| services.ente.api.settings.db.name | The database name
|
| services.legit.settings.server.name | Server name.
|
| services.postfix.settings.master.<name>.name | The name of the service to run
|
| services.sabnzbd.settings.servers.<name>.name | The name of the server
|
| services.rauc.slots.<name>.*.settings | Settings for this slot.
|
| services.cgit.<name>.settings | cgit configuration, see cgitrc(5)
|
| services.uhub.<name>.settings | Configuration of uhub
|
| services.rsync.jobs.<name>.settings | Settings that should be passed to rsync via long options
|
| services.syncthing.settings.devices.<name>.name | The name of the device.
|
| services.pretix.settings.database.name | Database name.
|
| services.uhub.<name>.plugins.*.settings | Settings specific to this plugin.
|
| services.pretalx.settings.database.name | Database name.
|
| services.grafana.settings.database.name | The name of the Grafana database.
|
| services.mpd.settings | Configuration for MPD
|
| services.metricbeat.settings.name | Name of the beat
|
| services.kimai.sites.<name>.settings | Structural Kimai's local.yaml configuration
|
| services.h2o.hosts.<name>.settings | Attrset to be transformed into YAML for host config
|
| services.phpfpm.pools.<name>.settings | PHP-FPM pool directives
|
| services.logrotate.settings.<name>.global | Whether this setting is a global option or not: set to have these
settings apply to all files settings with a higher priority.
|
| services.homebridge.settings.bridge.name | Name of the homebridge
|
| services.sourcehut.settings."sr.ht".site-name | The name of your network of sr.ht-based sites.
|
| services.etebase-server.settings.database.name | The database name.
|
| services.sourcehut.settings."sr.ht".owner-name | Owner's name.
|
| services.inadyn.settings.custom.<name>.ddns-server | DDNS server name.
|
| services.szurubooru.server.settings.name | Name shown in the website title and on the front page.
|
| services.inadyn.settings.custom.<name>.ssl | Whether to use HTTPS for this DDNS provider.
|
| services.postfix.settings.master.<name>.command | A program name specifying a Postfix service/daemon process
|
| services.bitmagnet.settings.postgres.name | Database name to connect to
|
| services.matrix-synapse.settings.database.name | The database engine name
|
| services.redis.servers.<name>.settings | Redis configuration
|
| services.inadyn.settings.custom.<name>.include | File to include additional settings for this provider from.
|
| services.easytier.instances.<name>.settings | Settings to generate easytier-‹name›.toml
|
| services.tor.relay.onionServices.<name>.settings | Settings of the onion service
|
| services.lemmy.settings.hostname | The domain name of your instance (eg 'lemmy.ml').
|
| services.inadyn.settings.custom.<name>.hostname | Hostname alias(es).
|
| services.inadyn.settings.custom.<name>.username | Username for this DDNS provider.
|
| services.sympa.settingsFile.<name>.text | Text of the file.
|
| services.stash.settings.stash_boxes.*.name | The name of the Stash Box
|
| services.sympa.domains.<name>.settings | The robot.conf configuration file as key value set
|
| services.tinc.networks.<name>.settings | Configuration of the Tinc daemon for this network
|
| services.postfix.settings.master.<name>.type | The type of the service
|
| services.tinc.networks.<name>.hostSettings.<name>.settings | Configuration for this host
|
| services.acme-dns.settings.general.nsname | Zone name server.
|
| services.dokuwiki.sites.<name>.settings | Structural DokuWiki configuration
|
| services.gancio.settings.hostname | The domain name under which the server is reachable.
|
| services.mosquitto.bridges.<name>.settings | Additional settings for this bridge.
|
| services.nipap.settings.nipapd.db_name | Name of database to use on PostgreSQL server.
|
| services.wiki-js.settings.db.db | Name of the database to use.
|
| services.zeronsd.servedNetworks.<name>.settings | Settings for zeronsd
|
| services.sabnzbd.settings.servers.<name>.ssl | Whether the server supports TLS
|
| services.pid-fan-controller.settings.heatSources.*.name | Name of the heat source.
|
| services.sabnzbd.settings.servers.<name>.host | Hostname of the server
|
| services.sabnzbd.settings.servers.<name>.port | Port of the server
|
| services.inadyn.settings.custom.<name>.ddns-path | DDNS server path
|
| services.inadyn.settings.provider.<name>.include | File to include additional settings for this provider from.
|
| services.nebula.networks.<name>.settings | Nebula configuration
|
| services.inadyn.settings.provider.<name>.ssl | Whether to use HTTPS for this DDNS provider.
|
| services.opensearch.settings."cluster.name" | The name of the cluster.
|
| services.anubis.instances.<name>.policy.settings | Additional policy settings merged into the policy file
|
| services.frp.instances.<name>.settings | Frp configuration, for configuration options
see the example of client
or server on github.
|
| services.postfix.settings.master.<name>.args | Arguments to pass to the command
|
| services.inadyn.settings.provider.<name>.hostname | Hostname alias(es).
|
| services.inadyn.settings.provider.<name>.username | Username for this DDNS provider.
|
| services.sympa.settingsFile.<name>.source | Path of the source file.
