inbound SA
|
| systemd.shutdownRamfs.contents.<name>.enable | Whether to enable copying of this file and symlinking it.
|
| services.chhoto-url.settings.allow_capital_letters | Whether to allow capital letters in slugs.
|
| services.anuko-time-tracker.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| boot.loader.systemd-boot.extraFiles | A set of files to be copied to $BOOT
|
| systemd.generators | Definition of systemd generators; see systemd.generator(5)
|
| users.mysql.pam.logging.rHostColumn | The name of the column in the log table to which the name of the remote
host that initiates the session is stored
|
| services.bookstack.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.gitea-actions-runner.instances.<name>.hostPackages | List of packages, that are available to actions, when the runner is configured
with a host execution label.
|
| services.anubis.instances.<name>.policy.useDefaultBotRules | Whether to include Anubis's default bot detection rules via the
(data)/meta/default-config.yaml import
|
| services.honk.host | The host name or IP address the server should listen to.
|
| services.jibri.xmppEnvironments.<name>.usageTimeout | The duration that the Jibri session can be
|
| services.maddy.ensureCredentials.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the user.
|
| services.wordpress.sites.<name>.virtualHost.globalRedirect | If set, all requests for this host are redirected permanently to
the given URL.
|
| services.tailscale.serve.services.<name>.advertised | Whether the service should accept new connections
|
| networking.nftables.tables.<name>.enable | Enable this table.
|
| networking.nftables.tables.<name>.family | Table family.
|
| services.borgbackup.jobs.<name>.persistentTimer | Set the Persistent option for the
systemd.timer(5)
which triggers the backup immediately if the last trigger
was missed (e.g. if the system was powered down).
|
| services.nezha-agent.settings.use_ipv6_country_code | Use ipv6 countrycode to report location.
|
| services.mautrix-meta.instances.<name>.registerToSynapse | Whether to add registration file to services.matrix-synapse.settings.app_service_config_files and
make Synapse wait for registration service.
|
| services.fediwall.nginx | Allows customizing the nginx virtualHost settings
|
| services.szurubooru.server.settings.delete_source_files | Whether to delete thumbnails and source files on post delete.
|
| systemd.user.sockets.<name>.listenDatagrams | For each item in this list, a ListenDatagram
option in the [Socket] section will be created.
|
| services.nextcloud.notify_push.dbname | Database name.
|
| systemd.user.slices.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.user.timers.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.kanidm.provision.persons.<name>.mailAddresses | Mail addresses
|
| services.litellm.settings.environment_variables | Environment variables to pass to the Lite
|
| services.dendrite.settings.key_server.database.connection_string | Database for the Key Server (for end-to-end encryption).
|
| services.armagetronad.servers.<name>.package | The armagetronad-dedicated package to use
|
| services.authelia.instances.<name>.secrets.oidcHmacSecretFile | Path to your HMAC secret used to sign OIDC JWTs.
|
| networking.bonds.<name>.lacp_rate | DEPRECATED, use driverOptions
|
| services.bepasty.servers.<name>.defaultPermissions | default permissions for all unauthenticated accesses.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_time | Time to schedule CHILD_SA rekeying
|
| services.agorakit.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.librenms.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.kanboard.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.dolibarr.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fediwall.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.mainsail.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.pixelfed.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.plausible.database.postgres.dbname | Name of the database to use.
|
| services.namecoind.rpc.port | Port the RPC server will bind to.
|
| boot.initrd.luks.devices.<name>.yubikey.storage.path | Absolute path of the salt on the unencrypted device with
that device's root directory as "/".
|
| systemd.user.targets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| programs.ssh.knownHosts | The set of system-wide known SSH hosts
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_packets | Maximum number of packets processed before CHILD_SA gets closed
|
| services.keepalived.vrrpInstances.<name>.trackScripts | List of script names to invoke for health tracking.
|
| services.strongswan-swanctl.swanctl.pools.<name>.netmask | Address or CIDR subnets
StrongSwan default: []
|
| services.postgresqlWalReceiver.receivers.<name>.connection | Specifies parameters used to connect to the server, as a connection string
|
| services.mastodon.sidekiqProcesses.<name>.jobClasses | If not empty, which job classes should be executed by this process. *Only one process should handle the 'scheduler' class
|
| services.firewalld.services.<name>.destination.ipv4 | IPv4 destination.
|
| services.firewalld.services.<name>.destination.ipv6 | IPv6 destination.
|
| services.bookstack.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| programs.clash-verge.tunMode | Whether to enable Setcap for TUN Mode
|
| services.spiped.config.<name>.disableReresolution | Disable target address re-resolution.
|
| services.radicle.httpd.nginx.serverName | Name of this virtual host
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.addr | IP address, optionally with a netmask: IPADDR[/MASK]
|
| services.gancio.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.fluidd.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.akkoma.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.monica.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.matomo.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.nextcloud-spreed-signaling.backends.<name>.urls | List of URLs of the Nextcloud instance
|
| services.agorakit.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.librenms.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.wstunnel.servers.<name>.websocketPingInterval | Frequency at which the client will send websocket ping to the server.
|
| services.wstunnel.clients.<name>.websocketPingInterval | Frequency at which the client will send websocket ping to the server.
|
| boot.initrd.luks.devices.<name>.fido2.credential | The FIDO2 credential ID.
|
| networking.wireguard.interfaces.<name>.listenPort | 16-bit port for listening
|
| systemd.services.<name>.confinement.fullUnit | Whether to include the full closure of the systemd unit file into the
chroot, instead of just the dependencies for the executables.
While it may be tempting to just enable this option to
make things work quickly, please be aware that this might add paths
to the closure of the chroot that you didn't anticipate
|
| services.limesurvey.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.limesurvey.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| systemd.network.netdevs.<name>.l2tpSessions | Each item in this array specifies an option in the
[L2TPSession] section of the unit
|
| networking.wlanInterfaces.<name>.meshID | MeshID of interface with type mesh.
|
| services.authelia.instances.<name>.secrets.manual | Configuring authelia's secret files via the secrets attribute set
is intended to be convenient and help catch cases where values are required
to run at all
|
| services.keepalived.vrrpInstances.<name>.priority | For electing MASTER, highest priority wins
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.tfc_padding | Pads ESP packets with additional data to have a consistent ESP packet
size for improved Traffic Flow Confidentiality
|
| services.buffyboard.settings.quirks.fbdev_force_refresh | If true and using the framebuffer backend, this triggers a display refresh after every draw operation
|
| services.buildkite-agents | Attribute set of buildkite agents
|
| services.tarsnap.archives.<name>.checkpointBytes | Create a checkpoint every checkpointBytes
of uploaded data (optionally specified using an SI prefix).
1GB is the minimum value
|
| virtualisation.oci-containers.containers.<name>.serviceName | Systemd service name that manages the container
|
| services.bacula-sd.autochanger.<name>.changerCommand | The name-string specifies an external program to be called that will
automatically change volumes as required by Bacula
|
| services.kanidm.provision.systems.oauth2.<name>.imageFile | Application image to display in the WebUI
|
| services.jibri.xmppEnvironments.<name>.stripFromRoomDomain | The prefix to strip from the room's JID domain to derive the call URL.
|
| users.mysql.pam.table | The name of table that maps unique login names to the passwords.
|
| system.nixos.codeName | The NixOS release code name (e.g. Emu).
|
| security.auditd.settings.admin_space_left | This is a numeric value in mebibytes (MiB) that tells the audit daemon when to perform a configurable action because the system is running
low on disk space
|
| services.nginx.virtualHosts.<name>.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.mediawiki.httpd.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.mediawiki.httpd.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.jitsi-meet.config | Client-side web application settings that override the defaults in config.js
|
| services.bacula-sd.director.<name>.password | Specifies the password that must be supplied for the default Bacula
Console to be authorized
|
| services.bacula-fd.director.<name>.password | Specifies the password that must be supplied for the default Bacula
Console to be authorized
|
| services.klipper.firmwares.<name>.enableKlipperFlash | Whether to enable flashings scripts for firmware
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.scope | The scope of the area where this address is valid.
|
| containers.<name>.forwardPorts.*.protocol | The protocol specifier for port forwarding between host and container
|
| services.neo4j.ssl.policies | Defines the SSL policies for use with Neo4j connectors
|
| services.gitea.appName | Application name.
|
| services.radicle.ci.adapters.native.instances.<name>.enable | Whether to enable this radicle-native-ci instance.
|
| services.jirafeau.nginxConfig.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fedimintd.<name>.nginx.config.sslCertificate | Path to server SSL certificate.
|
| services.gitlab.smtp.username | Username of the SMTP server for GitLab.
|
| services.tailscale.serve.services.<name>.endpoints | Map of incoming traffic patterns to local targets
|
| services.fedimintd.<name>.nginx.config.listenAddresses | Listen addresses for this virtual host
|
| services.radicle.httpd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.prometheus.scrapeConfigs.*.job_name | The job name assigned to scraped metrics by default.
|
| boot.specialFileSystems.<name>.device | The device as passed to mount
|
| systemd.network.netdevs.<name>.macvlanConfig | Each attribute in this set specifies an option in the
[MACVLAN] section of the unit
|
| boot.loader.grub.users.<name>.hashedPasswordFile | Specifies the path to a file containing the password hash
for the account, generated with grub-mkpasswd-pbkdf2
|
| services.dendrite.settings.room_server.database.connection_string | Database for the Room Server.
|
| services.artalk.allowModify | allow Artalk store the settings to config file persistently
|
| services.snapserver.streams.<name>.location | For type pipe or file, the path to the pipe or file
|
| services.matrix-synapse.workers.<name>.worker_log_config | The file for log configuration
|
| boot.initrd.luks.devices.<name>.allowDiscards | Whether to allow TRIM requests to the underlying device
|
| services.autorandr.profiles.<name>.hooks.postswitch | Postswitch hook executed after mode switch.
|
| networking.fqdn | The fully qualified domain name (FQDN) of this host
|
| services.github-runners.<name>.ephemeral | If enabled, causes the following behavior:
- Passes the
--ephemeral flag to the runner configuration script
- De-registers and stops the runner with GitHub after it has processed one job
- On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
- Restarts the service after its successful exit
- On start, wipes the state directory and configures a new runner
You should only enable this option if tokenFile points to a file which contains a
personal access token (PAT)
|
| services.postfixadmin.database.dbname | Name of the postgresql database
|
| services.mysql.galeraCluster.localName | The unique name that identifies this particular node within the cluster
|
| services.matomo.hostname | URL of the host, without https prefix
|
| security.apparmor.policies.<name>.profile | The profile file contents
|
| services.anuko-time-tracker.nginx.serverName | Name of this virtual host
|
| services.doh-server.settings.log_guessed_client_ip | Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
Note: http uri/useragent log cannot be controlled by this config
|
| services.dovecot2.mailboxes.<name>.autoexpunge | To automatically remove all email from the mailbox which is older than the
specified time.
|
| services.tor.relay.onionServices.<name>.authorizeClient.authType | Either "basic" for a general-purpose authorization protocol
or "stealth" for a less scalable protocol
that also hides service activity from unauthorized clients.
|
| networking.supplicant.<name>.driver | Force a specific wpa_supplicant driver.
|
| networking.wlanInterfaces.<name>.flags | Flags for interface of type monitor.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.replay_window | IPsec replay window to configure for this CHILD_SA
|
| services.postfix.masterConfig.<name>.wakeupUnusedComponent | If set to false the component will only be woken
up if it is used
|
| services.keepalived.vrrpInstances.<name>.unicastSrcIp | Default IP for binding vrrpd is the primary IP on interface
|
| services.i2pd.proto.http.hostname | Expected hostname for WebUI.
|
| services.jirafeau.nginxConfig.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.system76-scheduler.assignments.<name>.nice | Niceness.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.readPermissions | The read permissions to include for this token
|
| services.matrix-synapse.settings.tls_certificate_path | PEM encoded X509 certificate for TLS
|
| programs.tsmClient.servers.<name>.inclexcl | Text lines with include.* and exclude.* directives
to be used when sending files to the IBM TSM server,
or an absolute path pointing to a file with such lines.
|
| services.grafana.settings.security.csrf_trusted_origins | List of additional allowed URLs to pass by the CSRF check
|
| services.jitsi-videobridge.xmppConfigs.<name>.passwordFile | File containing the password for the user.
|
| services.keepalived.vrrpInstances.<name>.interface | Interface for inside_network, bound by vrrp.
|
| services.archisteamfarm.bots.<name>.enabled | Whether to enable the bot on startup.
|
| systemd.user.targets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.user.sockets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| networking.wlanInterfaces.<name>.type | The type of the WLAN interface
|
| services.anuko-time-tracker.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.influxdb2.provision.users.<name>.passwordFile | Password for the user
|
| services.shorewall.configs | This option defines the Shorewall configs
|
| services.matrix-continuwuity.settings.global.unix_socket_path | Listen on a UNIX socket at the specified path
|
| systemd.user.targets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| boot.zfs.devNodes | Name of directory from which to import ZFS device, this is passed to zpool import
as the value of the -d option
|
| services.nextcloud.settings.default_phone_region | An ISO 3166-1
country code which replaces automatic phone-number detection
without a country code
|
| services.fedimintd.<name>.nginx.config.sslCertificateKey | Path to server SSL certificate key.
|
| services.strongswan-swanctl.swanctl.secrets.ppk.<name>.id | PPK identity the PPK belongs to
|
| image.repart.partitions.<name>.repartConfig | Specify the repart options for a partiton as a structural setting
|
| services.beesd.filesystems.<name>.hashTableSizeMB | Hash table size in MB; must be a multiple of 16
|
| services.limesurvey.nginx.virtualHost.locations.<name>.root | Root directory for requests.
|
| services.firefox-syncserver.singleNode.hostname | Host name to use for this service.
|
| networking.nftables.tables.<name>.content | The table content.
|
| services.stash.settings.write_image_thumbnails | Write image thumbnails to disk when generating on the fly
|
| services.system76-scheduler.assignments.<name>.prio | CPU scheduler priority.
|
| services.limesurvey.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.jibri.xmppEnvironments.<name>.control.muc.domain | The domain part of the MUC to connect to for control.
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.slot | Optional slot number to access the token.
|
| networking.jool.siit.<name>.framework | The framework to use for attaching Jool's translation to the exist
kernel packet processing rules
|
| services.borgbackup.repos.<name>.authorizedKeys | Public SSH keys that are given full write access to this repository
|
| services.strongswan-swanctl.swanctl.secrets.eap.<name>.id | Identity the EAP/XAuth secret belongs to
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.writePermissions | The read permissions to include for this token
|
| services.slskd.settings.remote_file_management | Whether to enable modification of share contents through the web ui.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| systemd.user.targets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.user.sockets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.k3s.autoDeployCharts.<name>.extraFieldDefinitions | Extra HelmChart field definitions that are merged with the rest of the HelmChart
custom resource
|
| services.namecoind.enable | Whether to enable namecoind, Namecoin client.
|
| services.kanidm.provision.systems.oauth2.<name>.basicSecretFile | The basic secret to use for this service
|
| networking.wg-quick.interfaces.<name>.dns | The IP addresses of DNS servers to configure.
|
| services.cloudflared.tunnels.<name>.originRequest.caPool | Path to the certificate authority (CA) for the certificate of your origin
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_bytes | Number of bytes processed before initiating CHILD_SA rekeying
|
| services.armagetronad.servers.<name>.openFirewall | Set to true to open the configured UDP port for Armagetron Advanced.
|
| services.kmonad.keyboards.<name>.defcfg.fallthrough | Whether to enable re-emitting unhandled key events.
|
| services.radicle.ci.adapters.native.instances.<name>.package | The radicle-native-ci package to use.
|
| services.mediawiki.httpd.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| networking.fqdnOrHostName | Either the fully qualified domain name (FQDN), or just the host name if
it does not exist
|
| networking.bridges | This option allows you to define Ethernet bridge devices
that connect physical networks together
|
| services.hostapd.radios.<name>.wifi5.capabilities | VHT (Very High Throughput) capabilities given as a list of flags
|
| services.strongswan-swanctl.swanctl.secrets.ike.<name>.id | IKE identity the IKE preshared secret belongs to
|
| services.bookstack.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.bookstack.nginx.serverName | Name of this virtual host
|
| services.gitlab-runner.services.<name>.requestConcurrency | Limit number of concurrent requests for new jobs from GitLab.
|
| services.tuned.ppdSettings | Settings for TuneD's power-profiles-daemon compatibility service.
|
| services.system76-scheduler.assignments.<name>.ioPrio | IO scheduler priority.
|
| services.pantalaimon-headless.instances.<name>.ssl | Whether or not SSL verification should be enabled for outgoing
connections to the homeserver.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.close_action | Action to perform after a CHILD_SA gets closed by the peer.
- The default of
none does not take any action,
trap installs a trap policy for the CHILD_SA.
start tries to re-create the CHILD_SA.
close_action does not provide any guarantee that the
CHILD_SA is kept alive
|
| services.rke2.autoDeployCharts.<name>.extraFieldDefinitions | Extra HelmChart field definitions that are merged with the rest of the HelmChart
custom resource
|
| services.strongswan-swanctl.swanctl.secrets.ntlm.<name>.id | Identity the NTLM secret belongs to
|
| boot.specialFileSystems.<name>.depends | List of paths that should be mounted before this one
|
| boot.specialFileSystems.<name>.options | Options used to mount the file system
|
| services.warpgate.settings.ssh.host_key_verification | Specify host key verification action when connecting to a SSH target with unknown/differing host key.
|
| services.simplesamlphp.<name>.configureNginx | Configure nginx as a reverse proxy for SimpleSAMLphp.
|
| networking.wg-quick.interfaces.<name>.preUp | Commands called at the start of the interface setup.
|
| services.postfix.hostname | Hostname to use
|
| services.postfix.settings.main.smtpd_tls_chain_files | List of paths to the server private keys and certificates.
The order of items matters and a private key must always be followed by the corresponding certificate.
https://www.postfix.org/postconf.5.html#smtpd_tls_chain_files
|
| services.strongswan-swanctl.swanctl.secrets.rsa.<name>.secret | Value of decryption passphrase for RSA key.
|
| services.tor.relay.onionServices.<name>.authorizedClients | Authorized clients for a v3 onion service,
as a list of public key, in the format:
descriptor:x25519:<base32-public-key>
See torrc manual.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.set_mark_in | Netfilter mark applied to packets after the inbound IPsec SA processed
them
|
| services.peertube.settings.video_transcription.engine_path | Custom engine path for local transcription.
|
| services.mpdscribble.endpoints.<name>.passwordFile | File containing the password, either as MD5SUM or cleartext.
|
| services.nullmailer.config.me | The fully-qualifiled host name of the computer running nullmailer
|
| programs.proxychains.proxies.<name>.type | Proxy type.
|
| programs.proxychains.proxies.<name>.port | Proxy port
|
| systemd.user.generators | Definition of systemd generators; see systemd.generator(5)
|
| services.borgbackup.jobs.<name>.encryption.passCommand | A command which prints the passphrase to stdout
|
| services.authelia.instances.<name>.secrets.sessionSecretFile | Path to your session secret
|
| services.limesurvey.nginx.virtualHost.locations.<name>.index | Adds index directive.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.alias | Alias directory for requests.
|
| boot.initrd.luks.devices.<name>.tryEmptyPassphrase | If keyFile fails then try an empty passphrase first before
prompting for password.
|
| services.neo4j.ssl.policies.<name>.allowKeyGeneration | Allows the generation of a private key and associated self-signed
certificate
|
| services.wstunnel.clients.<name>.tlsVerifyCertificate | Whether to verify the TLS certificate of the server
|
| services.wordpress.sites.<name>.virtualHost.listenAddresses | Listen addresses for this virtual host
|
| services.system76-scheduler.assignments.<name>.class | CPU scheduler class.
|
| services.postgresqlWalReceiver.receivers.<name>.extraArgs | A list of extra arguments to pass to the pg_receivewal command.
|
| services.nextcloud-spreed-signaling.settings.backend.connectionsperhost | Maximum number of concurrent backend connections per host
|
| networking.wlanInterfaces.<name>.fourAddr | Whether to enable 4-address mode with type managed.
|
| services.frigate.hostname | Hostname of the nginx vhost to configure
|
| networking.supplicant.<name>.extraCmdArgs | Command line arguments to add when executing wpa_supplicant.
|
| services.ytdl-sub.instances.<name>.subscriptions | Subscriptions for ytdl-sub
|
| services.geoclue2.appConfig | Specify extra settings per application.
|
| services.outline.smtp.username | Username to authenticate with.
|
| networking.macvlans.<name>.interface | The interface the macvlan will transmit packets through.
|
| networking.wg-quick.interfaces.<name>.postUp | Commands called after the interface setup.
|
| networking.vswitches.<name>.openFlowRules | OpenFlow rules to insert into the Open vSwitch
|
| services.scrutiny.settings.web.influxdb.tls.insecure_skip_verify | Whether to enable skipping TLS verification when connecting to InfluxDB.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.auth | Authentication to expect from remote
|
| services.system76-scheduler.assignments.<name>.ioClass | IO scheduler class.
|
| services.limesurvey.httpd.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.limesurvey.httpd.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.per_cpu_sas | Enable per-CPU CHILD_SAs
|
| networking.jool.nat64.<name>.framework | The framework to use for attaching Jool's translation to the exist
kernel packet processing rules
|
| services.wyoming.faster-whisper.servers.<name>.initialPrompt | Optional text to provide as a prompt for the first window
|
| services.printing.cups-pdf.instances.<name>.installPrinter | Whether to enable a CUPS printer queue for this instance
|
| security.agnos.settings.accounts.*.private_key_path | Path of the PEM-encoded private key for this account
|
| services.namecoind.wallet | Wallet file
|
| boot.binfmt.registrations.<name>.mask | A mask to be ANDed with the byte sequence of the file before matching
|
| networking.wg-quick.interfaces.<name>.type | The type of the interface
|
| fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.wstunnel.clients.<name>.environmentFile | Environment file to be passed to the systemd service
|
| services.wstunnel.servers.<name>.environmentFile | Environment file to be passed to the systemd service
|
| services.limesurvey.nginx.virtualHost.locations.<name>.tryFiles | Adds try_files directive.
|
| services.doh-server.configFile | The config file for the doh-server
|
| services.biboumi.settings.persistent_by_default | Whether all rooms will be persistent by default:
the value of the “persistent” option in the global configuration of each
user will be “true”, but the value of each individual room will still
default to false
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.pin | Optional PIN required to access the key on the token
|
| services.mosquitto.listeners.*.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the MQTT user
|
| programs.xfs_quota.projects.<name>.sizeHardLimit | Hard limit of the project size.
|
| programs.proxychains.proxies.<name>.host | Proxy host or IP address.
|
| programs.xfs_quota.projects.<name>.sizeSoftLimit | Soft limit of the project size
|
| networking.wg-quick.interfaces.<name>.preDown | Command called before the interface is taken down.
|
| programs.ssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.bcg.device | Device name to configure gateway to use.
|
| networking.wg-quick.interfaces.<name>.peers | Peers linked to the interface.
|
| services.jirafeau.nginxConfig.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.h2o.hosts | The hosts config to be merged with the settings
|
| services.nsd.zones | Define your zones here
|
| services.fedimintd.<name>.nginx.config.listen.*.extraParameters | Extra parameters of this listen directive.
|
| services.jibri.xmppEnvironments.<name>.control.login.domain | The domain part of the JID for this Jibri instance.
|
| services.strongswan-swanctl.swanctl.secrets.xauth.<name>.id | Identity the EAP/XAuth secret belongs to
|
| services.hostapd.radios.<name>.wifi4.capabilities | HT (High Throughput) capabilities given as a list of flags
|
| services.keepalived.vrrpInstances.<name>.virtualRouterId | Arbitrary unique number 1..255
|
| services.librenms.hostname | The hostname to serve LibreNMS on.
|
| services.anuko-time-tracker.nginx | With this option, you can customize the Nginx virtualHost settings.
|
| services.artalk.user | Artalk user name.
|
| services.sogo.vhostName | Name of the nginx vhost
|
| services.zammad.user | Name of the Zammad user.
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.filters.*.name | Name of the filter
|
| services.fediwall.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.dolibarr.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.agorakit.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.librenms.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.kanboard.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.pixelfed.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.mainsail.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.pantalaimon-headless.instances.<name>.logLevel | Set the log level of the daemon.
|
| services.prometheus.exporters.mail.configuration.servers.*.name | Value for label 'configname' which will be added to all metrics.
|
| services.znc.user | The name of an existing user account to use to own the ZNC server
process
|
| programs.xfs_quota.projects.<name>.fileSystem | XFS filesystem hosting the xfs_quota project.
|
| services.kanidm.provision.systems.oauth2.<name>.originLanding | When redirecting from the Kanidm Apps Listing page, some linked applications may need to land on a specific page to trigger oauth2/oidc interactions.
|
| networking.bridges.<name>.interfaces | The physical network interfaces connected by the bridge.
|
| services.cloudflared.tunnels.<name>.warp-routing.enabled | Enable warp routing
|
| services.limesurvey.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.pantalaimon-headless.instances.<name>.dataPath | The directory where pantalaimon should store its state such as the database file.
|
| openstack.zfs.datasets.<name>.properties | Properties to set on this dataset.
|
| services.matrix-continuwuity.settings.global.allow_registration | Whether new users can register on this server
|
| services.keycloak.themes | Additional theme packages for Keycloak
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.hostapd.radios.<name>.wifi6.operatingChannelWidth | Determines the operating channel width for HE.
- "20or40": 20 or 40 MHz operating channel width
- "80": 80 MHz channel width
- "160": 160 MHz channel width
- "80+80": 80+80 MHz channel width
|
| services.sabnzbd.configFile | Path to config file (deprecated, use settings instead and set this value to null)
|
| services.ncps.cache.redis.username | Redis username for authentication (for Redis ACL).
|
| services.mediawiki.httpd.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.strongswan-swanctl.swanctl.secrets.ecdsa.<name>.secret | Value of decryption passphrase for ECDSA key.
|
| services.tt-rss.auth.autoLogin | Automatically login user on remote or other kind of externally supplied
authentication, otherwise redirect to login form as normal
|
| services.jirafeau.nginxConfig.serverName | Name of this virtual host
|
| services.nitter.server.hostname | Hostname of the instance.
|
| services.bluemap.maps | Settings for files in maps/
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".has_reverse_proxy | Whether you use a reverse proxy
|
| services.cloudflared.tunnels.<name>.originRequest.tcpKeepAlive | The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
|
| services.jibri.xmppEnvironments.<name>.call.login.passwordFile | File containing the password for the user.
|
| systemd.paths.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.hostapd.radios.<name>.wifi5.operatingChannelWidth | Determines the operating channel width for VHT.
- "20or40": 20 or 40 MHz operating channel width
- "80": 80 MHz channel width
- "160": 160 MHz channel width
- "80+80": 80+80 MHz channel width
|
| services.hostapd.radios.<name>.wifi7.operatingChannelWidth | Determines the operating channel width for EHT.
- "20or40": 20 or 40 MHz operating channel width
- "80": 80 MHz channel width
- "160": 160 MHz channel width
- "80+80": 80+80 MHz channel width
|
| services.namecoind.extraNodes | List of additional peer IP addresses to connect to.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.set_mark_out | Netfilter mark applied to packets after the outbound IPsec SA processed
them
|
| networking.wg-quick.interfaces.<name>.postDown | Command called after the interface is taken down.
|
| services.easytier.instances.<name>.environmentFiles | Environment files for this instance
|
| containers.<name>.forwardPorts.*.containerPort | Target port of container
|
| services.kanidm.provision.systems.oauth2.<name>.enableLegacyCrypto | Enable legacy crypto on this client
|
| services.maubot.settings.server.override_resource_path | Override path from where to load UI resources.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs8.<name>.secret | Value of decryption passphrase for PKCS#8 key.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.prometheus.scrapeConfigs.*.ec2_sd_configs.*.filters.*.name | See this list
for the available filters.
|
| boot.initrd.luks.devices.<name>.yubikey.iterationStep | How much the iteration count for PBKDF2 is increased at each successful authentication.
|
| services.gitlab-runner.services.<name>.registrationFlags | Extra command-line flags passed to
gitlab-runner register
|
| services.gitlab-runner.services.<name>.registrationConfigFile | Absolute path to a file with environment variables
used for gitlab-runner registration with runner registration
tokens
|
| boot.initrd.luks.devices.<name>.fallbackToPassword | Whether to fallback to interactive passphrase prompt if the keyfile
cannot be found
|
| services.keepalived.vrrpInstances.<name>.noPreempt | VRRP will normally preempt a lower priority machine when a higher
priority machine comes online. "nopreempt" allows the lower priority
machine to maintain the master role, even when a higher priority machine
comes back online
|
| services.authelia.instances.<name>.secrets.oidcIssuerPrivateKeyFile | Path to your private key file used to encrypt OIDC JWTs.
|
| services.radicle.httpd.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.woodpecker-agents.agents.<name>.environment | woodpecker-agent config environment variables, for other options read the documentation
|
| programs.schroot.profiles.<name>.copyfiles | A list of files to copy into the chroot from the host system.
|
| services.limesurvey.httpd.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.mediagoblin.settings.mediagoblin.allow_registration | Whether to enable user self registration
|
| services.newt.blueprint | Blueprint for declarative settings, see Newt Blueprint docs for more information.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.start_action | Action to perform after loading the configuration.
- The default of
none loads the connection only, which
then can be manually initiated or used as a responder configuration.
- The value
trap installs a trap policy, which triggers
the tunnel as soon as matching traffic has been detected.
- The value
start initiates the connection actively.
- Since version 5.9.6 two modes above can be combined with
trap|start,
to immediately initiate a connection for which trap policies have been installed
|
| services.bookstack.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.mautrix-meta.instances.<name>.registrationFile | Path to the yaml registration file of the appservice.
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.templates.description | The ntfy.sh message description template.
|
| services.paretosecurity.users.<name>.inviteId | A unique ID that links the agent to Pareto Cloud
|
| services.mosquitto.listeners.*.users.<name>.hashedPassword | Specifies the hashed password for the MQTT User
|
| networking.interfaces.<name>.ipv6.routes | List of extra IPv6 static routes that will be assigned to the interface.
|
| boot.binfmt.registrations.<name>.interpreter | The interpreter to invoke to run the program
|
| services.crab-hole.configFile | The config file of crab-hole
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.mailaddress | Your email address (at the moment used as login name)
|
| services.cloudflared.tunnels.<name>.originRequest.noTLSVerify | Disables TLS verification of the certificate presented by your origin
|
| services.shorewall6.configs | This option defines the Shorewall configs
|
| networking.interfaces.<name>.ipv4.routes.*.via | IPv4 address of the next hop.
|
| networking.interfaces.<name>.ipv6.routes.*.via | IPv6 address of the next hop.
|
| services.datadog-agent.hostname | The hostname to show in the Datadog dashboard (optional)
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.handle | Hex-encoded CKA_ID or handle of the private key on the token or TPM,
respectively.
|
| services.zabbixWeb.nginx.virtualHost.serverName | Name of this virtual host
|
| networking.interfaces.<name>.wakeOnLan.enable | Whether to enable wol on this interface.
|
| services.mautrix-meta.instances.<name>.serviceDependencies | List of Systemd services to require and wait for when starting the application service.
|
| services.anuko-time-tracker.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.sftpgo.user | User account name under which SFTPGo runs.
|
| image.repart.partitions.<name>.stripNixStorePrefix | Whether to strip /nix/store/ from the store paths
|
| networking.vswitches.<name>.openFlowVersion | Version of OpenFlow protocol to use when communicating with the switch internally (e.g. with openFlowRules).
|
| services.limesurvey.nginx.virtualHost.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.pgbouncer.settings.pgbouncer.max_db_connections | Do not allow more than this many server connections per database (regardless of user)
|
| services.armagetronad.servers.<name>.roundSettings | Armagetron Advanced server per-round configuration
|
| networking.interfaces.<name>.macAddress | MAC address of the interface
|
| services.r53-ddns.domain | The name of your domain in Route53
|
| services.grav.systemSettings | Settings written to user/config/system.yaml.
|
| services.taskserver.organisations.<name>.users | A list of user names that belong to the organization.
|
| networking.wlanInterfaces.<name>.mac | MAC address to use for the device
|
| programs.tsmClient.servers.<name>.genPasswd | Whether to enable automatic client password generation
|
| services.sanoid.datasets.<name>.pruning_script | Script to run after pruning snapshot.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs12.<name>.secret | Value of decryption passphrase for PKCS#12 container.
|
| boot.initrd.luks.devices.<name>.yubikey.storage.device | An unencrypted device that will temporarily be mounted in stage-1
|
| systemd.services.<name>.confinement.packages | Additional packages or strings with context to add to the closure of
the chroot
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.root | Root directory for requests.
|
| services.strongswan-swanctl.swanctl.secrets.eap.<name>.secret | Value of the EAP/XAuth secret
|
| services.strongswan-swanctl.swanctl.secrets.ike.<name>.secret | Value of the IKE preshared secret
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_packets | Number of packets processed before initiating CHILD_SA rekeying
|
| services.timekpr.adminUsers | All listed users will become part of the timekpr group so they can manage timekpr settings without requiring sudo.
|
| services.cloudflared.tunnels.<name>.originRequest.httpHostHeader | Sets the HTTP Host header on requests sent to the local service.
|
| systemd.timers.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.slices.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.bookstack.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.kanidm.provision.groups.<name>.overwriteMembers | Whether the member list should be overwritten each time (true) or appended
(false)
|
| services.nezha-agent.settings.disable_command_execute | Disable executing the command from dashboard.
|
| programs.proxychains.proxies.<name>.enable | Whether to enable this proxy.
|
| services.drupal.webserver | Whether to use nginx or caddy for virtual host management
|
| services.nextcloud.settings.mail_smtpstreamoptions | This depends on mail_smtpmode
|
| services.limesurvey.nginx.virtualHost.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.deepin.dde-daemon.enable | Whether to enable daemon for handling the deepin session settings.
|
| services.cloudflared.tunnels.<name>.credentialsFile | Credential file
|
| services.dendrite.settings.federation_api.database.connection_string | Database for the Federation API.
|
| security.wrappers.<name>.permissions | The permissions of the wrapper program
|
| virtualisation.fileSystems.<name>.encrypted.label | Label of the unlocked encrypted device
|
| services.bind.enable | Whether to enable BIND domain name server.
|
| services.cloudflared.tunnels.<name>.originRequest.tlsTimeout | Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
|
| services.veilid.settings.core.network.detect_address_changes | Should veilid-core detect and notify on network address changes?
|
| services.headscale.settings.tls_letsencrypt_listen | When HTTP-01 challenge is chosen, letsencrypt must set up a
verification endpoint, and it will be listening on:
:http = port 80.
|
| boot.binfmt.registrations.<name>.offset | The byte offset of the magic number used for recognition.
|
| services.invoiceplane.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| image.repart.partitions.<name>.nixStorePrefix | The prefix to use for store paths
|
| services.invoiceplane.sites.<name>.database.createLocally | Create the database and database user locally.
|
| services.artalk.group | Artalk group name.
|
| services.zammad.group | Name of the Zammad group.
|
| services.tt-rss.pool | Name of existing phpfpm pool that is used to run web-application
|
| systemd.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.units.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.keepalived.vrrpInstances.<name>.unicastPeers | Do not send VRRP adverts over VRRP multicast group
|
| services.dendrite.settings.app_service_api.database.connection_string | Database for the Appservice API.
|
| security.dhparams.params | Diffie-Hellman parameters to generate
|
| services.sourcehut.settings."hg.sr.ht".clone_bundle_threshold | .hg/store size (in MB) past which the nightly job generates clone bundles.
|
| services.strongswan-swanctl.swanctl.connections.<name>.mediated_by | The name of the connection to mediate this connection through
|
| services.fedimintd.<name>.nginx.config.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.bcg.automaticRenameNodes | Automatically rename all nodes.
|
| services.strongswan-swanctl.swanctl.pools.<name>.addrs | Addresses allocated in pool
|
| services.limesurvey.httpd.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.keepalived.vrrpInstances.<name>.trackInterfaces | List of network interfaces to monitor for health tracking.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.index | Adds index directive.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.alias | Alias directory for requests.
|
| systemd.user.paths.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.patroni.namespace | Path within the configuration store where Patroni will keep information about the cluster.
|
| services.cloudflared.tunnels.<name>.originRequest.proxyPort | cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP
|
| services.limesurvey.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.taskserver.organisations.<name>.groups | A list of group names that belong to the organization.
|
| services.longview.apiKey | Longview API key
|
| services.strongswan-swanctl.swanctl.secrets.ppk.<name>.secret | Value of the PPK
|
| services.strongswan-swanctl.swanctl.secrets.private.<name>.secret | Value of decryption passphrase for private key.
|
| security.auditd.plugins.<name>.direction | The option is dictated by the plugin
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.resources.*.names | List of resources to host on this listener.
|
| services.mediawiki.httpd.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.woodpecker-agents.agents.<name>.environmentFile | File to load environment variables
from
|
| services.sanoid.datasets.<name>.script_timeout | Time limit for pre/post/pruning script execution time (<=0 for infinite).
|
| services.coturn.realm | The default realm to be used for the users when no explicit
origin/realm relationship was found in the database, or if the TURN
server is not using any database (just the commands-line settings
and the userdb file)
|
| services.borgbackup.repos.<name>.authorizedKeysAppendOnly | Public SSH keys that can only be used to append new data (archives) to the repository
|
| services.jirafeau.nginxConfig.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| security.acme.certs.<name>.credentialFiles | Environment variables suffixed by "_FILE" to set for the cert's service
for your selected dnsProvider
|
| services.netbird.clients.<name>.login.systemdDependencies | Additional systemd dependencies required to succeed before the Setup Key file becomes available.
|
| services.netbird.tunnels.<name>.login.systemdDependencies | Additional systemd dependencies required to succeed before the Setup Key file becomes available.
|
| security.acme.certs.<name>.environmentFile | Path to an EnvironmentFile for the cert's service containing any required and
optional environment variables for your selected dnsProvider
|
| services.sftpgo.group | Group name under which SFTPGo runs.
|
| networking.wg-quick.interfaces.<name>.address | The IP addresses of the interface.
|
| services.system76-scheduler.assignments.<name>.matchers | Process matchers.
|
| services.kanidm.provision.systems.oauth2.<name>.removeOrphanedClaimMaps | Whether claim maps not specified here but present in kanidm should be removed from kanidm.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.strongswan-swanctl.swanctl.secrets.xauth.<name>.secret | Value of the EAP/XAuth secret
|
| services.factorio.username | Your factorio.com login credentials
|
| services.dendrite.settings.client_api.registration_disabled | Whether to disable user registration to the server
without the shared secret.
|
| services.invoiceplane.sites.<name>.invoiceTemplates | List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
These templates need to be packaged before use, see example.
|
| services.grav.pool | Name of existing phpfpm pool that is used to run web-application
|
| services.anuko-time-tracker.hostname | The hostname to serve Anuko Time Tracker on.
|
| services.mailman.webSettings | Overrides for the default mailman-web Django settings.
|
| services.factorio.loadLatestSave | Load the latest savegame on startup
|
| services.icingaweb2.libraryPaths | Libraries to add to the Icingaweb2 library path
|
| security.acme.certs.<name>.dnsPropagationCheck | Toggles lego DNS propagation check, which is used alongside DNS-01
challenge to ensure the DNS entries required are available.
|
| services.postgresqlWalReceiver.receivers.<name>.directory | Directory to write the output to.
|
| services.cloudflared.tunnels.<name>.originRequest.originServerName | Hostname that cloudflared should expect from your origin server certificate.
|
| boot.initrd.luks.devices.<name>.fido2.credentials | List of FIDO2 credential IDs
|
| networking.interfaces.<name>.virtual | Whether this interface is virtual and should be created by tunctl
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.policies_fwd_out | Whether to install outbound FWD IPsec policies or not
|
| services.namecoind.rpc.allowFrom | List of IP address ranges allowed to use the RPC API
|
| services.gitlab-runner.services.<name>.environmentVariables | Custom environment variables injected to build environment
|
| services.longview.apiKeyFile | A file containing the Longview API key
|
| services.hadoop.hdfs.namenode.extraEnv | Extra environment variables for HDFS NameNode
|
| services.namecoind.rpc.address | IP address the RPC server will bind to.