|
| services.homebridge.settings.platforms.*.name | Name of the platform
|
| services.logrotate.settings | logrotate freeform settings: each attribute here will define its own section,
ordered by services.logrotate.settings.<name>.priority,
which can either define files to rotate with their settings
or settings common to all further files settings
|
| services.biboumi.settings.db_name | The name of the database to use
|
| services.btrbk.instances.<name>.settings | configuration options for btrbk
|
| services.tor.settings.Nickname | See torrc manual.
|
| services.wordpress.sites.<name>.settings | Structural Wordpress configuration
|
| services.suricata.settings.outputs.*.<name>.enabled | Whether to enable .
|
| services.sourcehut.settings."builds.sr.ht::worker".name | Listening address and listening port
of the build runner (with HTTP port if not 80).
|
| services.xonotic.settings.hostname | The name that will appear in the server list. $g_xonoticversion
gets replaced with the current version.
|
| services.anubis.instances.<name>.settings.BIND | The address that Anubis listens to
|
| services.public-inbox.settings.coderepo.<name>.dir | Path to a git repository
|
| services.openbao.settings.listener.<name>.type | The listener type to enable.
|
| services.headscale.settings.database.postgres.name | Database name.
|
| services.sympa.settingsFile.<name>.enable | Whether this file should be generated
|
| services.logrotate.settings.<name>.enable | Whether to enable setting individual kill switch.
|
| services.sabnzbd.settings.servers.<name>.enable | Enable this server by default
|
| services.postfix.settings.master.<name>.wakeup | Automatically wake up the service after the specified number of
seconds
|
| services.vault-agent.instances.<name>.settings | Free-form settings written directly to the config.json file
|
| services.postfix.settings.master.<name>.chroot | Whether the service is chrooted to have only access to the
services.postfix.queueDir and the closure of
store paths specified by the program option.
|
| services.hostapd.radios.<name>.networks.<name>.settings | Extra configuration options to put at the end of this BSS's defintion in the
hostapd.conf for the associated interface
|
| services.public-inbox.settings.coderepo.<name>.cgitUrl | URL of a cgit instance
|
| services.vmalert.instances.<name>.settings.rule | Path to the files with alerting and/or recording rules.
|
| security.auditd.plugins.<name>.settings | Plugin-specific config file to link to /etc/audit/.conf
|
| services.syncthing.settings.folders.<name>.id | The ID of the folder
|
| services.syncthing.settings.devices.<name>.id | The device ID
|
| services.cgit.<name>.repos | cgit repository settings, see cgitrc(5)
|
| services.wstunnel.clients.<name>.settings | Command line arguments to pass to wstunnel
|
| services.wstunnel.servers.<name>.settings | Command line arguments to pass to wstunnel
|
| services.logrotate.settings.<name>.files | Single or list of files for which rules are defined
|
| services.anubis.instances.<name>.settings | Freeform configuration via environment variables for Anubis
|
| services.traefik.dynamic.files.<name>.settings | Dynamic configuration for Traefik, written in Nix.
This will be serialized to JSON (which is considered valid YAML) at build, and passed as part of the static file.
|
| services.actual.settings.hostname | The address to listen on
|
| services.misskey.settings.db.db | The database name.
|
| services.anubis.instances.<name>.settings.POLICY_FNAME | The policy file to use
|
| services.printing.cups-pdf.instances.<name>.settings.Out | output directory;
${HOME} will be expanded to the user's home directory,
${USER} will be expanded to the user name.
|
| services.grafana.settings.smtp.from_name | Name to be used as client identity for EHLO in SMTP dialog.
|
| services.sabnzbd.settings.servers.<name>.timeout | Time, in seconds, to wait for a response before
attempting error recovery.
|
| services.postfix.settings.master.<name>.maxproc | The maximum number of processes to spawn for this service
|
| services.keyd.keyboards.<name>.settings | Configuration, except ids section, that is written to /etc/keyd/.conf
|
| services.syncthing.settings.folders.<name>.type | Controls how the folder is handled by Syncthing
|
| services.syncthing.settings.folders.<name>.label | The label of the folder.
|
| services.hostapd.radios.<name>.settings | Extra configuration options to put at the end of global initialization, before defining BSSs
|
| services.homebridge.settings.accessories.*.name | Name of the accessory
|
| services.evremap.settings.phys | The physical device name to listen on
|
| services.postfix.settings.master.<name>.private | Whether the service's sockets and storage directory is restricted to
be only available via the mail system
|
| services.vmalert.instances.<name>.settings | vmalert configuration, passed via command line flags
|
| services.anubis.instances.<name>.settings.SERVE_ROBOTS_TXT | Whether to serve a default robots.txt that denies access to common AI bots by name and all other
bots by wildcard.
|
| services.radicle.ci.broker.settings.adapters.<name>.env | Environment variables to add when running the adapter.
|
| services.mobilizon.settings.":mobilizon".":instance".name | The fallback instance name if not configured into the admin UI
|
| services.grafana.provision.alerting.rules.settings.groups.*.name | Name of the rule group
|
| services.inadyn.settings.custom.<name>.password | Password for this DDNS provider
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs | List of inputs for this camera.