|
| boot.initrd.luks.devices.<name>.bypassWorkqueues | Whether to bypass dm-crypt's internal read and write workqueues
|
| systemd.network.netdevs.<name>.wireguardPeers | Each item in this array specifies an option in the
[WireGuardPeer] section of the unit
|
| security.agnos.settings.accounts.*.certificates.*.key_output_file | Output path for the certificate private key
|
| services.postfixadmin.database.username | Username for the postgresql connection
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.discourse.hostname | The hostname to serve Discourse on.
|
| services.bookstack.hostname | The hostname to serve BookStack on.
|
| services.sanoid.templates.<name>.pruning_script | Script to run after pruning snapshot.
|
| services.cloudflared.tunnels.<name>.originRequest.keepAliveTimeout | Timeout after which an idle keepalive connection can be discarded.
|
| boot.initrd.systemd.contents.<name>.dlopen.features | Features to enable via dlopen ELF notes
|
| programs.foot.theme | Theme name
|
| services.jibri.xmppEnvironments.<name>.control.login.passwordFile | File containing the password for the user.
|
| services.gitlab.host | GitLab host name
|
| services.gancio.user | The user (and PostgreSQL database name) used to run the gancio server
|
| programs.tsmClient.servers.<name>.passworddir | Directory that holds the TSM
node's password information.
|
| services.cyrus-imap.cyrusSettings | Cyrus configuration settings
|
| services.cyrus-imap.imapdSettings | IMAP configuration settings
|
| systemd.sockets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.targets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.grafana.settings.analytics.feedback_links_enabled | Set to false to remove all feedback links from the UI.
|
| services.xandikos.nginx.enable | Configure the nginx reverse proxy settings.
|
| virtualisation.xen.store.settings.conflict.rateLimitIsAggregate | If the conflict.rateLimitIsAggregate option is true, then after each
tick one point of conflict-credit is given to just one domain: the
one at the front of the queue
|
| systemd.network.netdevs.<name>.batmanAdvancedConfig | Each attribute in this set specifies an option in the
[BatmanAdvanced] section of the unit
|
| services.archisteamfarm.bots.<name>.passwordFile | Path to a file containing the password
|
| services.cntlm.domain | Proxy account domain/workgroup name.
|
| services.monero.rpc.user | User name for RPC connections.
|
| services.bcg.automaticRenameKitNodes | Automatically rename kit's nodes.
|
| services.namecoind.generate | Whether to generate (mine) Namecoins.
|
| systemd.slices.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.timers.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| networking.vswitches.<name>.extraOvsctlCmds | Commands to manipulate the Open vSwitch database
|
| services.dendrite.settings.user_api.device_database.connection_string | Database for the User API, devices.
|
| services.bonsaid.configFile | Path to a .json file specifying the state transitions
|
| services.stash.settings.preview_segment_duration | Preview segment duration, in seconds
|
| services.pantalaimon-headless.instances.<name>.listenPort | The port where the daemon will listen to client connections for
this homeserver
|
| services.strongswan-swanctl.swanctl.secrets.ntlm.<name>.secret | Value of the NTLM secret, which is the NT Hash of the actual secret,
that is, MD4(UTF-16LE(secret))
|
| systemd.user.slices.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.user.timers.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| networking.vswitches | This option allows you to define Open vSwitches that connect
physical networks together
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.wyoming.faster-whisper.servers.<name>.useTransformers | Whether to provide the dependencies to allow using transformer models.
|
| services.postfix.settings.main.smtp_tls_security_level | The client TLS security level.
Use dane with a local DNSSEC validating DNS resolver enabled.
https://www.postfix.org/postconf.5.html#smtp_tls_security_level
|
| services.hadoop.hdfs.namenode.enable | Whether to enable HDFS NameNode.
|
| services.akkoma.config | Configuration for Akkoma
|
| services.neo4j.extraServerConfig | Extra configuration for Neo4j Community server
|
| services.cloudflared.tunnels.<name>.edgeIPVersion | Specifies the IP address version (IPv4 or IPv6) used to establish a connection between cloudflared and the Cloudflare global network
|
| virtualisation.kvmgt.vgpus.<name>.uuid | UUID(s) of VGPU device
|
| services.fcron.allow | Users allowed to use fcrontab and fcrondyn (one name per
line, all for everyone).
|
| services.coder.database.username | Username for accessing the database.
|
| networking.wg-quick.interfaces.<name>.mtu | If not specified, the MTU is automatically determined
from the endpoint addresses or the system default route, which is usually
a sane choice
|
| networking.supplicant.<name>.extraConf | Configuration options for wpa_supplicant.conf
|
| services.strongswan-swanctl.swanctl.authorities.<name>.slot | Optional slot number of the token that stores the certificate.
|
| programs.uwsm.waylandCompositors.<name>.extraArgs | Extra command-line arguments pass to to the compsitor.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.cloudflared.tunnels.<name>.originRequest.proxyAddress | cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP
|
| security.tpm2.tssUser | Name of the tpm device-owner and service user, set if applyUdevRules is
set.
|
| users.mysql.database | The name of the database containing the users
|
| systemd.user.units.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.bacula-sd.autochanger.<name>.extraAutochangerConfig | Extra configuration to be passed in Autochanger directive.
|
| services.cloudflared.tunnels.<name>.originRequest.proxyType | cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP
|
| security.pam.services.<name>.googleAuthenticator.enable | If set, users with enabled Google Authenticator (created
~/.google_authenticator) will be required
to provide Google Authenticator token to log in.
|
| services.radicle.ci.adapters.native.instances.<name>.runtimePackages | Packages added to the adapter's PATH.
|
| services.mediagoblin.settings.mediagoblin.email_sender_address | Email address which notices are sent from.
|
| boot.binfmt.registrations.<name>.openBinary | Whether to pass the binary to the interpreter as an open
file descriptor, instead of a path.
|
| boot.initrd.systemd.contents.<name>.dlopen.usePriority | Priority of dlopen ELF notes to include. "required" is
minimal, "recommended" includes "required", and
"suggested" includes "recommended"
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.serveraddress | mailserver name or address
|
| services.tayga.tunDevice | Name of the nat64 tun device.
|
| security.pam.services.<name>.googleAuthenticator.allowNullOTP | Whether to allow login for accounts that have no OTP set
(i.e., accounts with no OTP configured or no existing
~/.google_authenticator).
|
| services.sanoid.templates.<name>.script_timeout | Time limit for pre/post/pruning script execution time (<=0 for infinite).
|
| services.mautrix-meta.instances.<name>.environmentFile | File containing environment variables to substitute when copying the configuration
out of Nix store to the services.mautrix-meta.dataDir
|
| services.pihole-web.hostName | Domain name for the website.
|
| services.journald.rateLimitBurst | Configures the rate limiting burst limit (number of messages per
interval) that is applied to all messages generated on the system
|
| services.mailman.ldap.attrMap.username | LDAP-attribute that corresponds to the username-attribute in mailman.
|
| fonts.fontconfig.localConf | System-wide customization file contents, has higher priority than
defaultFonts settings.
|
| boot.isNspawnContainer | Whether the machine is running in an nspawn container
|
| services.bluemap.coreSettings | Settings for the core.conf file, see upstream docs.
|
| services.graphite.web.extraConfig | Graphite webapp settings
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| networking.vswitches.<name>.interfaces | The physical network interfaces connected by the vSwitch.
|
| systemd.network.netdevs.<name>.wireguardConfig | Each attribute in this set specifies an option in the
[WireGuard] section of the unit
|
| services.tailscale.serve.services | Services to configure for Tailscale Serve
|
| networking.interfaces.<name>.virtualOwner | In case of a virtual device, the user who owns it.
null will not set owner, allowing access to any user.
|
| services.chhoto-url.settings.custom_landing_directory | The path of a directory which contains a custom landing page.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.limesurvey.httpd.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.mosquitto.listeners.*.users.<name>.hashedPasswordFile | Specifies the path to a file containing the
hashed password for the MQTT user
|
| services.tarsnap.archives.<name>.aggressiveNetworking | Upload data over multiple TCP connections, potentially
increasing tarsnap's bandwidth utilisation at the cost
of slowing down all other network traffic
|
| services.chhoto-url.settings.public_mode_expiry_delay | The maximum expiry delay in seconds to force in public mode.
|
| networking.supplicant.<name>.configFile.path | External wpa_supplicant.conf configuration file
|
| services.cpupower-gui.enable | Enables dbus/systemd service needed by cpupower-gui
|
| services.cyrus-imap.user | Cyrus IMAP user name
|
| services.grafana.settings.security.x_content_type_options | Set to false to disable the X-Content-Type-Options response header
|
| hardware.fw-fanctrl.config.strategies.<name>.speedCurve | How should the speed curve look like
|
| services.gitea.dump.file | Filename to be used for the dump
|
| containers.<name>.allowedDevices.*.modifier | Device node access modifier
|
| services.matrix-synapse.settings.app_service_config_files | A list of application service config file to use
|
| services.movim.domain | Fully-qualified domain name (FQDN) for the Movim instance.
|
| services.namecoind.rpc.password | Password for RPC connections.
|
| services.code-server.host | The host name or IP address the server should listen to.
|
| services.nats.serverName | Name of the NATS server, must be unique if clustered.
|
| programs.starship.presets | Presets files to be merged with settings in order.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.pantalaimon-headless.instances.<name>.listenAddress | The address where the daemon will listen to client connections
for this homeserver.
|
| services.borgbackup.jobs.<name>.encryption.passphrase | The passphrase the backups are encrypted with
|
| networking.wg-quick.interfaces.<name>.peers.*.publicKey | The base64 public key to the peer.
|
| services.gitlab.databaseUsername | GitLab database user.
|
| services.avahi.domainName | Domain name for all advertisements.
|
| services.postgresql.systemCallFilter.<name>.priority | Set the priority of the system call filter setting
|
| services.cloudflared.tunnels.<name>.originRequest.noHappyEyeballs | Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
|
| services.patroni.scope | Cluster name.
|
| networking.wireguard.interfaces.<name>.ips | The IP addresses of the interface.
|
| systemd.targets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.sockets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| users.users.<name>.openssh.authorizedKeys.keyFiles | A list of files each containing one OpenSSH public key that should be
added to the user's authorized keys
|
| services.dendrite.settings.user_api.account_database.connection_string | Database for the User API, accounts.
|
| services.mail.sendmailSetuidWrapper.program | The name of the wrapper program
|
| programs.nix-required-mounts.allowedPatterns.<name>.paths | A list of glob patterns, indicating which paths to expose to the sandbox
|
| boot.loader.limine.additionalFiles | A set of files to be copied to /boot
|
| boot.loader.refind.additionalFiles | A set of files to be copied to /boot
|
| services.authelia.instances.<name>.secrets.storageEncryptionKeyFile | Path to your storage encryption key.
|
| systemd.user.sockets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.user.targets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.avahi.hostName | Host name advertised on the LAN
|
| services.nscd.config | Configuration to use for Name Service Cache Daemon
|
| services.murmur.user | The name of an existing user to use to run the service
|
| programs.uwsm.waylandCompositors.<name>.comment | The comment field of the desktop entry file.
|
| networking.interfaces.<name>.ipv4.routes.*.address | IPv4 address of the network.
|
| networking.interfaces.<name>.ipv6.routes.*.address | IPv6 address of the network.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.bitlbee.extraSettings | Will be inserted in the Settings section of the config file.
|
| services.postgresqlWalReceiver.receivers.<name>.compress | Enables gzip compression of write-ahead logs, and specifies the compression level
(0 through 9, 0 being no compression and 9 being best compression)
|
| services.strongswan-swanctl.swanctl.authorities.<name>.file | Absolute path to the certificate to load
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.ah_proposals | AH proposals to offer for the CHILD_SA
|
| virtualisation.fileSystems.<name>.noCheck | Disable running fsck on this filesystem.
|
| systemd.user.timers.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.slices.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| networking.sits.<name>.encapsulation | Configures the type of encapsulation.
|
| users.users.<name>.openssh.authorizedKeys.keys | A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys
|
| services.namecoind.trustedNodes | List of the only peer IP addresses to connect to
|
| services.filesender.settings.storage_filesystem_path | When using storage type filesystem this is the absolute path to the file system where uploaded files are stored until they expire
|
| services.grafana.settings.security.csrf_additional_headers | List of allowed headers to be set by the user
|
| programs.zsh.ohMyZsh.theme | Name of the theme to be used by oh-my-zsh.
|
| networking.supplicant | Interfaces for which to start wpa_supplicant
|
| programs.tsmClient.servers.<name>.tcpserveraddress | Host/domain name or IP address of the IBM TSM server.
|
| services.cloudlog.extraConfig | Any additional text to be appended to the config.php
configuration file
|
| security.pam.services.<name>.googleAuthenticator.forwardPass | The authentication provides a single field requiring
the user's password followed by the one-time password (OTP).
|
| services.pantalaimon-headless.instances.<name>.extraSettings | Extra configuration options
|
| services.nomad.extraSettingsPaths | Additional settings paths used to configure nomad
|
| services.strongswan-swanctl.swanctl.connections.<name>.ppk_id | String identifying the Postquantum Preshared Key (PPK) to be used.
|
| services.wstunnel.clients.<name>.upgradeCredentials | Use these credentials to authenticate during the HTTP upgrade request
(Basic authorization type, USER:[PASS]).
Passwords specified here will be world-readable in the Nix store!
To pass a password to the service, point the environmentFile option
to a file containing HTTP_PASSWORD=<your-password-here> and set this
option to <user>:$HTTP_PASSWORD
|
| services.trilium-server.nginx.enable | Configure the nginx reverse proxy settings.
|
| services.dnsdist.dnscrypt.providerName | The name that will be given to this DNSCrypt resolver.
The provider name must start with 2.dnscrypt-cert..
|
| networking.wg-quick.interfaces.<name>.privateKeyFile | Private key file as generated by wg genkey.
|
| services.postfix.settings.main.smtpd_tls_security_level | The server TLS security level
|
| services.freshrss.webserver | Whether to use nginx or caddy for virtual host management
|
| services.dokuwiki.webserver | Whether to use nginx or caddy for virtual host management
|
| security.pam.services.<name>.googleOsLoginAccountVerification | If set, will use the Google OS Login PAM modules
(pam_oslogin_login,
pam_oslogin_admin) to verify possible OS Login
users and set sudoers configuration accordingly
|
| services.sitespeed-io.runs | A list of run configurations
|
| services.pgbouncer.settings.pgbouncer.max_user_connections | Do not allow more than this many server connections per user (regardless of database)
|
| services.matrix-conduit.settings.global.allow_check_for_updates | Whether to allow Conduit to automatically contact
https://conduit.rs hourly to check for important Conduit news
|
| services.hadoop.hdfs.namenode.extraFlags | Extra command line flags to pass to HDFS NameNode
|
| services.cloudflared.tunnels.<name>.originRequest.connectTimeout | Timeout for establishing a new TCP connection to your origin server
|
| services.limesurvey.nginx.virtualHost.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_emails | List of emails to allow access to this vhost, or null to allow all.
|
| services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_groups | List of groups to allow access to this vhost, or null to allow all.
|
| services.mattermost.environmentFile | Environment file (see systemd.exec(5)
"EnvironmentFile=" section for the syntax) which sets config options
for mattermost (see the Mattermost documentation)
|
| users.users.<name>.openssh.authorizedPrincipals | A list of verbatim principal names that should be added to the user's
authorized principals.
|
| services.syncplay.maxUsernameLength | Maximum number of characters in a username.
|
| services.minetest-server.config | Settings to add to the minetest config file
|
| services.doh-server.settings.ecs_allow_non_global_ip | By default, non global IP addresses are never forwarded to upstream servers
|
| services.icingaweb2.modules.monitoring.transports.<name>.type | Type of this transport
|
| services.tuned.settings.default_instance_priority | Default instance (unit) priority.
|
| services.samba-wsdd.domain | Set domain name (disables workgroup).
|
| virtualisation.fileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| services.radicale.rights | Configuration for Radicale's rights file
|
| services.grafana.settings.security.content_security_policy | Set to true to add the Content-Security-Policy header to your requests
|
| services.vault.address | The name of the ip interface to listen to
|
| security.pam.services.<name>.googleOsLoginAuthentication | If set, will use the pam_oslogin_login's user
authentication methods to authenticate users using 2FA
|
| security.ipa.ipaHostname | Fully-qualified hostname used to identify this host in the IPA domain.
|
| boot.binfmt.registrations.<name>.fixBinary | Whether to open the interpreter file as soon as the
registration is loaded, rather than waiting for a
relevant file to be invoked
|
| services.monica.mail.fromName | Mail "from" name.
|
| services.tmate-ssh-server.host | External host name
|
| services.kanidm.unix.settings.kanidm.pam_allowed_login_groups | Kanidm groups that are allowed to login using PAM.
|
| services.zoneminder.hostname | The hostname on which to listen.
|
| networking.interfaces.<name>.ipv6.addresses | List of IPv6 addresses that will be statically assigned to the interface.
|
| networking.interfaces.<name>.ipv4.addresses | List of IPv4 addresses that will be statically assigned to the interface.
|
| networking.wireguard.interfaces.<name>.type | The type of the interface
|
| services.icingaweb2.modules.monitoring.transports.<name>.host | Host for the api or remote transport
|
| services.influxdb2.provision.organizations.<name>.auths | API tokens to provision for the user in this organization.
|
| services.syncthing.configDir | The path where the settings and keys will exist.
|
| networking.wireguard.interfaces.<name>.peers | Peers linked to the interface.
|
| services.kanidm.serverSettings | Settings for Kanidm, see
the documentation
and example configuration
for possible values.
|
| services.firezone.server.provision.accounts.<name>.features.idp_sync | Whether to enable the idp_sync feature for this account.
|
| services.firezone.server.provision.accounts.<name>.features.rest_api | Whether to enable the rest_api feature for this account.
|
| services.onlyoffice.hostname | FQDN for the OnlyOffice instance.
|
| services.cyrus-imap.group | Cyrus IMAP group name
|
| containers.<name>.ephemeral | Runs container in ephemeral mode with the empty root filesystem at boot
|
| services.icingaweb2.modules.monitoring.transports.<name>.path | Path to the socket for local or remote transports
|
| services.icingaweb2.modules.monitoring.transports.<name>.port | Port to connect to for the api or remote transport
|
| hardware.fw-fanctrl.config.strategies.<name>.speedCurve.*.temp | Temperature in °C at which the fan speed should be changed
|
| services.pgadmin.emailServer.username | SMTP server username for email delivery
|
| services.davis.database.urlFile | A file containing the database connection url
|
| fileSystems.<name>.overlay.useStage1BaseDirectories | If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot
|
| services.icingaweb2.modules.monitoring.backends.<name>.disabled | Disable this backend
|
| services.postgresql.settings.shared_preload_libraries | List of libraries to be preloaded.
|
| systemd.user.sockets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.targets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.strongswan-swanctl.swanctl.authorities.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.parsedmarc.provision.localMail.recipientName | The DMARC mail recipient name, i.e. the name part of the
email address which receives DMARC reports
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.discourse.admin.username | The admin user username.
|
| services.strongswan-swanctl.swanctl.connections.<name>.dscp | Differentiated Services Field Codepoint to set on outgoing IKE packets for
this connection
|
| programs.tsmClient.defaultServername | If multiple server stanzas are declared with
programs.tsmClient.servers,
this option may be used to name a default
server stanza that IBM TSM uses in the absence of
a user-defined dsm.opt file
|
| services.nextcloud.settings.mail_send_plaintext_only | Email will be sent by default with an HTML and a plain text body
|
| services.dovecot2.user | Dovecot user name.
|
| services.kismet.serverName | The name of the server.
|
| systemd.shutdownRamfs.contents.<name>.dlopen.features | Features to enable via dlopen ELF notes
|
| services.vikunja.frontendHostname | The Hostname under which the frontend is running.
|
| services.elasticsearch.cluster_name | Elasticsearch name that identifies your cluster for auto-discovery.
|
| services.davfs2.davUser | When invoked by root the mount.davfs daemon will run as this user
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.password | |
| networking.wg-quick.interfaces.<name>.extraOptions | Extra options to append to the interface section
|
| virtualisation.oci-containers.containers.<name>.hostname | The hostname of the container.
|
| users.extraUsers.<name>.openssh.authorizedKeys.keyFiles | A list of files each containing one OpenSSH public key that should be
added to the user's authorized keys
|
| services.murmur.group | The name of an existing group to use to run the service
|
| networking.wg-quick.interfaces.<name>.table | The kernel routing table to add this interface's
associated routes to
|
| hardware.fw-fanctrl.config.strategies.<name>.speedCurve.*.speed | Percent how fast the fan should run at
|
| services.skydns.nameservers | Skydns list of nameservers to forward DNS requests to when not authoritative for a domain.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| virtualisation.fileSystems.<name>.fsType | Type of the file system
|
| services.cassandra.jmxRoles.*.username | Username for JMX
|
| services.cloudflared.tunnels.<name>.certificateFile | Account certificate file, necessary to create, delete and manage tunnels
|
| networking.wg-quick.interfaces.<name>.autostart | Whether to bring up this interface automatically during boot.
|
| services.gdomap.enable | Whether to enable GNUstep Distributed Objects name server.
|
| users.extraUsers.<name>.openssh.authorizedKeys.keys | A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys
|
| services.portunus.seedSettings | Seed settings for users and groups
|
| services.bluemap.webappSettings | Settings for the webapp.conf file, see upstream docs.
|
| services.weblate.smtp.user | SMTP login name.
|
| services.logstash.extraSettings | Extra Logstash settings in YAML format.
|
| services.librenms.user | Name of the LibreNMS user.
|
| containers.<name>.privateUsers | Whether to give the container its own private UIDs/GIDs space (user namespacing)
|
| networking.supplicant.<name>.configFile.writable | Whether the configuration file at configFile.path should be written to by
wpa_supplicant.
|
| networking.sits.<name>.encapsulation.port | Destination port when using UDP encapsulation.
|
| networking.wireguard.interfaces.<name>.preSetup | Commands called at the start of the interface setup.
|
| services.baikal.pool | Name of existing phpfpm pool that is used to run web-application
|
| services.strongswan-swanctl.swanctl.connections.<name>.vips | List of virtual IPs to request in IKEv2 configuration payloads or IKEv1
Mode Config
|
| networking.wg-quick.interfaces.<name>.privateKey | Base64 private key generated by wg genkey
|
| systemd.mounts.*.wantedBy | Units that want (i.e. depend on) this unit
|
| services.strongswan-swanctl.swanctl.authorities.<name>.cacert | The certificates may use a relative path from the swanctl
x509ca directory or an absolute path
|
| systemd.shutdownRamfs.contents.<name>.dlopen.usePriority | Priority of dlopen ELF notes to include. "required" is
minimal, "recommended" includes "required", and
"suggested" includes "recommended"
|
| services.hardware.lcd.server.usbGroup | The group to use for settings permissions
|
| services.kanidm.provision.systems.oauth2.<name>.enableLocalhostRedirects | Allow localhost redirects
|
| services.tor.torsocks.socks5Username | SOCKS5 username
|
| services.icecream.daemon.hostname | Hostname of the daemon in the icecream infrastructure
|
| services.hardware.bolt.enable | Whether to enable Bolt, a userspace daemon to enable
security levels for Thunderbolt 3 on GNU/Linux
|
| services.kanidm.provision.systems.oauth2.<name>.allowInsecureClientDisablePkce | Disable PKCE on this oauth2 resource server to work around insecure clients
that may not support it
|
| services.influxdb2.provision.organizations.<name>.buckets | Buckets to provision in this organization.
|
| boot.loader.systemd-boot.extraEntries | Any additional entries you want added to the systemd-boot menu
|
| users.extraUsers.<name>.openssh.authorizedPrincipals | A list of verbatim principal names that should be added to the user's
authorized principals.
|
| services.postgresqlWalReceiver.receivers.<name>.slot | Require pg_receivewal to use an existing replication slot (see
Section 26.2.6 of the PostgreSQL manual)
|
| networking.interfaces.<name>.ipv4.routes.*.type | Type of the route
|
| networking.interfaces.<name>.ipv6.routes.*.type | Type of the route
|
| services.keter.bundle.appName | The name keter assigns to this bundle
|
| services.guix.publish.user | Name of the user to change once the server is up.
|
| services.wordpress.webserver | Whether to use apache2 or nginx for virtual host management
|
| services.pantalaimon-headless.instances.<name>.homeserver | The URI of the homeserver that the pantalaimon proxy should
forward requests to, without the matrix API path but including
the http(s) schema.
|
| networking.wireguard.interfaces.<name>.postSetup | Commands called at the end of the interface setup.
|
| programs.uwsm.waylandCompositors.<name>.binPath | The wayland-compositor binary path that will be called by UWSM
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.starttls | set to true for using STARTTLS to start a TLS connection
|
| services.mediawiki.extraConfig | Any additional text to be appended to MediaWiki's
LocalSettings.php configuration file
|
| services.postgresqlWalReceiver.receivers.<name>.environment | Environment variables passed to the service
|
| services.firezone.server.smtp.username | Username to authenticate against the SMTP relay
|
| networking.interfaces.<name>.ipv4.routes.*.prefixLength | Subnet mask of the network, specified as the number of
bits in the prefix (24).
|
| networking.interfaces.<name>.ipv6.routes.*.prefixLength | Subnet mask of the network, specified as the number of
bits in the prefix (64).
|
| services.postgresqlWalReceiver.receivers.<name>.statusInterval | Specifies the number of seconds between status packets sent back to the server
|
| services.postgresqlWalReceiver.receivers.<name>.postgresqlPackage | The postgresql package to use.
|
| networking.vswitches.<name>.controllers | Specify the controller targets
|
| networking.interfaces.<name>.wakeOnLan.policy | The Wake-on-LAN policy
to set for the device
|
| services.freshrss.api.enable | Whether to enable API access for mobile apps and third-party clients (Google Reader API and Fever API)
|
| services.influxdb2.provision.organizations.<name>.present | Whether to ensure that this organization is present or absent.
|
| services.mautrix-meta.instances.<name>.registrationServiceUnit | The registration service that generates the registration file
|
| networking.wireguard.interfaces.<name>.metric | Set the metric of routes related to this Wireguard interface.
|
| services.tt-rss.email.fromName | Name for sending outgoing mail
|
| services.peertube-runner.instancesToRegister.<name>.runnerDescription | Runner description declared to the PeerTube instance.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.microsocks.authUsername | Optional username to use for authentication.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.crl_uris | List of CRL distribution points (ldap, http, or file URI)
|
| services.rspamd.locals | Local configuration files, written into /etc/rspamd/local.d/{name}.
|
| services.bacula-fd.tls.verifyPeer | Verify peer certificate
|
| services.bacula-sd.tls.verifyPeer | Verify peer certificate
|
| services.tt-rss.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.matrix-synapse.settings.url_preview_url_blacklist | Optional list of URL matches that the URL preview spider is
denied from accessing.
|
| services.strongswan-swanctl.swanctl.connections.<name>.pull | If the default of yes is used, Mode Config works in pull mode, where the
initiator actively requests a virtual IP
|
| services.epmd.enable | Whether to enable socket activation for Erlang Port Mapper Daemon (epmd),
which acts as a name server on all hosts involved in distributed
Erlang computations.
|
| virtualisation.oci-containers.containers.<name>.login.username | Username for login.
|
| networking.wg-quick.interfaces.<name>.configFile | wg-quick .conf file, describing the interface
|
| services.dovecot2.group | Dovecot group name.
|
| services.hqplayerd.auth.username | Username used for HQPlayer's WebUI
|
| networking.wg-quick.interfaces.<name>.peers.*.endpoint | Endpoint IP or hostname of the peer, followed by a colon,
and then a port number of the peer.
|
| services.bacula-dir.tls.verifyPeer | Verify peer certificate
|
| services.strongswan-swanctl.swanctl.pools.<name>.split_exclude | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.split_include | Address or CIDR subnets
StrongSwan default: []
|
| services.tor.client.onionServices.<name>.clientAuthorizations | Clients' authorizations for a v3 onion service,
as a list of files containing each one private key, in the format:
descriptor:x25519:<base32-private-key>
See torrc manual.
|
| programs.nix-required-mounts.allowedPatterns.<name>.onFeatures | Which requiredSystemFeatures should trigger relaxation of the sandbox
|
| virtualisation.interfaces.<name>.vlan | VLAN to which the network interface is connected.
|
| programs.tsmClient.servers | Server definitions ("stanzas")
for the client system-options file
|
| users.mysql.pam.logging.table | The name of the table to which logs are written.
|
| services.warpgate.settings.http.trust_x_forwarded_headers | Trust X-Forwarded-* headers
|
| hardware.nvidia.nvidiaSettings | Whether to enable nvidia-settings, NVIDIA's GUI configuration tool
.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.ocsp_uris | List of OCSP URIs
|
| services.grav.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.outline.smtp.host | Host name or IP address of the SMTP server.
|
| services.bcg.automaticRenameGenericNodes | Automatically rename generic nodes.
|
| boot.binfmt.registrations.<name>.magicOrExtension | The magic number or extension to match on.
|
| virtualisation.fileSystems.<name>.label | Label of the device
|
| services.authelia.instances.<name>.environmentVariables | Additional environment variables to provide to authelia
|
| services.limesurvey.nginx.virtualHost.serverName | Name of this virtual host
|
| services.librenms.group | Name of the LibreNMS group.
|
| specialisation.<name>.inheritParentConfig | Include the entire system's configuration
|
| virtualisation.oci-containers.containers.<name>.dependsOn | Define which other containers this one depends on
|
| services.cloudflared.tunnels.<name>.originRequest.disableChunkedEncoding | Disables chunked transfer encoding
|
| services.deye-dummycloud.mqttUsername | MQTT username
|
| boot.binfmt.registrations.<name>.preserveArgvZero | Whether to pass the original argv[0] to the interpreter
|
| virtualisation.fileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| services.strongswan-swanctl.swanctl.connections.<name>.encap | To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
NAT detection payloads
|
| virtualisation.allInterfaces.<name>.vlan | VLAN to which the network interface is connected.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote_addrs | Remote address(es) to use for IKE communication
|
| networking.wireguard.interfaces.<name>.peers.*.endpoint | Endpoint IP or hostname of the peer, followed by a colon,
and then a port number of the peer
|
| users.mysql.pam.updateTable | The name of the table used for password alteration
|
| services.castopod.database.hostname | Database hostname.
|
| networking.interfaces.<name>.ipv4.routes | List of extra IPv4 static routes that will be assigned to the interface.
If the route type is the default unicast, then the scope
is set differently depending on the value of networking.useNetworkd:
the script-based backend sets it to link, while networkd sets
it to global.
If you want consistency between the two implementations,
set the scope of the route manually with
networking.interfaces.eth0.ipv4.routes = [{ options.scope = "global"; }]
for example.
|
| networking.firewall.interfaces.<name>.allowedUDPPorts | List of open UDP ports.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local | Section for a local authentication round
|
| services.dnsdist.enable | Whether to enable dnsdist domain name server.
|
| services.slurm.controlAddr | Name that ControlMachine should be referred to in establishing a
communications path.
|
| services.unbound.enable | Whether to enable Unbound domain name server.
|
| services.ghostunnel.servers.<name>.disableAuthentication | Disable client authentication, no client certificate will be required.
|
| services.strongswan-swanctl.swanctl.connections.<name>.version | IKE major version to use for connection.
- 1 uses IKEv1 aka ISAKMP,
- 2 uses IKEv2.
- A connection using the default of 0 accepts both IKEv1 and IKEv2 as
responder, and initiates the connection actively with IKEv2
|
| services.matrix-synapse.workers.<name>.worker_listeners | List of ports that this worker should listen on, their purpose and their configuration.
|
| services.rss-bridge.pool | Name of phpfpm pool that is used to run web-application
|
| hardware.nvidia-container-toolkit.device-name-strategy | Specify the strategy for generating device names,
passed to nvidia-ctk cdi generate
|
| services.ircdHybrid.serverName | IRCD server name.
|
| services.icingaweb2.modules.monitoring.transports.<name>.password | Password for the api transport
|
| services.hadoop.hdfs.namenode.openFirewall | Open firewall ports for HDFS NameNode.
|
| services.varnish.listen.*.address | If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").
(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
followed by the name of an abstract socket ("@myvarnishd") accept connections
on a Unix domain socket
|
| programs.schroot.profiles.<name>.nssdatabases | System databases (as described in /etc/nsswitch.conf on GNU/Linux systems) to copy into the chroot from the host.
|
| networking.openconnect.interfaces.<name>.user | Username to authenticate with.
|
| services.icingaweb2.modules.monitoring.transports.<name>.instance | Assign a icinga instance to this transport
|
| services.olivetin.extraConfigFiles | Config files to merge into the settings defined in services.olivetin.settings
|
| services.k3s.autoDeployCharts | Auto deploying Helm charts that are installed by the k3s Helm controller
|
| services.kubernetes.proxy.hostname | Kubernetes proxy hostname override.
|
| containers.<name>.networkNamespace | Takes the path to a file representing a kernel network namespace that the container
shall run in
|
| virtualisation.fileSystems.<name>.autoFormat | If the device does not currently contain a filesystem (as
determined by blkid), then automatically
format it with the filesystem type specified in
fsType
|
| networking.firewall.interfaces.<name>.allowedTCPPorts | List of TCP ports on which incoming connections are
accepted.
|
| services.icingaweb2.modules.monitoring.transports.<name>.resource | SSH identity resource for the remote transport
|
| services.pfix-srsd.configurePostfix | Whether to configure the required settings to use pfix-srsd in the local Postfix instance.
|
| networking.supplicant.<name>.userControlled.group | Members of this group can control wpa_supplicant.
|
| services.forgejo.dump.file | Filename to be used for the dump
|
| networking.vswitches.<name>.supportedOpenFlowVersions | Supported versions to enable on this switch.
|
| services.grafana.settings.analytics.check_for_plugin_updates | When set to false, disables checking for new versions of installed plugins from https://grafana.com
|
| i18n.inputMethod.fcitx5.plasma6Support | Use qt6 versions of fcitx5 packages
|
| services.prometheus.remoteRead.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.mailman.enablePostfix | Enable Postfix integration
|
| services.buffyboard.settings.quirks.ignore_unused_terminals | If true, buffyboard won't automatically update the layout of a new terminal and
draw the keyboard, if the terminal is not opened by any process
|
| services.apcupsd.configText | Contents of the runtime configuration file, apcupsd.conf
|
| services.prosody.muc.*.domain | Domain name of the MUC
|
| services.mjpg-streamer.user | mjpg-streamer user name.
|
| services.cloudflared.tunnels.<name>.originRequest.keepAliveConnections | Maximum number of idle keepalive connections between Tunnel and your origin
|
| _module.args | Additional arguments passed to each module in addition to ones
like lib, config,
and pkgs, modulesPath
|
| services.vsmartcard-vpcd.hostname | Hostname of a waiting vpicc server vpcd will be connecting to
|
| services.selfoss.pool | Name of existing phpfpm pool that is used to run web-application
|
| services.snipe-it.config | Snipe-IT configuration options to set in the
.env file
|
| services.kanidm.provision.systems.oauth2.<name>.supplementaryScopeMaps | Maps kanidm groups to additionally returned oauth scopes
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.type | The type of the listener, usually http.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote | Section for a remote authentication round
|
| services.flannel.iface | Interface to use (IP or name) for inter-host communication
|
| services.foundationdb.tls | FoundationDB Transport Security Layer (TLS) settings.
|
| networking.wireguard.interfaces.<name>.peers.*.publicKey | The base64 public key of the peer.
|
| services.rshim.index | Specify the index to create device path /dev/rshim<index>
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.port | The port to listen for HTTP(S) requests on.
|
| networking.interfaces.<name>.ipv4.routes.*.options | Other route options
|
| networking.interfaces.<name>.ipv6.routes.*.options | Other route options
|
| services.nscd.enable | Whether to enable the Name Service Cache Daemon
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.asusd.auraConfigs | The content of /etc/asusd/aura_.ron
|
| virtualisation.fileSystems.<name>.autoResize | If set, the filesystem is grown to its maximum size before
being mounted. (This is typically the size of the containing
partition.) This is currently only supported for ext2/3/4
filesystems that are mounted during early boot.
|
| services.openldap.mutableConfig | Whether to allow writable on-line configuration
|
| services.stash.settings.video_file_naming_algorithm | Hash algorithm to use for generated file naming
|
| services.rke2.autoDeployCharts | Auto deploying Helm charts that are installed by the rke2 Helm controller
|
| services.yarr.environmentFile | Environment file for specifying additional settings such as secrets
|
| services.prometheus.remoteWrite.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.dawarich.smtp.user | SMTP login name.
|
| services.mastodon.smtp.user | SMTP login name.
|
| services.resilio.deviceName | Name of the Resilio Sync device.
|
| services.lasuite-docs.domain | Domain name of the docs instance.
|
| services.lasuite-meet.domain | Domain name of the meet instance.
|
| networking.ipips.<name>.encapsulation.limit | For an IPv6-based tunnel, the maximum number of nested
encapsulation to allow. 0 means no nesting, "none" unlimited.
|
| services.postgresqlWalReceiver.receivers.<name>.synchronous | Flush the WAL data to disk immediately after it has been received
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.serverport | imap port number (at the moment only tls connection is supported)
|
| networking.interfaces.<name>.proxyARP | Turn on proxy_arp for this device
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.filters.*.name | Name of the filter
|
| services.nextjs-ollama-llm-ui.hostname | The hostname under which the Ollama UI interface should be accessible
|
| services.spiped.config | Configuration for a secure pipe daemon
|
| programs.captive-browser.enable | Whether to enable captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings.
|
| services.strongswan-swanctl.swanctl.connections.<name>.mediation | Whether this connection is a mediation connection, that is, whether this
connection is used to mediate other connections using the IKEv2 Mediation
Extension
|
| services.calibre-web.dataDir | Where Calibre-Web stores its data
|
| services.nixops-dns.domain | Fake domain name to resolve to NixOps virtual machines
|
| services.matrix-synapse.settings.registration_shared_secret | If set, allows registration by anyone who also has the shared
secret, even if registration is otherwise disabled
|
| services.jitsi-meet.interfaceConfig | Client-side web-app interface settings that override the defaults in interface_config.js
|
| networking.wireguard.interfaces.<name>.preShutdown | Commands called before shutting down the interface.
|
| services.peertube-runner.instancesToRegister.<name>.registrationTokenFile | Path to a file containing a registration token for the PeerTube instance
|
| virtualisation.oci-containers.containers.<name>.imageFile | Path to an image file to load before running the image
|
| services.vmagent.remoteWrite.basicAuthUsername | Basic Auth username used to connect to remote_write endpoint
|
| services.vlagent.remoteWrite.basicAuthUsername | Basic Auth username used to connect to remote_write endpoint
|
| services.jicofo.xmppDomain | Domain name of the XMMP server to which to connect as a component
|
| services.schleuder.listDefaults | Default settings for lists (list-defaults.yml)
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.tls | Whether to enable TLS on the listener socket.