|
| services.easytier.instances.<name>.settings.hostname | Hostname shown in peer list and web console.
|
| services.prometheus.exporters.fritz.settings.devices.*.name | Name to use for the device.
|
| services.tlsrpt.reportd.settings.dbname | Path to the sqlite database.
|
| services.openbao.settings.listener.<name>.address | The TCP address or UNIX socket path to listen on.
|
| services.angrr.settings.profile-policies.<name>.enable | Whether to enable this angrr policy.
|
| services.tor.relay.onionServices.<name>.settings.RendPostPeriod | See torrc manual.
|
| services.authelia.instances.<name>.settings.theme | The theme to display.
|
| services.angrr.settings.profile-policies.<name>.keep-since | Retention period for the GC roots in this profile.
|
| services.wordpress.sites.<name>.extraConfig | Any additional text to be appended to the wp-config.php
configuration file
|
| services.logrotate.settings.<name>.priority | Order of this logrotate block in relation to the others
|
| services.sabnzbd.settings.servers.<name>.displayname | Human-friendly description of the server
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs.*.path | Stream URL
|
| services.prometheus.exporters.script.settings.scripts.*.name | Name of the script.
|
| services.syncthing.settings.folders.<name>.path | The path to the folder which should be shared
|
| services.zeronsd.servedNetworks.<name>.settings.token | Path to a file containing the API Token for ZeroTier Central.
|
| services.sabnzbd.settings.servers.<name>.priority | Priority of this servers
|
| services.sabnzbd.settings.servers.<name>.required | In case of connection failures, wait for the
server to come back online instead of skipping
it.
|
| services.authelia.instances.<name>.settings.log.level | Level of verbosity for logs.
|
| services.easytier.instances.<name>.settings.dhcp | Automatically determine the IPv4 address of this peer based on
existing peers on network.
|
| services.wstunnel.clients.<name>.settings.http-headers | Custom headers to send in the upgrade request
|
| services.maubot.settings.homeservers.<name>.url | Client-server API URL
|
| services.anubis.instances.<name>.settings.TARGET | The reverse proxy target that Anubis is protecting
|
| services.sabnzbd.settings.servers.<name>.optional | In case of connection failures, temporarily
disable this server. (See sabnzbd's documentation
for usage guides).
|
| services.printing.cups-pdf.instances.<name>.settings | Settings for a cups-pdf instance, see the descriptions in the template config file in the cups-pdf package
|
| services.lasuite-meet.settings.DB_NAME | Name of the database
|
| services.lasuite-docs.settings.DB_NAME | Name of the database
|
| services.consul-template.instances.<name>.settings | Free-form settings written directly to the config.json file
|
| services.zeronsd.servedNetworks.<name>.settings.domain | Domain under which ZeroTier records will be available.
|
| services.openssh.settings.UseDns | Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for
the remote IP address maps back to the very same IP address
|
| services.postfix.settings.master.<name>.privileged | |
| services.easytier.instances.<name>.settings.peers | Peers to connect initially
|
| services.frigate.settings.cameras.<name>.ffmpeg.inputs.*.roles | List of roles for this stream
|
| services.authelia.instances.<name>.settings | Your Authelia config.yml as a Nix attribute set
|
| services.mautrix-meta.instances.<name>.settings | config.yaml configuration as a Nix attribute set
|
| services.printing.cups-pdf.instances.<name>.settings.Spool | spool directory
|
| services.maubot.settings.server.hostname | The IP to listen on
|
| services.angrr.settings.profile-policies.<name>.keep-latest-n | Keep the latest N GC roots in this profile.
|
| services.authelia.instances.<name>.settings.log.format | Format the logs are written as.
|
| services.headscale.settings.dns.extra_records.*.name | DNS record name.
|
| services.easytier.instances.<name>.settings.ipv4 | IPv4 cidr address of this peer in the virtual network
|
| services.biboumi.settings.hostname | The hostname served by the XMPP gateway
|
| services.syncthing.settings.folders.<name>.enable | Whether to share this folder
|
| services.logrotate.settings.<name>.frequency | How often to rotate the logs
|
| services.hatsu.settings.HATSU_DOMAIN | The domain name of your instance (eg 'hatsu.local').
|
| services.inadyn.settings.provider.<name>.password | Password for this DDNS provider
|
| services.sslh.settings.protocols | List of protocols sslh will probe for and redirect
|
| services.grafana.provision.alerting.muteTimings.settings.muteTimes.*.name | Name of the mute time interval, must be unique
|
| services.radicle.ci.broker.settings.adapters.<name>.command | Adapter command to run.
|
| services.wstunnel.servers.<name>.settings.restrict-to.*.port | The port.
|
| services.wstunnel.servers.<name>.settings.restrict-to.*.host | The hostname.
|
| services.bonsaid.settings.*.event_name | Name of the event which should trigger this transition when received by bonsaid
|
| services.vault-agent.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.pds.settings.PDS_HOSTNAME | Instance hostname (base domain name)
|
| services.archisteamfarm.bots.<name>.settings | Additional settings that are documented here.