This option will be ignored for UNIX domain sockets.
|
| virtualisation.fileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| networking.wireguard.interfaces.<name>.privateKeyFile | Private key file as generated by wg genkey.
|
| services.pretix.nginx.domain | The domain name under which to set up the virtual host.
|
| services.saunafs.masterHost | IP or hostname name of master host.
|
| networking.supplicant.<name>.userControlled.socketDir | Directory of sockets for controlling wpa_supplicant.
|
| security.ipa.shells | List of shells which binaries should be installed to /bin/
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries | SQL queries to run.
|
| services.grafana.settings.security.strict_transport_security | Set to true if you want to enable HTTP Strict-Transport-Security (HSTS) response header
|
| networking.interfaces.<name>.ipv4.addresses.*.address | IPv4 address of the interface
|
| networking.interfaces.<name>.ipv6.addresses.*.address | IPv6 address of the interface
|
| services.dolibarr.domain | Domain name of your server.
|
| networking.sits.<name>.encapsulation.sourcePort | Source port when using UDP encapsulation
|
| networking.wireguard.interfaces.<name>.mtu | Set the maximum transmission unit in bytes for the wireguard
interface
|
| services.strongswan-swanctl.swanctl.connections.<name>.mobike | Enables MOBIKE on IKEv2 connections
|
| services.flexget.systemScheduler | When true, execute the runs via the flexget-runner.timer
|
| services.nixops-dns.enable | Whether to enable the nixops-dns resolution
of NixOps virtual machines via dnsmasq and fake domain name.
|
| services.multipath.overrides | This section defines values for attributes that should override the
device-specific settings for all devices.
|
| networking.wireguard.interfaces.<name>.postShutdown | Commands called after shutting down the interface.
|
| networking.firewall.interfaces.<name>.allowedUDPPortRanges | Range of open UDP ports.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.esp_proposals | ESP proposals to offer for the CHILD_SA
|
| services.postgresql.ensureUsers.*.ensureClauses.login | Grants the user, created by the ensureUser attr, login permissions
|
| services.jigasi.xmppDomain | Domain name of the XMMP server to which to connect as a component
|
| services.wgautomesh.settings.upnp_forward_external_port | Public port number to try to redirect to this machine's Wireguard
daemon using UPnP IGD.
|
| services.gitlab-runner.configFile | Configuration file for gitlab-runner.
configFile takes precedence over services.
checkInterval and concurrent will be ignored too
|
| services.strongswan-swanctl.swanctl.pools | Section defining named pools
|
| services.tsmBackup.servername | Create a systemd system service
tsm-backup.service that starts
a backup based on the given servername's stanza
|
| services.moosefs.masterHost | IP or DNS name of the MooseFS master server.
|
| services.veilid.settings.core.protected_store.allow_insecure_fallback | If we can't use system-provided secure storage, should we proceed anyway?
|
| services.mjpg-streamer.group | mjpg-streamer group name.
|
| services.lldap.settings.force_ldap_user_pass_reset | Force reset of the admin password
|
| networking.wg-quick.interfaces.<name>.generatePrivateKeyFile | Automatically generate a private key with
wg genkey, at the privateKeyFile location.
|
| services.strongswan-swanctl.swanctl.connections.<name>.dpd_delay | Interval to check the liveness of a peer actively using IKEv2
INFORMATIONAL exchanges or IKEv1 R_U_THERE messages
|
| virtualisation.interfaces.<name>.assignIP | Automatically assign an IP address to the network interface using the same scheme as
virtualisation.vlans.
|
| services.openafsClient.cellName | Cell name.
|
| networking.firewall.interfaces.<name>.allowedTCPPortRanges | A range of TCP ports on which incoming connections are
accepted.
|
| networking.wireguard.interfaces.<name>.fwMark | Mark all wireguard packets originating from
this interface with the given firewall mark
|
| services.hadoop.hdfs.namenode.formatOnInit | Format HDFS namenode on first start
|
| services.strongswan-swanctl.swanctl.connections.<name>.rand_time | Time range from which to choose a random value to subtract from
rekey/reauth times
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.startupSql | A list of SQL statements to execute once after making a connection.
|
| services.freshrss.pool | Name of the php-fpm pool to use and setup
|
| services.mongodb.replSetName | If this instance is part of a replica set, set its name here
|
| services.librespeed.secrets | Attribute set of filesystem paths
|
| networking.wg-quick.interfaces.<name>.peers.*.allowedIPs | List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed
|
| services.discourse.database.username | Discourse database user.
|
| services.strongswan-swanctl.swanctl.connections.<name>.if_id_in | XFRM interface ID set on inbound policies/SA, can be overridden by child
config, see there for details
|
| services.nginx.resolver | Configures name servers used to resolve names of upstream servers into addresses
|
| networking.openconnect.interfaces.<name>.autoStart | Whether this VPN connection should be started automatically.
|
| virtualisation.fileSystems.<name>.encrypted.blkDev | Location of the backing encrypted device.
|
| services.ncdns.identity.hostname | The hostname of this ncdns instance, which defaults to the machine
hostname
|
| services.davfs2.davGroup | The group of the running mount.davfs daemon
|
| services.varnish.listen.*.user | User name who owns the socket file.
|
| networking.wireguard.interfaces.<name>.extraOptions | Extra options to append to the interface section
|
| services.dependency-track.oidc.teams.claim | Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
|
| services.sympa.web.server | The webserver used for the Sympa web interface
|
| virtualisation.allInterfaces.<name>.assignIP | Automatically assign an IP address to the network interface using the same scheme as
virtualisation.vlans.
|
| services.agorakit.mail.fromName | Mail "from" name.
|
| networking.wireguard.interfaces.<name>.table | The kernel routing table to add this interface's
associated routes to
|
| services.jupyter.group | Name of the group used to run the jupyter service
|
| services.rshim.backend | Specify the backend to attach
|
| services.dovecot2.imapsieve.mailbox.*.from | Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox..name when the message originates from the indicated mailbox
|
| boot.zfs.forceImportAll | Forcibly import all ZFS pool(s)
|
| containers | A set of NixOS system configurations to be run as lightweight
containers
|
| services.prometheus.scrapeConfigs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.dovecot2.imapsieve.mailbox.*.causes | Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox..name when one of the listed IMAPSIEVE causes apply
|
| networking.interfaces.<name>.ipv4.addresses.*.prefixLength | Subnet mask of the interface, specified as the number of
bits in the prefix (24).
|
| networking.interfaces.<name>.ipv6.addresses.*.prefixLength | Subnet mask of the interface, specified as the number of
bits in the prefix (64).
|
| services.prometheus.remoteWrite.*.sigv4 | Configures AWS Signature Version 4 settings.
|
| boot.binfmt.registrations.<name>.recognitionType | Whether to recognize executables by magic number or extension.
|
| services.misskey.reverseProxy.webserver.nginx.serverName | Name of this virtual host
|
| services.baikal.virtualHost | Name of the nginx virtualhost to use and setup
|
| networking.wireguard.interfaces.<name>.privateKey | Base64 private key generated by wg genkey
|
| services.strongswan-swanctl.swanctl.connections.<name>.send_cert | Send certificate payloads when using certificate authentication.
- With the default of
ifasked the daemon sends
certificate payloads only if certificate requests have been received.
never disables sending of certificate payloads
altogether,
always causes certificate payloads to be sent
unconditionally whenever certificate authentication is used
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.path | Unix domain socket path to bind this listener to.
|
| networking.interfaces.<name>.tempAddress | When IPv6 is enabled with SLAAC, this option controls the use of
temporary address (aka privacy extensions) on this
interface
|
| services.borgmatic.configurations.<name>.repositories.*.path | Path to the repository
|
| services.powerdns.enable | Whether to enable PowerDNS domain name server.
|
| services.cachix-agent.profile | Profile name, defaults to 'system' (NixOS).
|
| services.weblate.localDomain | The domain name serving your Weblate instance.
|
| networking.wireguard.interfaces.<name>.allowedIPsAsRoutes | Determines whether to add allowed IPs as routes or not.
|
| services.ceph.global.clusterName | Name of cluster
|
| networking.openconnect.interfaces.<name>.gateway | Gateway server to connect to.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.interval | How often to run this job, specified in
Go duration format.
|
| services.echoip.enableReverseHostnameLookups | Whether to enable reverse hostname lookups.
|
| services.kubernetes.kubelet.hostname | Kubernetes kubelet hostname override.
|
| services.dawarich.user | User under which dawarich runs
|
| virtualisation.credentials.<name>.source | Source file on the host containing the credential data.
|
| services.factorio.extraSettingsFile | File, which is dynamically applied to server-settings.json before
startup
|
| containers.<name>.additionalCapabilities | Grant additional capabilities to the container
|
| services.zfs.autoReplication.username | Username used by SSH to login to remote host.
|
| services.echoip.virtualHost | Name of the nginx virtual host to use and setup
|
| services.znc.confOptions.userName | The user name used to log in to the ZNC web admin interface.
|
| environment.wvdial.pppDefaults | Default ppp settings for wvdial.
|
| services.influxdb2.provision.organizations.<name>.description | Optional description for the organization.
|
| services.borgmatic.configurations.<name>.repositories.*.label | Label to the repository
|
| hardware.nvidia-container-toolkit.enable-hooks | List of hooks to enable when generating the CDI specification
|
| services.openafsServer.cellName | Cell name, this server will serve.
|
| services.strongswan-swanctl.swanctl.connections.<name>.if_id_out | XFRM interface ID set on outbound policies/SA, can be overridden by child
config, see there for details
|
| services.cachix-watch-store.cacheName | Cachix binary cache name
|
| services.smokeping.owner | Real name of the owner of the instance
|
| services.weechat.sessionName | Name of the screen session for weechat.
|
| services.matrix-continuwuity.settings.global.allow_announcements_check | If enabled, continuwuity will send a simple GET request periodically to
https://continuwuity.org/.well-known/continuwuity/announcements for any new announcements made.
|
| networking.openconnect.interfaces.<name>.privateKey | Private key to authenticate with.
|
| services.gitlab.databaseName | GitLab database name.
|
| services.bitlbee.hostName | Normally, BitlBee gets a hostname using getsockname()
|
| services.yggdrasil.configFile | A file which contains JSON or HJSON configuration for yggdrasil
|
| services.gitlab-runner.services.<name>.authenticationTokenConfigFile | Absolute path to a file containing environment variables used for
gitlab-runner registrations with runner authentication tokens
|
| console.font | The font used for the virtual consoles
|
| boot.iscsi-initiator.target | Name of the iSCSI target to boot from.
|
| services.mattermost.preferNixConfig | If both mutableConfig and this option are set, the Nix configuration
will take precedence over any settings configured in the server
console.
|
| services.paperless.passwordFile | A file containing the superuser password
|
| services.varnish.listen.*.group | Group name who owns the socket file.
|
| hardware.fw-fanctrl.config.strategies.<name>.fanSpeedUpdateFrequency | How often the fan speed should be updated in seconds
|
| services.pretalx.nginx.domain | The domain name under which to set up the virtual host.
|
| services.prosody.muc.*.tombstoneExpiry | This settings controls how long a tombstone is considered
valid
|
| services.namecoind.rpc.certificate | Certificate file for securing RPC connections.
|
| services.alerta.databaseName | Name of the database instance to connect to
|
| services.pgbouncer.settings.pgbouncer.ignore_startup_parameters | By default, PgBouncer allows only parameters it can keep track of in startup packets:
client_encoding, datestyle, timezone and standard_conforming_strings
|
| services.grafana.settings.database.locking_attempt_timeout_sec | For mysql, if the migrationLocking feature toggle is set,
specify the time (in seconds) to wait before failing to lock the database for the migrations.
|
| services.discourse.mail.outgoing.username | The username of the SMTP server.
|
| services.monica.config | monica configuration options to set in the
.env file
|
| users.users.<name>.hashedPassword | Specifies the hashed password for the user
|
| services.strongswan-swanctl.swanctl.connections.<name>.aggressive | Enables Aggressive Mode instead of Main Mode with Identity
Protection
|
| networking.openconnect.interfaces.<name>.protocol | Protocol to use.
|
| services.prometheus.exporters.ebpf.names | List of eBPF programs to load
|
| services.rss-bridge.virtualHost | Name of the nginx or caddy virtualhost to use and setup
|
| services.netatalk.extmap | File name extension mappings
|
| virtualisation.fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.sympa.database.user | Database user
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote_port | Remote UDP port for IKE communication
|
| services.samba.nmbd.enable | Whether to enable Samba's nmbd, which replies to NetBIOS over IP name
service requests
|
| services.gammu-smsd.backend.sql.user | User name used for connection to the database
|
| services.strongswan-swanctl.swanctl.connections.<name>.ppk_required | Whether a Postquantum Preshared Key (PPK) is required for this connection
|
| services.smokeping.hostName | DNS name for the urls generated in the cgi.
|
| virtualisation.credentials.<name>.text | Text content of the credential
|
| services.komodo-periphery.extraSettings | Extra settings to add to the generated TOML config.
|
| services.ddclient.domains | Domain name(s) to synchronize.
|
| services.packagekit.vendorSettings | Additional settings passed straight through to Vendor.conf
|
| hardware.fw-fanctrl.config.strategies.<name>.movingAverageInterval | Interval (seconds) of the last temperatures to use to calculate the average temperature
|
| services.keycloak.database.username | Username to use when connecting to an external or manually
provisioned database; has no effect when a local database is
automatically provisioned
|
| networking.sits.<name>.encapsulation.type | Select the encapsulation type:
-
6in4: the IPv6 packets are encapsulated using the
6in4 protocol (formerly known as SIT, RFC 4213);
-
gue: the IPv6 packets are encapsulated in UDP packets
using the Generic UDP Encapsulation (GUE) scheme;
-
foo: the IPv6 packets are encapsulated in UDP packets
using the Foo over UDP (FOU) scheme.
|
| services.filesender.database.hostname | Database hostname.
|
| services.oink.domains | List of attribute sets containing configuration for each domain
|
| services.strongswan-swanctl.swanctl.connections.<name>.over_time | Hard IKE_SA lifetime if rekey/reauth does not complete, as time
|
| virtualisation.fileSystems.<name>.device | The device as passed to mount
|
| services.bluemap.webserverSettings | Settings for the webserver.conf file, usually not required.
See upstream docs.
|
| services.postsrsd.configurePostfix | Whether to configure the required settings to use postsrsd in the local Postfix instance.
|
| networking.networkmanager.ensureProfiles.profiles.<name>.connection.id | This is the name that will be displayed by NetworkManager and GUIs.
|
| boot.initrd.luks.devices | The encrypted disk that should be opened before the root
filesystem is mounted
|
| users.mysql.pam.passwordColumn | The name of the column that contains a (encrypted) password string.
|
| users.mysql.pam.logging.msgColumn | The name of the column in the log table to which the description
of the performed operation is stored.
|
| hardware.nvidia-container-toolkit.disable-hooks | List of hooks to disable when generating the CDI specification
|
| services.smokeping.user | User that runs smokeping and (optionally) thttpd
|
| services.zoneminder.database.username | Username for accessing the database.
|
| networking.supplicant.<name>.userControlled.enable | Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli
|
| services.stash.settings.create_image_clip_from_videos | Create Image Clips from Video extensions when Videos are disabled in Library
|
| hardware.cpu.amd.ryzen-smu.enable | Whether to enable ryzen_smu, a linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors
|
| programs.chromium.initialPrefs | Initial preferences are used to configure the browser for the first run
|
| services.asterisk.useTheseDefaultConfFiles | Sets these config files to the default content
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.resources | List of HTTP resources to serve on this listener.
|
| services.wakapi.database.user | The name of the user to use for Wakapi.
|
| services.vault.storageBackend | The name of the type of storage backend
|
| services.pgpkeyserver-lite.hostname | Which hostname to set the vHost to that is proxying to sks.
|
| services.oidentd.enable | Whether to enable ‘oidentd’, an implementation of the Ident
protocol (RFC 1413)
|
| networking.ipips.<name>.encapsulation.type | Select the encapsulation type:
-
ipip to create an IPv4 within IPv4 tunnel (RFC 2003).
-
4in6 to create a 4in6 tunnel (RFC 2473);
-
ip6ip6 to create an IPv6 within IPv6 tunnel (RFC 2473);
For encapsulating IPv6 within IPv4 packets, see
the ad-hoc networking.sits option.
|
| boot.kernelPatches | A list of additional patches to apply to the kernel
|
| services.nullmailer.config.defaulthost | The content of this attribute is appended to any address that
is missing a host name
|
| services.strongswan-swanctl.swanctl.connections.<name>.dpd_timeout | Charon by default uses the normal retransmission mechanism and timeouts to
check the liveness of a peer, as all messages are used for liveness
checking
|
| services.grafana.settings.security.data_source_proxy_whitelist | Define a whitelist of allowed IP addresses or domains, with ports,
to be used in data source URLs with the Grafana data source proxy
|
| virtualisation.fileSystems.<name>.encrypted.enable | The block device is backed by an encrypted one, adds this device as a initrd luks entry.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local_port | Local UDP port for IKE communication
|
| security.agnos.settings.accounts.*.certificates.*.fullchain_output_file | Output path for the full chain including the acquired certificate
|
| services.avahi.publish.domain | Whether to announce the locally used domain name for browsing by other hosts.
|
| systemd.automounts.*.wantedBy | Units that want (i.e. depend on) this unit
|
| security.tpm2.fapi.profileName | Name of the default cryptographic profile chosen from the profile_dir directory.
|
| xdg.portal.config | Sets which portal backend should be used to provide the implementation
for the requested interface
|
| boot.binfmt.registrations.<name>.wrapInterpreterInShell | Whether to wrap the interpreter in a shell script
|
| services.pangolin.baseDomain | Your base fully qualified domain name (without any subdomains).
|
| virtualisation.fileSystems.<name>.options | Options used to mount the file system
|
| virtualisation.fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.gitlab.registry.host | GitLab container registry host name.
|
| services.bird-lg.frontend.domain | Server name domain suffixes.
|
| services.netbird.enable | Enables backward-compatible NetBird client service
|
| services.mjolnir.pantalaimon.username | The username to login with.
|
| networking.wg-quick.interfaces.<name>.peers.*.presharedKeyFile | File pointing to preshared key as generated by wg genpsk
|
| services.shellhub-agent.preferredHostname | Set the device preferred hostname
|
| virtualisation.fileSystems.<name>.neededForBoot | If set, this file system will be mounted in the initial ramdisk
|
| services.strongswan-swanctl.swanctl.connections.<name>.rekey_time | IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
does not re-check associated credentials
|
| users.extraUsers.<name>.hashedPassword | Specifies the hashed password for the user
|
| virtualisation.sharedDirectories.<name>.target | The mount point of the directory inside the virtual machine
|
| virtualisation.sharedDirectories.<name>.source | The path of the directory to share, can be a shell variable
|
| services.teeworlds.game.tournamentMode | Whether to enable tournament mode
|
| services.tomcat.virtualHosts | List consisting of a virtual host name and a list of web applications to deploy on each virtual host
|
| services.samba.nsswins | Whether to enable WINS NSS (Name Service Switch) plug-in
|
| security.wrappers.<name>.capabilities | A comma-separated list of capability clauses to be given to the
wrapper program
|
| services.strongswan-swanctl.swanctl.connections.<name>.keyingtries | Number of retransmission sequences to perform during initial
connect
|
| services.jibri.xmppEnvironments.<name>.disableCertificateVerification | Whether to skip validation of the server's certificate.
|
| services.xserver.displayManager.lightdm.greeter.package | The LightDM greeter to login via
|
| programs.zsh.enable | Whether to configure zsh as an interactive shell
|
| users.mysql.pam.logging.timeColumn | The name of the column in the log table to which the timestamp of the
log entry is stored.
|
| services.smokeping.linkStyle | DNS name for the urls generated in the cgi.
|
| services.samba-wsdd.workgroup | Set workgroup name (default WORKGROUP).
|
| services.bookstack.mail.fromName | Mail "from" name.
|
| services.corosync.clusterName | Name of the corosync cluster.
|
| services.prefect.databaseName | database name for postgres only
|
| services.sanoid.datasets.<name>.pre_snapshot_script | Script to run before taking snapshot.
|
| services.cryptpad.configureNginx | Configure Nginx as a reverse proxy for Cryptpad
|
| services.xserver.videoDriver | The name of the video driver for your graphics card
|
| services.factorio.stateDirName | Name of the directory under /var/lib holding the server's data
|
| services.shairport-sync.user | User account name under which to run shairport-sync
|
| programs.nix-required-mounts.allowedPatterns.<name>.unsafeFollowSymlinks | Whether to enable Instructs the hook to mount the symlink targets as well, when any of
the paths contain symlinks
|
| hardware.openrazer.batteryNotifier | Settings for device battery notifications.
|
| services.rathole.credentialsFile | Path to a TOML file to be merged with the settings
|
| boot.loader.systemd-boot.windows.<name>.efiDeviceHandle | The device handle of the EFI System Partition (ESP) where the Windows bootloader is
located
|
| services.autorandr.matchEdid | Match displays based on edid instead of name
|
| boot.binfmt.registrations.<name>.matchCredentials | Whether to launch with the credentials and security
token of the binary, not the interpreter (e.g. setuid
bit)
|
| users.mysql.pam.logging.pidColumn | The name of the column in the log table to which the pid of the
process utilising the pam_mysql authentication
service is stored.
|
| services.nginx.recommendedTlsSettings | Enable recommended TLS settings.
|
| services.xserver.displayManager.session | List of sessions supported with the command used to start each
session
|
| services.foundationdb.locality | FoundationDB locality settings.
|
| networking.openconnect.interfaces.<name>.passwordFile | File containing the password to authenticate with
|
| networking.wireguard.interfaces.<name>.generatePrivateKeyFile | Automatically generate a private key with
wg genkey, at the privateKeyFile location.
|
| networking.wg-quick.interfaces.<name>.peers.*.presharedKey | Base64 preshared key generated by wg genpsk
|
| services.postfix-tlspol.configurePostfix | Whether to configure the required settings to use postfix-tlspol in the local Postfix instance.
|
| services.jitsi-videobridge.xmppConfigs.<name>.disableCertificateVerification | Whether to skip validation of the server's certificate.
|
| services.kresd.enable | Whether to enable knot-resolver (version 5) domain name server
|
| services.athens.storage.s3.bucket | Bucket name for the S3 storage backend.
|
| services.gnome.at-spi2-core.enable | Whether to enable at-spi2-core, a service for the Assistive Technologies
available on the GNOME platform
|
| services.strongswan-swanctl.swanctl.connections.<name>.unique | Connection uniqueness policy to enforce
|
| services.ncps.cache.storage.s3.bucket | The name of the S3 bucket.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.connections | A list of connection strings of the SQL servers to scrape metrics from
|
| services.usbrelayd.clientName | Name, your client connects as.
|
| networking.wireguard.interfaces.<name>.peers.*.allowedIPs | List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed
|
| virtualisation.credentials.<name>.mechanism | The mechanism used to pass the credential to the VM.
|
| services.netbird.useRoutingFeatures | Enables settings required for NetBird's routing features: Network Resources, Network Routes & Exit Nodes
|
| services.sanoid.templates.<name>.pre_snapshot_script | Script to run before taking snapshot.
|
| services.jigasi.defaultJvbRoomName | Name of the default JVB room that will be joined if no special header is included in SIP invite.
|
| virtualisation.fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.avahi.nssmdns4 | Whether to enable the mDNS NSS (Name Service Switch) plug-in for IPv4
|
| services.freshrss.virtualHost | Name of the caddy/nginx virtualhost to use and setup.
|
| services.httpd.extraModules | Additional Apache modules to be used
|
| services.prosody.httpFileShare.domain | Domain name for a http_file_share service.
|
| i18n.extraLocaleSettings | A set of additional system-wide locale settings other than LANG
which can be configured with i18n.defaultLocale
|
| virtualisation.fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| services.bird-lg.frontend.servers | Server name prefixes.
|
| services.miredo.interfaceName | Name of the network tunneling interface.
|
| services.mattermost.siteName | Name of this Mattermost site.
|
| networking.hostName | The name of the machine
|
| services.keyd.keyboards | Configuration for one or more device IDs
|
| services.librenms.environmentFile | File containing env-vars to be substituted into the final config
|
| services.kapacitor.defaultDatabase.username | The username to connect to the remote InfluxDB server
|
| services.shairport-sync.group | Group account name under which to run shairport-sync
|
| services.rspamd.overrides | Overridden configuration files, written into /etc/rspamd/override.d/{name}.
|
| services.borgmatic.configurations.<name>.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| specialisation.<name>.configuration | Arbitrary NixOS configuration
|
| services.autossh.sessions.*.user | Name of the user the AutoSSH session should run as
|
| services.prosody.uploadHttp.domain | Domain name for the http-upload service
|
| services.victorialogs.basicAuthUsername | Basic Auth username used to protect VictoriaLogs instance by authorization
|
| services.bookstack.config | BookStack configuration options to set in the
.env file
|
| services.outline.storage.region | AWS S3 region name.
|
| services.agorakit.config | Agorakit configuration options to set in the
.env file
|
| services.strongswan-swanctl.swanctl.connections.<name>.local_addrs | Local address(es) to use for IKE communication
|
| networking.bonds.<name>.xmit_hash_policy | DEPRECATED, use driverOptions
|
| virtualisation.oci-containers.containers.<name>.cmd | Commandline arguments to pass to the image's entrypoint.
|
| services.hadoop.hdfs.namenode.restartIfChanged | Automatically restart the service on config change
|
| services.airsonic.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.cloudlog.virtualHost | Name of the nginx virtualhost to use and setup
|
| users.users.<name>.password | Specifies the (clear text) password for the user
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.x_forwarded | Use the X-Forwarded-For (XFF) header as the client IP and not the
actual client IP.
|
| services.guacamole-server.host | The host name or IP address the server should listen to.
|
| services.consul.interface.bind | The name of the interface to pull the bind_addr from.
|
| services.discourse.admin.fullName | The admin user's full name.
|
| services.wiki-js.stateDirectoryName | Name of the directory in /var/lib.
|
| services.strongswan-swanctl.swanctl.connections.<name>.send_certreq | Send certificate request payloads to offer trusted root CA certificates to
the peer
|
| services.matrix-synapse.settings.url_preview_ip_range_blacklist | List of IP address CIDR ranges that the URL preview spider is denied
from accessing.
|
| services.thanos.rule.alert.label-drop | Labels by name to drop before sending to alertmanager
|
| networking.wireguard.interfaces.<name>.socketNamespace | The pre-existing network namespace in which the
WireGuard interface is created, and which retains the socket even if the
interface is moved via interfaceNamespace
|
| services.matrix-synapse.settings.url_preview_ip_range_whitelist | List of IP address CIDR ranges that the URL preview spider is allowed
to access even if they are specified in url_preview_ip_range_blacklist.
|
| services.heisenbridge.namespaces | Configure the 'namespaces' section of the registration.yml for the bridge and the server
|
| services.karakeep.extraEnvironment | Environment variables to pass to Karakaeep
|
| services.headscale.settings.tls_letsencrypt_challenge_type | Type of ACME challenge to use, currently supported types:
HTTP-01 or TLS-ALPN-01.
|
| services.youtrack.virtualHost | Name of the nginx virtual host to use and setup
|
| services.synergy.client.screenName | Use the given name instead of the hostname to identify
ourselves to the server.
|
| services.nginx.recommendedGzipSettings | Enable recommended gzip settings
|
| services.firezone.server.provision.accounts.<name>.features.flow_activities | Whether to enable the flow_activities feature for this account.
|
| services.firezone.server.provision.accounts.<name>.features.traffic_filters | Whether to enable the traffic_filters feature for this account.
|
| services.strongswan-swanctl.swanctl.connections.<name>.reauth_time | Time to schedule IKE reauthentication
|
| services.clamav.clamonacc.enable | Whether to enable ClamAV on-access scanner
|
| virtualisation.oci-containers.containers.<name>.image | OCI image to run.
|
| services.unpoller.influxdb.db | Database name
|
| services.strongswan-swanctl.swanctl.authorities.<name>.cert_uri_base | Defines the base URI for the Hash and URL feature supported by
IKEv2
|
| services.sanoid.datasets.<name>.post_snapshot_script | Script to run after taking snapshot.
|
| services.mqtt2influxdb.mqtt.username | Username used to connect to the MQTT server.
|
| services.nix-serve.secretKeyFile | The path to the file used for signing derivation data
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.namespaces.names | Namespace name.
|
| virtualisation.oci-containers.containers.<name>.user | Override the username or UID (and optionally groupname or GID) used
in the container.
|
| services.synergy.server.screenName | Use the given name instead of the hostname to identify
this screen in the configuration.
|
| services.grafana.settings.security.disable_initial_admin_creation | Disable creation of admin user on first start of Grafana.
|
| services.syncplay.useACMEHost | If set, use NixOS-generated ACME certificate with the specified name for TLS
|
| services.supybot.plugins | Attribute set of additional plugins that will be symlinked to the
plugin subdirectory
|
| services.soju.acceptProxyIP | Allow the specified IPs to act as a proxy
|
| services.nextcloud-spreed-signaling.backends | A list of backends from which clients are allowed to connect from
|
| services.stargazer.routes.*.route | Route section name
|
| services.dendrite.settings.global.trusted_third_party_id_servers | Lists of domains that the server will trust as identity
servers to verify third party identifiers such as phone
numbers and email addresses
|
| services.sunshine.applications | Configuration for applications to be exposed to Moonlight
|
| hardware.display.edid.linuxhw | Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID
Attribute names will be mapped to EDID filenames <NAME>.bin
|
| services.veilid.settings.core.protected_store.always_use_insecure_storage | Should we bypass any attempt to use system-provided secure storage?
|
| networking.openconnect.interfaces.<name>.extraOptions | Extra config to be appended to the interface config
|
| networking.openconnect.interfaces.<name>.certificate | Certificate to authenticate with.
|
| virtualisation.oci-containers.containers.<name>.pull | Image pull policy for the container
|
| virtualisation.appvm.enable | This enables AppVMs and related virtualisation settings.
|
| services.zabbixWeb.httpd.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.<name>
|
| services.zabbixWeb.nginx.virtualHost | Nginx configuration can be done by adapting services.nginx.virtualHosts.<name>
|
| boot.initrd.secrets | Secrets to append to the initrd
|
| programs.regreet.font.package | The package that provides the font given in the name option.
|
| services.slurm.dbdserver.dbdHost | Hostname of the machine where slurmdbd
is running (i.e. name returned by hostname -s).
|
| services.nginx.recommendedZstdSettings | Enable recommended zstd settings
|
| services.nginx.recommendedUwsgiSettings | Whether to enable recommended uwsgi settings if a vhost does not specify the option manually.
|
| services.nginx.recommendedProxySettings | Whether to enable recommended proxy settings if a vhost does not specify the option manually.
|
| services.biboumi.credentialsFile | Path to a configuration file to be merged with the settings
|
| services.strongswan-swanctl.swanctl.connections.<name>.childless | Use childless IKE_SA initiation (allow, prefer, force or never)
|
| services.cloudlog.database.user | MySQL user name.
|
| virtualisation.oci-containers.containers.<name>.labels | Labels to attach to the container at runtime.
|
| services.gitlab.registry.serviceName | GitLab container registry service name.
|
| services.sanoid.templates.<name>.post_snapshot_script | Script to run after taking snapshot.
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.resources.*.compress | Whether synapse should compress HTTP responses to clients that support it
|
| services.davis.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.movim.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.slskd.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.discourse.backendSettings | Additional settings to put in the
discourse.conf file
|
| networking.wireguard.interfaces.<name>.peers.*.presharedKeyFile | File pointing to preshared key as generated by wg genpsk
|
| users.users.<name>.initialHashedPassword | Specifies the initial hashed password for the user, i.e. the
hashed password assigned if the user does not already
exist
|
| services.athens.storage.minio.bucket | Bucket name for the minio storage backend.
|
| services.writefreely.host | The public host name to serve.
|
| services.prometheus.exporters.mqtt.mqttUsername | Username which should be used to authenticate against the MQTT broker.
|
| users.extraUsers.<name>.password | Specifies the (clear text) password for the user
|
| services.resolved.llmnr | Controls Link-Local Multicast Name Resolution support
(RFC 4795) on the local host
|
| services.icingaweb2.pool | Name of existing PHP-FPM pool that is used to run Icingaweb2
|
| services.cjdns.ETHInterface.bind | Bind to this device for native ethernet operation.
all is a pseudo-name which will try to connect to all devices.
|
| services.snipe-it.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.dnscrypt-proxy2.upstreamDefaults | Whether to base the config declared in services.dnscrypt-proxy2.settings on the upstream example config (https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml)
Disable this if you want to declare your dnscrypt config from scratch.
|
| virtualisation.fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.apache-kafka.configFiles.serverProperties | Kafka server.properties configuration file path
|
| services.athens.index.mysql.database | Database name for the MySQL database.
|
| services.multipath.devices.*.prio | The name of the path priority routine
|
| services.cadvisor.storageDriverDb | Cadvisord storage driver database name.
|
| services.strongswan-swanctl.swanctl.connections.<name>.proposals | A proposal is a set of algorithms
|
| services.stash.settings.show_one_time_moved_notification | Whether a small notification to inform the user that Stash will no longer show a terminal window, and instead will be available in the tray
|
| services.coder.database.database | Name of database.
|
| services.minetest-server.world | Name of the world to use
|
| services.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| virtualisation.oci-containers.containers.<name>.podman.user | The user under which the container should run.
|
| virtualisation.oci-containers.containers.<name>.devices | List of devices to attach to this container.
|
| services.misskey.reverseProxy.host | The fully qualified domain name to bind to
|
| services.privoxy.inspectHttps | Whether to configure Privoxy to inspect HTTPS requests, meaning all
encrypted traffic will be filtered as well
|
| services.strongswan-swanctl.swanctl.connections.<name>.mediation_peer | Identity under which the peer is registered at the mediation server, that
is, the IKE identity the other end of this connection uses as its local
identity on its connection to the mediation server
|
| services.mastodon.user | User under which mastodon runs
|
| virtualisation.oci-containers.containers.<name>.workdir | Override the default working directory for the container.
|
| programs.regreet.theme.package | The package that provides the theme given in the name option.
|
| services.multipath.pathGroups.*.alias | The name of the multipath device
|
| services.nullmailer.config.defaultdomain | The content of this attribute is appended to any host name that
does not contain a period (except localhost), including defaulthost
and idhost
|
| services.nextcloud.configureRedis | Whether to configure Nextcloud to use the recommended Redis settings for small instances.
The Nextcloud system check recommends to configure either Redis or Memcache for file lock caching.
The notify_push app requires Redis to be configured
|
| services.slurm.controlMachine | The short hostname of the machine where SLURM control functions are
executed (i.e. the name returned by the command "hostname -s", use "tux001"
rather than "tux001.my.com").
|
| networking.wireguard.interfaces.<name>.peers.*.presharedKey | Base64 preshared key generated by wg genpsk
|
| services.dependency-track.database.username | Username to use when connecting to an external or manually
provisioned database; has no effect when a local database is
automatically provisioned
|
| users.extraUsers.<name>.initialHashedPassword | Specifies the initial hashed password for the user, i.e. the
hashed password assigned if the user does not already
exist
|
| services.xserver.xrandrHeads.*.output | The output name of the monitor, as shown by
xrandr(1) invoked without arguments.
|
| services.influxdb2.provision.initialSetup.username | Primary username
|
| services.prometheus.exporters.dmarc.imap.username | Login username for the IMAP connection.
|
| virtualisation.oci-containers.containers.<name>.autoStart | When enabled, the container is automatically started on boot
|
| services.knot-resolver.enable | Whether to enable knot-resolver (version 6) domain name server
|
| networking.wireguard.interfaces.<name>.interfaceNamespace | The pre-existing network namespace the WireGuard
interface is moved to
|
| services.traefik.environmentFiles | Files to load as an environment file just before Traefik starts
|
| services.multipath.pathGroups.*.array | The DNS name of the storage array
|
| services.netbird.server.signal.domain | The domain name for the signal service.
|
| services.prometheus.remoteRead.*.tls_config | Configures the remote read request's TLS settings.
|
| networking.nameservers | The list of nameservers
|
| swapDevices.*.encrypted.label | Label of the unlocked encrypted device
|
| services.akkoma.initDb.enable | Whether to automatically initialise the database on startup
|
| services.vault-agent.instances | Attribute set of vault-agent instances
|
| services.listmonk.database.mutableSettings | Database settings will be reset to the value set in this module if this is not enabled
|
| services.restic.server.privateRepos | Enable private repos
|
| services.nginx.recommendedBrotliSettings | Enable recommended brotli settings
|
| virtualisation.oci-containers.containers.<name>.autoRemoveOnStop | Automatically remove the container when it is stopped or killed
|
| services.gancio.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.fluidd.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.akkoma.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.matomo.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.monica.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.sanoid.datasets.<name>.process_children_only | Whether to only snapshot child datasets if recursing.
|
| services.opencloud.environment | Extra environment variables to set for the service
|
| services.openvscode-server.host | The host name or IP address the server should listen to.
|
| services.tailscale.derper.domain | Domain name under which the derper server is reachable.
|
| services.opencloud.environmentFile | An environment file as defined in systemd.exec(5)
|
| services.tailscale.authKeyFile | A file containing the auth key
|
| services.nominatim.enable | Whether to enable nominatim
|
| services.ncps.cache.lru.scheduleTimeZone | The name of the timezone to use for the cron schedule
|
| services.radicle.privateKeyFile | Absolute file path to an SSH private key,
usually generated by rad auth
|
| services._3proxy.resolution | Use this option to configure name resolution and DNS caching.
|
| services.trilium-server.instanceName | Instance name used to distinguish between different instances
|
| services.roundcube.enable | Whether to enable roundcube
|
| virtualisation.oci-containers.containers.<name>.extraOptions | Extra options for podman run.
|
| services.prometheus.remoteWrite.*.tls_config | Configures the remote write request's TLS settings.
|
| services.buildbot-worker.adminMessage | Name of the administrator of this worker
|
| virtualisation.lxc.bridgeConfig | This is the config file for override lxc-net bridge default settings.
|
| services.mattermost.mutableConfig | Whether the Mattermost config.json is writeable by Mattermost
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.bind_addresses | IP addresses to bind the listener to.
|
| services.portunus.ldap.searchUserName | The login name of the search user
|
| services.displayManager.dms-greeter.configFiles | List of DankMaterialShell configuration files to copy into the greeter
data directory at /var/lib/dms-greeter
|
| services.gotify.stateDirectoryName | The name of the directory below /var/lib where
gotify stores its runtime data.
|
| services.gammu-smsd.backend.sql.database | Database name to store sms data
|
| services.httpd.customLogFormat | Defines a custom Apache HTTPD access log format string
|
| services.crossfire-server.configFiles | Text to append to the corresponding configuration files
|
| services.firezone.server.provision.accounts.<name>.features.internet_resource | Whether to enable the internet_resource feature for this account.
|
| services.firezone.server.provision.accounts.<name>.features.policy_conditions | Whether to enable the policy_conditions feature for this account.
|
| services.weblate.configurePostgresql | Whether to enable and configure a local PostgreSQL server by creating a user and database for weblate
|
| services.lavalink.plugins.*.configName | The name of the plugin to use as the key for the plugin configuration.
|
| services.maubot.settings.plugin_databases.postgres_max_conns_per_plugin | Maximum number of connections per plugin instance.
|
| services.slurm.dbdserver.storageUser | Database user name.
|
| services.rustus.storage.s3_region | S3 region name.
|
| services.strongswan-swanctl.swanctl.connections.<name>.fragmentation | Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
fragmentation)
|
| services.headscale.settings.ephemeral_node_inactivity_timeout | Time before an inactive ephemeral node is deleted.
|
| users.users.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| networking.dhcpcd.setHostname | Whether to set the machine hostname based on the information
received from the DHCP server.
The hostname will be changed only if the current one is
the empty string, localhost or nixos
|
| virtualisation.oci-containers.containers.<name>.login.registry | Registry where to login to.
|
| services.cntlm.netbios_hostname | The hostname of your machine.
|
| programs.ryzen-monitor-ng.enable | Whether to enable ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver
|
| programs.regreet.iconTheme.package | The package that provides the icon theme given in the name option.
|
| services.nginx.experimentalZstdSettings | Enable alpha quality zstd module with recommended settings
|
| virtualisation.oci-containers.containers.<name>.preRunExtraOptions | Extra options for podman that go before the run argument.
|
| services.mqtt2influxdb.influxdb.username | Username for InfluxDB login.
|
| services.dysnomia.extraContainerProperties | An attribute set providing additional container settings in addition to the default properties
|
| services.samba.winbindd.enable | Whether to enable Samba's winbindd, which provides a number of services
to the Name Service Switch capability found in most modern C libraries,
to arbitrary applications via PAM and ntlm_auth and to Samba itself.
|
| services.prometheus.remoteRead.*.url | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.rosenpass.defaultDevice | Name of the network interface to use for all peers by default.
|
| services.athens.storage.mongo.defaultDBName | Name of the mongo database.
|
| virtualisation.graphics | Whether to run QEMU with a graphics window, or in nographic mode
|
| services.prometheus.remoteRead.*.basic_auth.username | HTTP username
|
| services.cassandra.clusterName | The name of the cluster
|
| services.nextcloud.config.objectstore.s3.hostname | Required for some non-Amazon implementations.
|
| systemd.network.config.routeTables | Defines route table names as an attrset of name to number
|
| services.prometheus.scrapeConfigs.*.label_name_length_limit | Per-scrape limit on length of labels name that will be accepted for a sample
|
| services.multipath.devices.*.vendor | Regular expression to match the vendor name
|
| services.grafana.settings.users.user_invite_max_lifetime_duration | The duration in time a user invitation remains valid before expiring
|
| services.thinkfan.fans.*.query | The query string used to match one or more fans: can be
a fullpath to the temperature file (single fan) or a fullpath
to a driver directory (multiple fans).