|
| services.anubis.instances.<name>.settings.METRICS_BIND | The address Anubis' metrics server listens to
|
| services.gitea.settings.server.DOMAIN | Domain name of your server.
|
| services.gitea-actions-runner.instances.<name>.settings | Configuration for act_runner daemon
|
| services.printing.cups-pdf.instances.<name>.settings.AnonDirName | path for anonymously created PDF files
|
| services.invoiceplane.sites.<name>.settings | Structural InvoicePlane configuration
|
| services.easytier.instances.<name>.settings.network_name | EasyTier network name.
|
| services.botamusique.settings.bot.username | Name the bot should appear with.
|
| services.vault-agent.instances.<name>.settings.template | Template section of vault-agent
|
| services.evremap.settings.device_name | The name of the device that should be remapped
|
| services.sabnzbd.secretFiles | Path to a list of ini file containing confidential settings such as credentials
|
| services.anubis.instances.<name>.settings.BIND_NETWORK | The network family that Anubis should bind to
|
| services.warpgate.settings.sso_providers.*.name | Internal identifier of SSO provider.
|
| services.pgbackrest.stanzas.<name>.settings | An attribute set of options as described in:
https://pgbackrest.org/configuration.html
All options can be used
|
| services.wstunnel.servers.<name>.settings.restrict-to | Restrictions on the connections that the server will accept
|
| services.grafana.provision.dashboards.settings.providers.*.name | A unique provider name.
|
| services.grafana.provision.alerting.muteTimings.settings.deleteMuteTimes.*.name | Name of the mute time interval, must be unique
|
| services.zeronsd.servedNetworks.<name>.settings.wildcard | Whether to serve a wildcard record for ZeroTier Nodes.
|
| services.keycloak.settings.hostname | The hostname part of the public URL used as base for
all frontend requests
|
| services.authelia.instances.<name>.settingsFiles | Here you can provide authelia with configuration files or directories
|
| services.syncthing.settings.folders.<name>.devices | The devices this folder should be shared with
|
| services.hickory-dns.settings.zones.*.zone | Zone name, like "example.com", "localhost", or "0.0.127.in-addr.arpa".
|
| services.angrr.settings.temporary-root-policies.<name>.enable | Whether to enable this angrr policy.
|
| services.acme-dns.settings.general.domain | Domain name to serve the requests off of.
|
| services.gancio.settings.db.database | Name of the PostgreSQL database
|
| services.printing.cups-pdf.instances.<name>.settings.GhostScript | location of GhostScript binary
|
| services.simplesamlphp.<name>.settings | Configuration options used by SimpleSAMLphp
|
| services.hockeypuck.settings | Configuration file for hockeypuck, here you can override
certain settings (loglevel and
openpgp.db.dsn) by just setting those values
|
| services.angrr.settings.temporary-root-policies.<name>.period | Retention period for the GC roots matched by this policy.
|
| services.angrr.settings.temporary-root-policies.<name>.path-regex | Regex pattern to match the GC root path.
|
| services.angrr.settings.profile-policies.<name>.keep-booted-system | Whether to keep the last booted system generation
|
| services.dependency-track.settings."alpine.oidc.username.claim" | Defines the name of the claim that contains the username in the provider's userinfo endpoint
|
| services.vmalert.instances.<name>.settings."notifier.url" | Prometheus Alertmanager URL
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| services.authelia.instances.<name>.settings.server.address | The address to listen on.
|
| services.angrr.settings.temporary-root-policies.<name>.filter | External filter program to further filter GC roots matched by this policy.
|
| services.zeronsd.servedNetworks.<name>.settings.log_level | Log Level.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| services.sabnzbd.settings.servers.<name>.connections | Number of parallel connections permitted by
the server.
|
| services.angrr.settings.profile-policies.<name>.keep-current-system | Whether to keep the current system generation
|
| services.forgejo.settings.server.DOMAIN | Domain name of your server.
|
| services.angrr.settings.temporary-root-policies.<name>.ignore-prefixes | List of path prefixes to ignore
|
| services.radicle.ci.adapters.native.instances.<name>.settings | Configuration of radicle-native-ci
|
| services.grafana.provision.alerting.contactPoints.settings.contactPoints.*.name | Name of the contact point
|
| services.syncthing.settings.devices.<name>.autoAcceptFolders | Automatically create or share folders that this device advertises at the default path
|
| services.tor.settings.ServerDNSAllowNonRFC953Hostnames | See torrc manual.
|
| services.sabnzbd.settings.servers.<name>.ssl_verify | Level of TLS verification
|
| services.printing.cups-pdf.instances.<name>.settings.Anonuser | User for anonymous PDF creation
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceSingleHopMode | See torrc manual.
|
| services.radicle.ci.adapters.native.instances.<name>.settings.log | File where radicle-native-ci should write the run log.
|
| services.canaille.settings.SERVER_NAME | The domain name on which canaille will be served.