When multiple fans match, the query can be restricted using the
name or indices options.
|
| services.unpoller.unifi.defaults.user | Unifi service user name.
|
| services.grafana.settings.security.strict_transport_security_preload | Set to true to enable HSTS preloading option
|
| services.caddy.adapter | Name of the config adapter to use
|
| services.samba.usershares.group | Name of the group members of which will be allowed to create usershares
|
| services.prometheus.exporters.pihole.piholeHostname | Hostname or address where to find the Pi-Hole webinterface
|
| services.victoriatraces.basicAuthUsername | Basic Auth username used to protect VictoriaTraces instance by authorization
|
| services.crowdsec-firewall-bouncer.createRulesets | Whether to have the module create the appropriate firewall configuration
based on the bouncer settings
|
| services.bitwarden-directory-connector-cli.ldap.username | The user to authenticate as.
|
| services.icingaweb2.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.nextcloud.autoUpdateApps.startAt | When to run the update
|
| virtualisation.oci-containers.containers.<name>.login.passwordFile | Path to file containing password.
|
| services.outline.storage.uploadBucketName | Name of the bucket where uploads should be stored.
|
| services.linux-enable-ir-emitter.device | IR camera device to depend on
|
| services.prometheus.remoteWrite.*.basic_auth.username | HTTP username
|
| services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_email_domains | List of email domains to allow access to this vhost, or null to allow all.
|
| services.vikunja.database.database | Database name.
|
| services.bitwarden-directory-connector-cli.ldap.hostname | The host the LDAP is accessible on.
|
| services.cloudflare-ddns.wafLists | List of WAF IP Lists to manage, in the format account-id/list-name.
(Experimental feature as of cloudflare-ddns 1.14.0).
|
| services.libreswan.policies | A set of policies to apply to the IPsec connections.
The policy name must match the one of connection it needs to apply to.
|
| virtualisation.fileSystems.<name>.overlay.useStage1BaseDirectories | If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot
|
| services.prometheus.scrapeConfigs.*.tls_config | Configures the scrape request's TLS settings.
|
| services.borgbackup.jobs | Deduplicating backups using BorgBackup
|
| services.bacula-fd.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.bacula-sd.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.mysql.ensureUsers | Ensures that the specified users exist and have at least the ensured permissions
|
| networking.wireguard.interfaces.<name>.dynamicEndpointRefreshSeconds | Periodically refresh the endpoint hostname or address for all peers
|
| services.stash.settings.dangerous_allow_public_without_auth | Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/
|
| services.prometheus.remoteWrite.*.url | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| image.repart.verityStore.partitionIds.esp | Specify the attribute name of the ESP.
|
| virtualisation.oci-containers.containers.<name>.privileged | Give extended privileges to the container
|
| virtualisation.oci-containers.containers.<name>.entrypoint | Override the default entrypoint of the image.
|
| users.extraUsers.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.windmill.database.urlPath | Path to the file containing the database url windmill should connect to
|
| services.bacula-dir.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.tailscale.useRoutingFeatures | Enables settings required for Tailscale's routing features like subnet routers and exit nodes
|
| services.firezone.server.provision.accounts.<name>.features.self_hosted_relays | Whether to enable the self_hosted_relays feature for this account.
|
| services.archisteamfarm.ipcSettings | Settings to write to IPC.config
|
| hardware.firmware | List of packages containing firmware files
|
| services.pcscd.ignoreReaderNames | List of reader name patterns for the PCSC daemon to ignore
|
| services.davis.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.movim.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.slskd.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.mautrix-meta.instances | Configuration of multiple mautrix-meta instances.
services.mautrix-meta.instances.facebook and services.mautrix-meta.instances.instagram
come preconfigured with network.mode, appservice.id, bot username, display name and avatar.
|
| virtualisation.oci-containers.containers.<name>.volumes | List of volumes to attach to this container
|
| services.ntopng.redis.createInstance | Local Redis instance name
|
| networking.wg-quick.interfaces.<name>.peers.*.persistentKeepalive | This is optional and is by default off, because most
users will not need it
|
| services.lldap.environment | Environment variables passed to the service
|
| virtualisation.oci-containers.containers.<name>.log-driver | Logging driver for the container
|
| services.borgmatic.configurations.<name>.source_directories | List of source directories and files to backup
|
| services.icecream.scheduler.netName | Network name for the icecream scheduler
|
| services.bitwarden-directory-connector-cli.ldap | Options to configure the LDAP connection
|
| services.bitwarden-directory-connector-cli.sync | Options to configure what gets synced
|
| networking.ucarp.upscript | Command to run after become master, the interface name, virtual address
and optional extra parameters are passed as arguments.
|
| boot.zfs.extraPools | Name or GUID of extra ZFS pools that you wish to import during boot
|
| services.snipe-it.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.onlyoffice.postgresName | The name of database OnlyOffice should use.
|
| services.stargazer.routes | Routes that Stargazer should server
|
| users.users.<name>.initialPassword | Specifies the initial password for the user, i.e. the
password assigned if the user does not already exist
|
| services.limesurvey.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.<name>
|
| services.multipath.devices.*.product | Regular expression to match the product name
|
| services.k3s.charts | Packaged Helm charts that are linked to /var/lib/rancher/k3s/server/static/charts before k3s starts
|
| services.nginx.recommendedOptimisation | Enable recommended optimisation settings.
|
| services.librenms.distributedPoller.enable | Configure this LibreNMS instance as a distributed poller
|
| services.mastodon.configureNginx | Configure nginx as a reverse proxy for mastodon
|
| services.prometheus.exporters.py-air-control.deviceHostname | The hostname of the air purification device from which to scrape the metrics.
|
| services.agorakit.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.fediwall.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.kanboard.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.librenms.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.dolibarr.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.pixelfed.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.mainsail.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.dependency-track.nginx.domain | The domain name under which to set up the virtual host.
|
| virtualisation.oci-containers.containers.<name>.environment | Environment variables to set for this container.
|
| services.xserver.displayManager.sx.enable | Whether to enable the "sx" pseudo-display manager, which allows users
to start manually via the "sx" command from a vt shell
|
| programs.regreet.cursorTheme.package | The package that provides the cursor theme given in the name option.
|
| services.davis.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.slskd.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.portunus.dex.oidcClients | List of OIDC clients
|
| services.movim.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.avahi.nssmdns6 | Whether to enable the mDNS NSS (Name Service Switch) plug-in for IPv6
|
| services.prometheus.scrapeConfigs.*.basic_auth.username | HTTP username
|
| services.rke2.charts | Packaged Helm charts that are linked to /var/lib/rancher/rke2/server/static/charts before rke2 starts
|
| services.athens.index.postgres.database | Database name for the Postgres database.
|
| services.gancio.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.akkoma.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.fluidd.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.matomo.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.monica.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| programs.kubeswitch.commandName | The name of the command to use
|
| users.ldap.daemon.rootpwmoddn | The distinguished name to use to bind to the LDAP server
when the root user tries to modify a user's password.
|
| services.snipe-it.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.rutorrent.nginx.enable | Whether to enable nginx virtual host management
|
| services.subsonic.listenAddress | The host name or IP address on which to bind Subsonic
|
| services.qbittorrent.serverConfig | Free-form settings mapped to the qBittorrent.conf file in the profile
|
| services.pomerium.useACMEHost | If set, use a NixOS-generated ACME certificate with the specified name
|
| services.prometheus.exporters.nextcloud.username | Username for connecting to Nextcloud
|
| users.extraUsers.<name>.initialPassword | Specifies the initial password for the user, i.e. the
password assigned if the user does not already exist
|
| image.repart.verityStore.partitionIds.store | Specify the attribute name of the store partition.
|
| services.tailscale.interfaceName | The interface name for tunnel traffic
|
| services.radicle.httpd.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| virtualisation.oci-containers.containers.<name>.environmentFiles | Environment files for this container.
|
| services.victoriametrics.basicAuthUsername | Basic Auth username used to protect VictoriaMetrics instance by authorization
|
| virtualisation.sharedDirectories.<name>.securityModel | The security model to use for this share:
passthrough: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root)
mapped-xattr: some of the file attributes like uid, gid, mode bits and link target are stored as file attributes
mapped-file: the attributes are stored in the hidden .virtfs_metadata directory
|
| services.pgbackrest.repos | An attribute set of repositories as described in:
https://pgbackrest.org/configuration.html#section-repository
Each repository defaults to set repo-host to the attribute's name
|
| networking.wireguard.interfaces.<name>.peers.*.dynamicEndpointRefreshSeconds | Periodically re-execute the wg utility every
this many seconds in order to let WireGuard notice DNS / hostname
changes
|
| services.documize.stateDirectoryName | The name of the directory below /var/lib/private
where documize runs in and stores, for example, backups.
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.librenms.database.database | Name of the database on the MySQL/MariaDB server.
|
| services.xserver.displayManager.lightdm.greeters.gtk.indicators | List of allowed indicator modules to use for the lightdm gtk
greeter panel
|
| services.grafana.settings.security.content_security_policy_report_only | Set to true to add the Content-Security-Policy-Report-Only header to your requests
|
| services.printing.cups-pdf.instances | Permits to raise one or more cups-pdf instances
|
| services.akkoma.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.gancio.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.fluidd.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.monica.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.matomo.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.mjolnir.pantalaimon | pantalaimon options (enables E2E Encryption support)
|
| hardware.trackpoint.device | The device name of the trackpoint
|
| services.anuko-time-tracker.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| programs.captive-browser.browser | The shell (/bin/sh) command executed once the proxy starts
|
| services.nagios.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.moodle.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.znc.useLegacyConfig | Whether to propagate the legacy options under
services.znc.confOptions.* to the znc config
|
| networking.wireguard.interfaces.<name>.peers.*.dynamicEndpointRefreshRestartSeconds | When the dynamic endpoint refresh that is configured via
dynamicEndpointRefreshSeconds exits (likely due to a failure),
restart that service after this many seconds
|
| nixpkgs.flake.source | The path to the nixpkgs sources used to build the system
|
| services.grafana.settings.security.disable_brute_force_login_protection | Set to true to disable brute force login protection.
|
| services._3proxy.resolution.nscache | Set name cache size for IPv4.
|
| services.grafana.settings.security.strict_transport_security_subdomains | Set to true to enable HSTS includeSubDomains option
|
| services.consul.interface.advertise | The name of the interface to pull the advertise_addr from.
|
| services.thinkfan.sensors.*.query | The query string used to match one or more sensors: can be
a fullpath to the temperature file (single sensor) or a fullpath
to a driver directory (multiple sensors).
When multiple sensors match, the query can be restricted using the
name or indices options.
|
| services.rsnapshot.extraConfig | rsnapshot configuration option in addition to the defaults from
rsnapshot and this module
|
| virtualisation.oci-containers.containers.<name>.podman.sdnotify | Determines how podman should notify systemd that the unit is ready
|
| virtualisation.oci-containers.containers.<name>.imageStream | Path to a script that streams the desired image on standard output
|
| services.transmission.credentialsFile | Path to a JSON file to be merged with the settings
|
| services.bookstack.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| security.doas.extraRules.*.setEnv | Keep or set the specified variables
|
| networking.wireguard.interfaces.<name>.peers.*.persistentKeepalive | This is optional and is by default off, because most
users will not need it
|
| services.outline.oidcAuthentication.usernameClaim | Specify which claims to derive user information from
|
| services.consul-template.instances | Attribute set of consul-template instances
|
| services.limesurvey.httpd.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.<name>
|
| services.limesurvey.nginx.virtualHost | Nginx configuration can be done by adapting services.nginx.virtualHosts.<name>
|
| hardware.display.edid.modelines | Attribute set of XFree86 Modelines automatically converted
and exposed as edid/<name>.bin files in initrd
|
| services.matrix-tuwunel.stateDirectory | The name of the directory under /var/lib/ where the database will be stored
|
| services.firezone.server.provision.accounts.<name>.features.multi_site_resources | Whether to enable the multi_site_resources feature for this account.
|
| services.homebridge.uiSettings.log.service | Name of the systemd service to log to
|
| services.lasuite-meet.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| services.zfs.autoSnapshot.flags | Flags to pass to the zfs-auto-snapshot command
|
| services.prometheus.scrapeConfigs.*.azure_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| networking.networkmanager.ensureProfiles.profiles.<name>.connection.type | The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.
|
| services.postgresqlBackup.backupAll | Backup all databases using pg_dumpall
|
| networking.wireless.userControlled | Allow users of the wpa_supplicant group to control wpa_supplicant
through wpa_gui or wpa_cli
|
| services.sanoid.datasets.<name>.no_inconsistent_snapshot | Whether to take a snapshot if the pre script fails
|
| services.airsonic.listenAddress | The host name or IP address on which to bind Airsonic
|
| virtualisation.rosetta.enable | Whether to enable Rosetta support
|
| services.nghttpx.backends.*.params.affinity | If "ip" is given, client IP based session affinity is
enabled
|
| services.jirafeau.nginxConfig.http3 | Whether to enable the HTTP/3 protocol
|
| services.calibre-web.options.reverseProxyAuth.header | Auth proxy header name.
|
| virtualisation.libvirtd.onBoot | Specifies the action to be done to / on the guests when the host boots
|
| users.mysql.pam.statusColumn | The name of the column or an SQL expression that indicates the status of
the user
|
| services.prometheus.exporters.ecoflow.ecoflowDevicesPrettyNamesFile | File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...}
The key/value map of custom names for your devices
|
| services.prometheus.exporters.artifactory.artiUsername | Username for authentication against JFrog Artifactory API.
|
| services._3proxy.resolution.nscache6 | Set name cache size for IPv6.
|
| services.kanboard.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.librenms.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.dolibarr.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.fediwall.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.agorakit.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.pixelfed.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.mainsail.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.fluent-bit.configurationFile | Fluent Bit configuration
|
| services.sanoid.templates.<name>.no_inconsistent_snapshot | Whether to take a snapshot if the pre script fails
|
| services.zabbixWeb.nginx.virtualHost.http3 | Whether to enable the HTTP/3 protocol
|
| services.prometheus.exporters.pve.user | User name under which the pve exporter shall be run.
|
| services.prometheus.exporters.nut.user | User name under which the nut exporter shall be run.
|
| services.prometheus.exporters.kea.user | User name under which the kea exporter shall be run.
|
| services.prometheus.exporters.sql.user | User name under which the sql exporter shall be run.
|
| services.prometheus.exporters.zfs.user | User name under which the zfs exporter shall be run.
|
| services.prometheus.exporters.lnd.user | User name under which the lnd exporter shall be run.
|
| services.datadog-agent.checks | Configuration for all Datadog checks
|
| services.nominatim.database.superUser | Postgresql database superuser used to create Nominatim database and
import data
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.name_filter | Specify a name filter (works as a LIKE) to apply on the server listing request.
|
| services.prometheus.alertmanagerGotify.metrics.username | The username used to access your metrics.
|
| virtualisation.containerd.configFile | Path to containerd config file
|
| virtualisation.oci-containers.containers.<name>.ports | Network ports to publish from the container to the outer host
|
| services.miniupnpd.externalInterface | Name of the external interface.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.triton_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| networking.ucarp.downscript | Command to run after become backup, the interface name, virtual address
and optional extra parameters are passed as arguments.
|
| networking.nat.externalInterface | The name of the external network interface.
|
| services.prometheus.exporters.snmp.user | User name under which the snmp exporter shall be run.
|
| services.prometheus.exporters.bind.user | User name under which the bind exporter shall be run.
|
| services.prometheus.exporters.ipmi.user | User name under which the ipmi exporter shall be run.
|
| services.prometheus.exporters.flow.user | User name under which the flow exporter shall be run.
|
| services.prometheus.exporters.nats.user | User name under which the nats exporter shall be run.
|
| services.prometheus.exporters.mail.user | User name under which the mail exporter shall be run.
|
| services.prometheus.exporters.ping.user | User name under which the ping exporter shall be run.
|
| services.prometheus.exporters.bird.user | User name under which the bird exporter shall be run.
|
| services.prometheus.exporters.ebpf.user | User name under which the ebpf exporter shall be run.
|
| services.prometheus.exporters.json.user | User name under which the json exporter shall be run.
|
| services.prometheus.exporters.mqtt.user | User name under which the mqtt exporter shall be run.
|
| services.prometheus.exporters.node.user | User name under which the node exporter shall be run.
|
| services.prometheus.exporters.knot.user | User name under which the knot exporter shall be run.
|
| services.radicle.httpd.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services._3proxy.resolution.nserver | List of nameservers to use
|
| networking.wireless.userControlled.enable | Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli
|
| services.agorakit.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.librenms.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.kanboard.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.dolibarr.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.fediwall.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.pixelfed.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.mainsail.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.certspotter.watchlist | Domain names to watch
|
| services.prometheus.exporters.php-fpm.user | User name under which the php-fpm exporter shall be run.
|
| services.athens.singleFlight.redisSentinel.masterName | Name of the sentinel master server.
|
| services.icingaweb2.modulePackages | Name-package attrset of Icingaweb 2 modules packages to enable
|
| services.zabbixWeb.httpd.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.nghttpx.frontends.*.params.sni-fwd | When performing a match to select a backend server, SNI host
name received from the client is used instead of the request
host
|
| services.athens.storage.azureblob.accountName | Account name for the Azure Blob storage backend.
|
| services.postfixadmin.enable | Whether to enable postfixadmin
|
| services.gmediarender.friendlyName | A "friendly name" for identifying the endpoint.
|
| services.archisteamfarm.bots | Bots name and configuration.
|
| services.anuko-time-tracker.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.prometheus.alertmanagerGotify.metrics.namespace | The namescape of the metrics.
|
| services.prometheus.alertmanager-ntfy.extraConfigFiles | Config files to merge into the settings defined in services.prometheus.alertmanager-ntfy.settings
|
| services.prometheus.exporters.nginx.user | User name under which the nginx exporter shall be run.
|
| services.prometheus.exporters.kafka.user | User name under which the kafka exporter shall be run.
|
| services.prometheus.exporters.redis.user | User name under which the redis exporter shall be run.
|
| services.prometheus.exporters.fritz.user | User name under which the fritz exporter shall be run.
|
| services.prometheus.exporters.idrac.user | User name under which the idrac exporter shall be run.
|
| services.prometheus.exporters.jitsi.user | User name under which the jitsi exporter shall be run.
|
| services.prometheus.exporters.dmarc.user | User name under which the dmarc exporter shall be run.
|
| services.prometheus.exporters.v2ray.user | User name under which the v2ray exporter shall be run.
|
| services.unpoller.unifi.controllers.*.user | Unifi service user name.
|
| image.repart.verityStore.partitionIds.store-verity | Specify the attribute name of the store's dm-verity hash partition.
|
| boot.loader.systemd-boot.windows | Make Windows bootable from systemd-boot
|
| boot.loader.grub.configurationName | GRUB entry name instead of default.
|
| services.radicle.httpd.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.nextcloud-spreed-signaling.hostName | The host name to bind the nginx virtual host to, if
config.services.nextcloud-spreed-signaling.configureNginx is set to true.
|
| services.prometheus.exporters.zfs.pools | Name of the pool(s) to collect, repeat for multiple pools (default: all pools).
|
| users.ldap.bind.distinguishedName | The distinguished name to bind to the LDAP server with
|
| services.bookstack.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| networking.networkmanager.enable | Whether to use NetworkManager to obtain an IP address and other
configuration for all network interfaces that are not manually
configured
|
| services.prometheus.scrapeConfigs.*.dns_sd_configs.*.names | A list of DNS SRV record names to be queried.
|
| services.munin-node.extraPlugins | Additional Munin plugins to activate
|
| programs.msmtp.accounts | Named accounts and their respective configurations
|
| services.journaldriver.logName | Configures the name of the target log in Stackdriver Logging
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.exporters.frr.user | User name under which the frr exporter shall be run
|
| services.anuko-time-tracker.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| programs.pay-respects.runtimeRules | List of rules to be added to /etc/xdg/pay-respects/rules.
pay-respects will read the contents of these generated rules to recommend command corrections
|
| services.postgresql.ensureUsers | Ensures that the specified users exist
|
| services.prometheus.exporters.statsd.user | User name under which the statsd exporter shall be run.
|
| services.prometheus.exporters.dnssec.user | User name under which the dnssec exporter shall be run.
|
| services.prometheus.exporters.script.user | User name under which the script exporter shall be run.
|
| services.prometheus.exporters.mysqld.user | User name under which the mysqld exporter shall be run.
|
| services.prometheus.exporters.deluge.user | User name under which the deluge exporter shall be run.
|
| services.prometheus.exporters.domain.user | User name under which the domain exporter shall be run.
|
| services.prometheus.exporters.fastly.user | User name under which the fastly exporter shall be run.
|
| services.prometheus.exporters.restic.user | User name under which the restic exporter shall be run.
|
| services.prometheus.exporters.pihole.user | User name under which the pihole exporter shall be run.
|
| services.prometheus.exporters.shelly.user | User name under which the shelly exporter shall be run.
|
| services.prometheus.exporters.rspamd.user | User name under which the rspamd exporter shall be run.
|
| services.prometheus.exporters.tibber.user | User name under which the tibber exporter shall be run.
|
| services.home-assistant.extraComponents | List of components that have their dependencies included in the package
|
| services.bookstack.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.xserver.desktopManager.surf-display.screensaverSettings | Screensaver settings, see man 1 xset for possible options.
|
| services.jirafeau.nginxConfig.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.pipewire.wireplumber.extraScripts | Additional scripts for WirePlumber to be used by configuration files
|
| boot.loader.grub.fsIdentifier | Determines how GRUB will identify devices when generating the
configuration file
|
| services.prometheus.exporters.nvidia-gpu.user | User name under which the nvidia-gpu exporter shall be run.