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceMaxStreams | See torrc manual.
|
| services.anubis.instances.<name>.settings.DIFFICULTY | The difficulty required for clients to solve the challenge
|
| services.armagetronad.servers.<name>.settings | Armagetron Advanced server rules configuration
|
| services.grafana.provision.alerting.templates.settings.templates.*.name | Name of the template, must be unique
|
| services.consul-template.instances.<name>.settings.pid_file | Path to use for the pid file.
|
| services.radicle.ci.adapters.native.instances.<name>.settings.state | Directory where per-run directories are stored.
|
| services.angrr.settings.temporary-root-policies.<name>.ignore-prefixes-in-home | Path prefixes to ignore under home directory
|
| services.authelia.instances.<name>.settings.log.file_path | File path where the logs will be written
|
| services.vmalert.instances.<name>.settings."datasource.url" | Datasource compatible with Prometheus HTTP API.
|
| services.angrr.settings.profile-policies.<name>.profile-paths | Paths to the Nix profile
|
| services.syncthing.settings.folders.<name>.versioning.type | The type of versioning
|
| services.suricata.settings.app-layer.protocols.<name>.enabled | The option "enabled" takes 3 values - "yes", "no", "detection-only".
"yes" enables both detection and the parser, "no" disables both, and
"detection-only" enables protocol detection only (parser disabled).
|
| services.matrix-tuwunel.settings.global.server_name | The server_name is the name of this server
|
| services.matrix-conduit.settings.global.server_name | The server_name is the name of this server
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| services.anubis.instances.<name>.settings.WEBMASTER_EMAIL | If set, shows a contact email address when rendering error pages
|
| services.dendrite.settings.global.server_name | The domain name of the server, with optional explicit port
|
| services.anubis.instances.<name>.settings.METRICS_BIND_NETWORK | The network family that the metrics server should bind to
|
| services.pretix.settings.pretix.instance_name | The name of this installation.
|
| services.consul-template.instances.<name>.settings.template | Template section of consul-template
|
| services.postfix.settings.master.<name>.wakeupUnusedComponent | If set to false the component will only be woken
up if it is used
|
| services.postfix.settings.main.myhostname | The internet hostname of this mail system
|
| services.angrr.settings.temporary-root-policies.<name>.filter.program | Path to the external filter program.
|
| services.matrix-synapse.settings.server_name | The domain name of the server, with optional explicit port
|
| services.sabnzbd.settings.servers.<name>.expire_date | If Notifications are enabled and an expiry date is
set, warn 5 days before expiry
|
| services.suricata.settings.unix-command.filename | Filename for unix-command socket.
|
| services.dsnet.settings.ExternalHostname | The hostname that clients should use to connect to this server
|
| services.hddfancontrol.settings.<drive-bay-name>.extraArgs | Extra commandline arguments for hddfancontrol
|
| services.reposilite.settings.hostname | The hostname to bind to
|
| services.syncthing.settings.folders.<name>.versioning | How to keep changed/deleted files with Syncthing
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user | The user of the file
|
| services.minidlna.settings.friendly_name | Name that the server presents to clients.
|
| services.bluesky-pds.settings.PDS_HOSTNAME | Instance hostname (base domain name)
|
| services.umami.settings.TRACKER_SCRIPT_NAME | Allows you to assign a custom name to the tracker script different from the default script.js.
|
| services.easytier.instances.<name>.settings.listeners | Listener addresses to accept connections from other peers
|
| services.easytier.instances.<name>.settings.instance_name | Identify different instances on same host
|
| services.grafana.provision.alerting.templates.settings.deleteTemplates.*.name | Name of the template, must be unique
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group | The group of the file
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceExportCircuitID | See torrc manual.
|
| services.grafana.provision.datasources.settings.datasources.*.name | Name of the datasource
|
| services.angrr.settings.temporary-root-policies.<name>.priority | Priority of this policy
|
| services.hddfancontrol.settings.<drive-bay-name>.disks | Drive(s) to get temperature from
Can also use command substitution to automatically grab all matching drives; such as all scsi (sas) drives
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceAllowUnknownPorts | See torrc manual.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| services.oncall.settings.db.conn.kwargs.database | Database name.
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceDirGroupReadable | See torrc manual.
|
| services.libeufin.nexus.settings.nexus-ebics.HOST_ID | Name of the EBICS host.
|
| services.tlsrpt.collectd.settings.socketname | Path at which the UNIX socket will be created.
|
| services.anubis.instances.<name>.settings.OG_PASSTHROUGH | Whether to enable Open Graph tag passthrough
|
| services.tinc.networks.<name>.extraConfig | Extra lines to add to the tinc service configuration file
|
| services.grafana.settings.server.domain | The public facing domain name used to access grafana from a browser
|
| services.rosenpass.settings.peers.*.device | Name of the local WireGuard interface to use for this peer.
|
| services.authelia.instances.<name>.settings.log.keep_stdout | Whether to also log to stdout when a file_path is defined.
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| services.grafana.provision.datasources.settings.deleteDatasources.*.name | Name of the datasource to delete.
|
| services.cgit.<name>.gitHttpBackend.enable | Whether to bypass cgit and use git-http-backend for HTTP clones
|
| services.bookstack.settings | Options for Bookstack configuration
|
| services.radicle.ci.adapters.native.instances.<name>.settings.base_url | Base URL for build logs (mandatory for access from CI broker page).