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".url.host | Domain name of the instance.
|
| services.grafana.settings.security.strict_transport_security_max_age_seconds | Sets how long a browser should cache HSTS in seconds
|
| services.zabbixWeb.nginx.virtualHost.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.firefox-syncserver.database.host | Database host name. localhost is treated specially and inserts
systemd dependencies, other hostnames or IP addresses of the local machine do not.
|
| services.sanoid.datasets.<name>.force_post_snapshot_script | Whether to run the post script if the pre script fails
|
| services.prometheus.exporters.ecoflow.scrapingInterval | Scrapping interval in seconds
|
| services.prometheus.exporters.rtl_433.user | User name under which the rtl_433 exporter shall be run.
|
| services.prometheus.exporters.bitcoin.rpcUser | RPC user name.
|
| services.umami.createPostgresqlDatabase | Whether to automatically create the database for Umami using PostgreSQL
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.jirafeau.nginxConfig.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.prometheus.exporters.systemd.user | User name under which the systemd exporter shall be run.
|
| services.prometheus.exporters.bitcoin.user | User name under which the bitcoin exporter shall be run.
|
| services.prometheus.exporters.varnish.user | User name under which the varnish exporter shall be run.
|
| services.prometheus.exporters.apcupsd.user | User name under which the apcupsd exporter shall be run.
|
| services.prometheus.exporters.ecoflow.user | User name under which the ecoflow exporter shall be run.
|
| services.prometheus.exporters.dovecot.user | User name under which the dovecot exporter shall be run.
|
| services.prometheus.exporters.process.user | User name under which the process exporter shall be run.
|
| services.prometheus.exporters.dnsmasq.user | User name under which the dnsmasq exporter shall be run.
|
| services.prometheus.exporters.libvirt.user | User name under which the libvirt exporter shall be run.
|
| services.prometheus.exporters.sabnzbd.user | User name under which the sabnzbd exporter shall be run.
|
| services.prometheus.exporters.mongodb.user | User name under which the mongodb exporter shall be run.
|
| services.prometheus.exporters.postfix.user | User name under which the postfix exporter shall be run.
|
| services.prometheus.exporters.klipper.user | User name under which the klipper exporter shall be run.
|
| services.prometheus.exporters.unbound.user | User name under which the unbound exporter shall be run.
|
| services.journaldriver.logStream | Configures the name of the Stackdriver Logging log stream into
which to write journald entries
|
| services.thanos.rule.web.prefix-header | Name of HTTP request header used for dynamic prefixing of UI links and
redirects
|
| services.sanoid.templates.<name>.force_post_snapshot_script | Whether to run the post script if the pre script fails
|
| boot.loader.grub.mirroredBoots.*.efiBootloaderId | The id of the bootloader to store in efi nvram
|
| services.zabbixWeb.nginx.virtualHost.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.influxdb2.provision.initialSetup.bucket | Primary bucket name
|
| services.pds.environmentFiles | File to load environment variables from
|
| services.athens.storage.azureblob.containerName | Container name for the Azure Blob storage backend.
|
| services.pgmanage.connections | pgmanage requires at least one PostgreSQL server be defined
|
| services.thanos.query.web.prefix-header | Name of HTTP request header used for dynamic prefixing of UI links and
redirects
|
| hardware.nvidia.prime.offload.offloadCmdMainProgram | Specifies the CLI name of the hardware.nvidia.prime.offload.enableOffloadCmd
convenience script for offloading programs to an nvidia device.
|
| system.nixos.label | NixOS version name to be used in the names of generated
outputs and boot labels
|
| services.limesurvey.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.prometheus.exporters.py-air-control.user | User name under which the py-air-control exporter shall be run.
|
| services.cassandra.listenAddress | Address or interface to bind to and tell other Cassandra nodes
to connect to
|
| services.prometheus.exporters.mailman3.user | User name under which the mailman3 exporter shall be run.
|
| programs.opengamepadui.powerstation.enable | Whether to enable Run PowerStation service for TDP control and performance settings.
.
|
| networking.dhcpcd.denyInterfaces | Disable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| boot.initrd.compressor | The compressor to use on the initrd image
|
| services.mediawiki.httpd.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.sourcehut.hg.postgresql.database | PostgreSQL database name for the hg.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.prometheus.exporters.influxdb.user | User name under which the influxdb exporter shall be run.
|
| services.prometheus.exporters.opnsense.user | User name under which the opensense exporter shall be run.
|
| services.prometheus.exporters.smartctl.user | User name under which the smartctl exporter shall be run.
|
| services.prometheus.exporters.fritzbox.user | User name under which the fritzbox exporter shall be run.
|
| services.prometheus.exporters.mikrotik.user | User name under which the mikrotik exporter shall be run.
|
| services.prometheus.exporters.nginxlog.user | User name under which the nginxlog exporter shall be run.
|
| services.prometheus.exporters.postgres.user | User name under which the postgres exporter shall be run.
|
| services.prometheus.exporters.unpoller.user | User name under which the unpoller exporter shall be run.
|
| services.prometheus.exporters.graphite.user | User name under which the graphite exporter shall be run.
|
| services.prometheus.exporters.blackbox.user | User name under which the blackbox exporter shall be run.
|
| services.prometheus.exporters.keylight.user | User name under which the keylight exporter shall be run.
|
| services.prometheus.exporters.collectd.user | User name under which the collectd exporter shall be run.
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| security.tpm2.tctiEnvironment.tabrmdConf | Configuration part of the tabrmd TCTI, like the D-Bus bus name
|
| services.sourcehut.man.postgresql.database | PostgreSQL database name for the man.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.git.postgresql.database | PostgreSQL database name for the git.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.hub.postgresql.database | PostgreSQL database name for the hub.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.nullmailer.config.remotes | A list of remote servers to which to send each message
|
| services.sourcehut.todo.postgresql.database | PostgreSQL database name for the todo.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.meta.postgresql.database | PostgreSQL database name for the meta.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| networking.dhcpcd.allowInterfaces | Enable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.zfs.autoReplication.localFilesystem | Local ZFS filesystem from which snapshots should be sent
|
| security.tpm2.tctiEnvironment.interface | The name of the TPM command transmission interface (TCTI) library to
use.
|
| services.nextcloud.config.objectstore.s3.bucket | The name of the S3 bucket.
|
| services.limesurvey.nginx.virtualHost.http3 | Whether to enable the HTTP/3 protocol
|
| services.mosquitto.listeners.*.omitPasswordAuth | Omits password checking, allowing anyone to log in with any user name unless
other mandatory authentication methods (eg TLS client certificates) are configured.
|
| services.prometheus.exporters.imap-mailstat.user | User name under which the imap-mailstat exporter shall be run.
|
| services.sourcehut.lists.postgresql.database | PostgreSQL database name for the lists.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.paste.postgresql.database | PostgreSQL database name for the paste.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.pages.postgresql.database | PostgreSQL database name for the pages.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.transmission.performanceNetParameters | Whether to enable tweaking of kernel parameters
to open many more connections at the same time
|
| services.yggdrasil.denyDhcpcdInterfaces | Disable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.postgresql.ensureUsers.*.ensureDBOwnership | Grants the user ownership to a database with the same name
|
| services.matrix-alertmanager.matrixRooms | Combination of Alertmanager receiver(s) and rooms for the bot to join
|
| services.prometheus.exporters.surfboard.user | User name under which the surfboard exporter shall be run.
|
| services.prometheus.exporters.tailscale.user | User name under which the tailscale exporter shall be run.
|
| services.prometheus.exporters.wireguard.user | User name under which the wireguard exporter shall be run.
|
| services.prometheus.exporters.rasdaemon.user | User name under which the rasdaemon exporter shall be run.
|
| services.prometheus.exporters.borgmatic.user | User name under which the borgmatic exporter shall be run.
|
| services.prometheus.exporters.smokeping.user | User name under which the smokeping exporter shall be run.
|
| services.prometheus.exporters.pgbouncer.user | User name under which the pgbouncer exporter shall be run.
|
| services.prometheus.exporters.nextcloud.user | User name under which the nextcloud exporter shall be run.
|
| services.prometheus.exporters.mongodb.collectAll | Enable all collectors
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.exporters.chrony.user | User name under which the chrony exporter shall be run
|
| services.limesurvey.httpd.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.prometheus.exporters.junos-czerwonk.user | User name under which the junos-czerwonk exporter shall be run.
|
| services.chatgpt-retrieval-plugin.qdrantCollection | name of the qdrant collection used to store documents.
|
| services.stash.settings.security_tripwire_accessed_from_public_internet | Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/
|
| services.sourcehut.builds.postgresql.database | PostgreSQL database name for the builds.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.prometheus.exporters.postfix.systemd.unit | Name of the postfix systemd unit.
|
| services.glance.environmentFile | Path to an environment file as defined in systemd.exec(5)
|
| services.foundationdb.tls.allowedPeers | "Peer verification string"
|
| hardware.block.defaultSchedulerExclude | Device name pattern to exclude from default scheduler assignment
through config.hardware.block.defaultScheduler and
config.hardware.block.defaultSchedulerRotational
|
| services.datadog-agent.extraIntegrations | Extra integrations from the Datadog core-integrations
repository that should be built and included
|
| hardware.printers.ensurePrinters | Will regularly ensure that the given CUPS printers are configured as declared here
|
| services.tarsnap.keyfile | The keyfile which associates this machine with your tarsnap
account
|
| services.nullmailer.config.adminaddr | If set, all recipients to users at either "localhost" (the literal string)
or the canonical host name (from the me control attribute) are remapped to this address
|
| services.mosquitto.listeners.*.authPlugins.*.denySpecialChars | Automatically disallow all clients using #
or + in their name/id.
|
| services.bluesky-pds.environmentFiles | File to load environment variables from
|
| virtualisation.lxd.recommendedSysctlSettings | Enables various settings to avoid common pitfalls when
running containers requiring many file operations
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.username | Credentials are used to authenticate the requests to Uyuni API.
|
| services.taskserver.organisations | An attribute set where the keys name the organisation and the values
are a set of lists of users and
groups.
|
| services.mqtt2influxdb.influxdb.database | Name of the InfluxDB database.
|
| services.crowdsec-firewall-bouncer.secrets.apiKeyPath | Path to the API key to authenticate with a local CrowdSec API
|
| services.journaldriver.googleCloudProject | Configures the name of the Google Cloud project to which to
forward journald logs
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.dependency-track.database.databaseName | Database name to use when connecting to an external or
manually provisioned database; has no effect when a local
database is automatically provisioned
|
| services.prometheus.exporters.buildkite-agent.user | User name under which the buildkite-agent exporter shall be run.
|
| services.prometheus.exporters.scaphandre.user | User name under which the scaphandre exporter shall be run.
|
| services.prometheus.exporters.storagebox.user | User name under which the storagebox exporter shall be run.
|
| services.prometheus.exporters.postfix.systemd.slice | Name of the postfix systemd slice
|
| services.limesurvey.nginx.virtualHost.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.pufferpanel.enable | Whether to enable PufferPanel game management server
|
| services.misskey.reverseProxy.webserver.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| qt.platformTheme | Selects the platform theme to use for Qt applications
|
| services.rutorrent.nginx.exposeInsecureRPC2mount | If you do not enable one of the rpc or httprpc plugins you need to expose an RPC mount through scgi using this option
|
| services.tabby.model | Specify the model that tabby will use to generate completions
|
| services.desktopManager.gnome.flashback.customSessions.*.wmLabel | The name of the window manager to show in the session chooser.
|
| services.prometheus.exporters.exportarr-lidarr.user | User name under which the exportarr-lidarr exporter shall be run.
|
| services.prometheus.exporters.exportarr-sonarr.user | User name under which the exportarr-sonarr exporter shall be run.
|
| services.prometheus.exporters.exportarr-radarr.user | User name under which the exportarr-radarr exporter shall be run.
|
| services.prometheus.exporters.exportarr-bazarr.user | User name under which the exportarr-bazarr exporter shall be run.
|
| services.limesurvey.nginx.virtualHost.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.changedetection-io.environmentFile | Securely pass environment variables to changedetection-io
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.username | Consul username
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.crowdsec-firewall-bouncer.registerBouncer.bouncerName | Name to register the bouncer as to the CrowdSec API
|
| services.outline.oidcAuthentication.displayName | Display name for OIDC authentication.
|
| services.prometheus.exporters.exportarr-readarr.user | User name under which the exportarr-readarr exporter shall be run.
|
| services.prometheus.exporters.artifactory.user | User name under which the artifactory exporter shall be run.
|
| services.prometheus.exporters.mqtt.prometheusPrefix | Prefix added to the metric name.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowCN | Allow client if common name appears in the list.
|
| services.strongswan-swanctl.swanctl.connections | Section defining IKE connection configurations, each in its own subsection
with an arbitrary yet unique name
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowOU | Allow client if organizational unit name appears in the list.
|
| services.strongswan-swanctl.swanctl.authorities | Section defining complementary attributes of certification authorities, each
in its own subsection with an arbitrary yet unique name
|
| services.mqtt2influxdb.points.*.measurement | Name of the measurement
|
| services.multipath.devices.*.user_friendly_names | If set to "yes", using the bindings file /etc/multipath/bindings
to assign a persistent and unique alias to the multipath, in the
form of mpath
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config | Configures the scrape request's TLS settings.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowDNS | Allow client if DNS subject alternative name appears in the list.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowURI | Allow client if URI subject alternative name appears in the list.
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.basic_auth.username | HTTP username
|
| virtualisation.rosetta.mountTag | The VirtioFS mount tag for the Rosetta runtime, exposed by the host's virtualisation software
|
| services.misskey.reverseProxy.webserver.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.prometheus.exporters.exportarr-prowlarr.user | User name under which the exportarr-prowlarr exporter shall be run.
|
| services.misskey.reverseProxy.webserver.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| virtualisation.libvirtd.nss.enableGuest | This option enables the newer libvirt_guest NSS module
|
| services.prometheus.exporters.modemmanager.user | User name under which the modemmanager exporter shall be run.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchType | NetworkManager connection type
The NetworkManager configuration settings reference roughly corresponds to connection types
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.basic_auth.username | HTTP username
|
| services.bitwarden-directory-connector-cli.sync.groupNameAttribute | Attribute for a name of group.
|
| services.xserver.desktopManager.gnome.flashback.customSessions.*.wmLabel | The name of the window manager to show in the session chooser.
|
| services.postgresql.ensureUsers.*.ensureClauses.inherit | Grants the user created inherit permissions
|
| services.influxdb2.provision.initialSetup.organization | Primary organization name
|
| services.mautrix-telegram.environmentFile | File containing environment variables to be passed to the mautrix-telegram service,
in which secret tokens can be specified securely by defining values for e.g.
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN,
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN,
MAUTRIX_TELEGRAM_TELEGRAM_API_ID,
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH and optionally
MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.exporters.unpoller.controllers.*.user | Unifi service user name.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config | Configures the Consul request's TLS settings.
|
| virtualisation.sharedDirectories | An attributes set of directories that will be shared with the
virtual machine using VirtFS (9P filesystem over VirtIO)
|
| services.postgresql.ensureUsers.*.ensureClauses.createdb | Grants the user, created by the ensureUser attr, createdb permissions
|
| system.replaceDependencies.replacements | List of packages to override without doing a full rebuild
|
| boot.loader.systemd-boot.sortKey | The sort key used for the NixOS bootloader entries
|
| services.prometheus.exporters.restic.rcloneConfig | Configuration for the rclone remote being used for backup
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.exporters.mqtt.zigbee2MqttAvailability | Whether to enable Normalize sensor name for device availability metric added by Zigbee2MQTT..
|
| services.prometheus.exporters.wireguard.wireguardConfig | Path to the Wireguard Config to
add the peer's name to the stats of a peer
|
| security.apparmor.killUnconfinedConfinables | Whether to enable killing of processes which have an AppArmor profile enabled
(in security.apparmor.policies)
but are not confined (because AppArmor can only confine new processes)
|
| networking.networkmanager.unmanaged | List of interfaces that will not be managed by NetworkManager
|
| services.postgresql.ensureUsers.*.ensureClauses.bypassrls | Grants the user, created by the ensureUser attr, replication permissions
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.username | username is required if using Identity V2 API
|
| services.postgresql.ensureUsers.*.ensureClauses.superuser | Grants the user, created by the ensureUser attr, superuser permissions
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.domain_name | At most one of domain_id and domain_name must be provided if using username
with Identity V3
|
| services.prometheus.exporters.pgbouncer.connectionEnvFile | File that must contain the environment variable
PGBOUNCER_EXPORTER_CONNECTION_STRING which is set to the connection
string used by pgbouncer
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.namespaces | Optional namespace discovery
|
| networking.networkmanager.appendNameservers | A list of name servers that should be appended
to the ones configured in NetworkManager or received by DHCP.
|
| networking.networkmanager.insertNameservers | A list of name servers that should be inserted before
the ones configured in NetworkManager or received by DHCP.
|
| services.postgresql.ensureUsers.*.ensureClauses.replication | Grants the user, created by the ensureUser attr, replication permissions
|
| services.prometheus.exporters.pgbouncer.connectionString | Connection string for accessing pgBouncer
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.project_name | The project_id and project_name fields are optional for the Identity V2 API
|
| services.postgresql.ensureUsers.*.ensureClauses.createrole | Grants the user, created by the ensureUser attr, createrole permissions
|
| hardware.block.scheduler | Assign block I/O scheduler by device name pattern
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.basic_auth.username | HTTP username
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchIface | interface name of the NetworkManager connection
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.basic_auth.username | HTTP username
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchSetting | name of the setting section for which secrets are requested
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchId | connection id used by NetworkManager
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.application_credential_name | The application_credential_id or application_credential_name fields are
required if using an application credential to authenticate
|