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.mode | The file access mode to use when creating this file or directory.
|
| services.hddfancontrol.settings.<drive-bay-name>.pwmPaths | PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
Can also use command substitution to ensure the correct hwmonX is selected on every boot
|
| services.spacecookie.settings.hostname | The hostname the service is reachable via
|
| services.sourcehut.settings."sr.ht".global-domain | Global domain name.
|
| services.suricata.settings.default-log-dir | The default logging directory
|
| services.angrr.settings.temporary-root-policies.<name>.filter.arguments | Extra command-line arguments pass to the external filter program.
|
| services.kerberos_server.settings.realms.<name>.acl | The privileges granted to a user.
|
| services.suwayomi-server.settings.server.basicAuthUsername | The username value that you have to provide when authenticating.
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceMaxStreamsCloseCircuit | See torrc manual.
|
| services.suricata.settings.logging.outputs.file.filename | Filename of the logfile.
|
| services.nvme-rs.settings.email.smtp_username | SMTP username
|
| services.syncthing.settings.folders.<name>.copyOwnershipFromParent | On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in)
|
| services.authelia.instances.<name>.settings.telemetry.metrics.enabled | Enable Metrics.
|
| services.hddfancontrol.settings.<drive-bay-name>.logVerbosity | Verbosity of the log level
|
| services.resolved.settings.Resolve.Domains | List of search domains used to complete unqualified name lookups.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.age | Delete a file when it reaches a certain age
|
| services.authelia.instances.<name>.settings.telemetry.metrics.address | The address to listen on for metrics
|
| services.healthchecks.settings.DB_NAME | Database name.
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.type | The type of operation to perform on the file
|
| services.simplesamlphp.<name>.settings.baseurlpath | URL where SimpleSAMLphp can be reached.
|
| services.github-runners.<name>.user | User under which to run the service
|
| systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| services.kerberos_server.settings.realms.<name>.acl.*.target | The principals that 'access' applies to.
|
| services.syncthing.settings.folders.<name>.ignorePatterns | Syncthing can be configured to ignore certain files in a folder using ignore patterns
|
| services.headscale.settings.dns.nameservers.global | List of nameservers to pass to Tailscale clients.
|
| services.libeufin.nexus.settings.nexus-ebics.CURRENCY | Name of the fiat currency.
|
| services.radicle.ci.broker.settings.triggers.*.adapter | Adapter name.
|
| services.cgit.<name>.gitHttpBackend.checkExportOkFiles | Whether git-http-backend should only export repositories that contain a git-daemon-export-ok file
|
| services.dependency-track.settings."alpine.oidc.teams.claim" | Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
|
| services.anubis.defaultOptions.settings.POLICY_FNAME | The policy file to use
|
| services.public-inbox.settings.publicinbox.css | The local path name of a CSS file for the PSGI web interface.
|
| services.matrix-continuwuity.settings.global.server_name | The server_name is the name of this server
|
| services.suricata.settings.unix-command | Unix command socket that can be used to pass commands to Suricata
|
| services.matrix-synapse.settings.listeners.*.resources.*.names | List of resources to host on this listener.
|
| services.anubis.defaultOptions.settings.SERVE_ROBOTS_TXT | Whether to serve a default robots.txt that denies access to common AI bots by name and all other
bots by wildcard.
|
| services.dovecot2.imapsieve.mailbox.*.name | This setting configures the name of a mailbox for which administrator scripts are configured
|
| boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.argument | An argument whose meaning depends on the type of operation
|
| services.dependency-track.settings."alpine.database.username" | Specifies the username to use when authenticating to the database.
|
| services.tor.relay.onionServices.<name>.settings.HiddenServiceNumIntroductionPoints | See torrc manual.
|
| services.libeufin.nexus.settings.nexus-ebics.BANK_DIALECT | Name of the following combination: EBICS version and ISO20022
recommendations that Nexus would honor in the communication with the
bank
|
| services.btrbk.instances.<name>.settings.stream_compress | Compress the btrfs send stream before transferring it from/to remote locations using a
compression command.
|
| services.nextcloud.settings.mail_smtpname | This depends on mail_smtpauth
|
| services.h2o.hosts.<name>.tls.recommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| services.easytier.instances.<name>.settings.network_secret | EasyTier network credential used for verification and
encryption
|
| services.kerberos_server.settings.realms.<name>.acl.*.principal | Which principal the rule applies to
|
| services.prometheus.exporters.process.settings.process_names | All settings expressed as an Nix attrset
|
| services.kerberos_server.settings.realms.<name>.acl.*.access | The changes the principal is allowed to make.
The "all" permission does not imply the "get-keys" permission
|
| services.journald.upload.settings.Upload.ServerKeyFile | SSL key in PEM format
|
| users.users.<name>.linger | Whether to enable or disable lingering for this user
|
| services.mobilizon.settings.":mobilizon".":instance".hostname | Your instance's hostname
|
| services.matrix-synapse.settings.database.args.database | Name of the database when using the psycopg2 backend,
path to the database location when using sqlite3.
|
| services.suricata.settings.outputs | Configure the type of alert (and other) logging you would like
|
| services.transmission.settings.script-torrent-done-filename | Executable to be run at torrent completion.
|
| services.prometheus.exporters.fritz.settings.devices.*.username | Username to authenticate with the target device.
|
| services.prometheus.exporters.fritz.settings.devices.*.hostname | Hostname under which the target device is reachable.
|
| services.easytier.instances.<name>.extraSettings | Extra settings to add to easytier-‹name›.toml.
|
| services.tlsrpt.reportd.settings.organization_name | Name of the organization sending out the reports.
|
| services.grafana.settings.database.server_cert_name | The common name field of the certificate used by the mysql or postgres server
|
| services.keycloak.settings.hostname-backchannel-dynamic | Enables dynamic resolving of backchannel URLs,
including hostname, scheme, port and context path
|
| services.grafana.settings.smtp.ehlo_identity | Name to be used as client identity for EHLO in SMTP dialog.
|
| users.extraUsers.<name>.linger | Whether to enable or disable lingering for this user
|
| services.matrix-synapse.settings.log_config | The file that holds the logging configuration.
|
| boot.uki.name | Name of the UKI
|
| services.matrix-appservice-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.nextcloud.settings."profile.enabled" | Makes user-profiles globally available under nextcloud.tld/u/user.name
|
| services.warpgate.settings.external_host | Configure the domain name of this Warpgate instance
|
| services.prometheus.exporters.nginxlog.settings.namespaces | Namespaces to collect the metrics for
|
| services.easytier.instances.<name>.configFile | Path to easytier config file
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".username | User used to connect to the database
|
| services.grafana.provision.alerting.rules.settings.groups.*.folder | Name of the folder the rule group will be stored in
|
| services.discourse.siteSettings | Discourse site settings
|
| services.warpgate.settings.sso_providers.*.label | SSO provider name displayed on login page.
|
| services.jupyter.user | Name of the user used to run the jupyter service
|
| services.sanoid.datasets.<name>.recursive | Whether to recursively snapshot dataset children
|
| services.crowdsec-firewall-bouncer.settings.api_key | API key to authenticate with a local crowdsec API
|
| services.nipap.settings.auth.default_backend | Name of auth backend to use by default.
|
| services.opendkim.keyPath | The path that opendkim should put its generated private keys into
|
| services.printing.cups-pdf.instances.<name>.confFileText | This will contain the contents of cups-pdf.conf for this instance, derived from settings
|
| services.matrix-appservice-irc.settings.homeserver.domain | The 'domain' part for user IDs on this home server
|
| services.nginx.virtualHosts.<name>.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.nginx.virtualHosts.<name>.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.authelia.instances.<name>.settings.default_2fa_method | Default 2FA method for new users and fallback for preferred but disabled methods.
|
| services.journald.upload.settings.Upload.ServerCertificateFile | SSL CA certificate in PEM format
|
| services.biboumi.settings.realname_from_jid | Whether the realname and username of each biboumi
user will be extracted from their JID
|
| services.factorio.saveName | The name of the savegame that will be used by the server
|
| services.pgbouncer.settings.pgbouncer.listen_addr | Specifies a list (comma-separated) of addresses where to listen for TCP connections
|
| users.users.<name>.name | The name of the user account
|
| services.easytier.instances.<name>.configServer | Configure the instance from config server
|
| services.matrix-synapse.log | Default configuration for the loggers used by matrix-synapse and its workers
|
| documentation.man.mandoc.settings.output.man | A template for linked manuals (usually via the Xr macro) in HTML
output
|
| services.fedimintd.<name>.nginx.config.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| security.pam.rssh.settings.auth_key_file | Path to file with trusted public keys in OpenSSH's authorized_keys format
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".database | Name of the database
|
| services.veilid.settings.core.network.routing_table.bootstrap | Host name of existing well-known Veilid bootstrap servers for the network to connect to.
|
| services.frp.instances.<name>.environmentFiles | List of paths files that follows systemd environmentfile structure
|
| services.movim.h2o.tls.recommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| documentation.man.mandoc.settings.output.paper | This option is for generating PostScript and PDF output
|
| users.groups.<name>.name | The name of the group
|
| services.nylon.<name>.name | The name of this nylon instance.
|
| virtualisation.xen.store.settings.perms.enableWatch | Whether to enable the watch permission system
|
| services.h2o.defaultTLSRecommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| services.dolibarr.h2o.tls.recommendations | By default, H2O, without prejudice, will use as many TLS versions &
cipher suites as it & the TLS library (OpenSSL) can support
|
| services.bind.zones.<name>.name | Name of the zone.
|
| services.filesender.settings.log_facilities | Defines where FileSender logging is sent
|
| services.pppd.peers.<name>.name | Name of the PPP peer.
|
| services.pgbouncer.settings.pgbouncer.max_client_conn | Maximum number of client connections allowed
|
| system.name | The name of the system used in the system.build.toplevel derivation
|
| services.btrbk.extraPackages | Extra packages for btrbk, like compression utilities for stream_compress.
Note: This option will get deprecated in future releases
|
| users.extraUsers.<name>.name | The name of the user account
|
| services.davis.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.davis.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.movim.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.slskd.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.slskd.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.movim.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.snipe-it.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.snipe-it.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.lact.settings | Settings for LACT
|
| services.akkoma.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.gancio.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fluidd.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fluidd.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.gancio.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.akkoma.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.matomo.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.matomo.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.monica.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.monica.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.filebeat.inputs | Inputs specify how Filebeat locates and processes input data
|
| services.libvirtd.autoSnapshot.vms | If specified only the list of VMs will be snapshotted else all existing one
|
| boot.uki.settings | The configuration settings for ukify
|
| services.mjolnir.settings | Additional settings (see mjolnir default config for available settings)
|
| users.extraGroups.<name>.name | The name of the group
|
| services.nitter.settings | Add settings here to override NixOS module generated settings
|
| services.radicle.httpd.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.radicle.httpd.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.etcd.name | Etcd unique node name.
|
| services.headscale.settings.tls_letsencrypt_hostname | Domain name to request a TLS certificate for.
|
| services.dolibarr.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.agorakit.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.librenms.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.kanboard.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.fediwall.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.librenms.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.kanboard.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.fediwall.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.agorakit.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.dolibarr.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.mainsail.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.pixelfed.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.pixelfed.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.mainsail.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.matrix-synapse.settings.trusted_key_servers.*.server_name | Hostname of the trusted server.
|
| services.anuko-time-tracker.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.anuko-time-tracker.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.biboumi.settings.realname_customization | Whether the users will be able to use
the ad-hoc commands that lets them configure
their realname and username.
|
| services.bookstack.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.bookstack.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.pufferpanel.environment | Environment variables to set for the service
|
| services.hostapd.radios.<name>.networks.<name>.authentication.mode | Selects the authentication mode for this AP.
- "none": Don't configure any authentication
|
| services.i2pd.inTunnels.<name>.name | The endpoint name.
|
| services.jirafeau.nginxConfig.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.jirafeau.nginxConfig.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.amule.settings | Free form attribute set for aMule settings
|
| services.i2pd.outTunnels.<name>.name | The endpoint name.
|
| services.odoo.settings | Odoo configuration settings
|
| systemd.services.<name>.name | The name of this systemd unit, including its extension
|
| systemd.units.<name>.name | The name of this systemd unit, including its extension
|
| systemd.paths.<name>.name | The name of this systemd unit, including its extension
|
| services.i2pd.upnp.name | Name i2pd appears in UPnP forwardings list.
|
| services.sslh.settings | sslh configuration
|
| services.ncdns.settings | ncdns settings
|
| security.pam.services.<name>.name | Name of the PAM service.
|
| services.newt.settings | Settings for Newt module, see Newt CLI docs for more information.
|
| services.xray.settings | The configuration object
|
| services.bitcoind.<name>.rpc.users.<name>.name | Username for JSON-RPC connections.
|
| services.picom.settings | Picom settings
|
| systemd.user.services.<name>.name | The name of this systemd unit, including its extension
|
| services.ntpd-rs.settings | Settings to write to ntp.toml
See https://docs.ntpd-rs.pendulum-project.org/man/ntp.toml.5
for more information about available options.
|
| services.metricbeat.modules | Metricbeat modules are responsible for reading metrics from the various sources
|
| services.filebeat.modules | Filebeat modules provide a quick way to get started
processing common log formats
|
| services.auto-epp.settings | Settings for the auto-epp application
|
| services.marytts.settings | Settings for MaryTTS
|
| services.davfs2.settings | Extra settings appended to the configuration of davfs2
|
| services.i2pd.proto.bob.name | The endpoint name.
|
| services.i2pd.proto.sam.name | The endpoint name.
|
| services.rspamd.workers.<name>.name | Name of the worker
|
| services.rimgo.settings | Settings for rimgo, see the official documentation for supported options.
|
| services.bcg.name | Name for the device
|
| services.netbird.tunnels.<name>.name | Primary name for use (as a suffix) in:
- systemd service name,
- hardened user name and group,
- systemd
*Directory= names,
- desktop application identification,
|
| services.netbird.clients.<name>.name | Primary name for use (as a suffix) in:
- systemd service name,
- hardened user name and group,
- systemd
*Directory= names,
- desktop application identification,
|
| systemd.user.units.<name>.name | The name of this systemd unit, including its extension
|
| systemd.user.paths.<name>.name | The name of this systemd unit, including its extension
|
| services.searx.settings | Searx settings
|
| services.limesurvey.nginx.virtualHost.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.acme-dns.settings | Free-form settings written directly to the acme-dns.cfg file
|
| systemd.timers.<name>.name | The name of this systemd unit, including its extension
|
| systemd.slices.<name>.name | The name of this systemd unit, including its extension
|
| services.bacula-sd.name | Specifies the Name of the Storage daemon.
|
| services.stubby.settings | Content of the Stubby configuration file
|
| services.redlib.settings | See GitHub for available settings.
|
| services.i2pd.proto.http.name | The endpoint name.
|
| services.i2pd.proto.i2cp.name | The endpoint name.
|
| services.send.redis.name | Name of the redis server
|
| services.movim.settings | .env settings for Movim
|
| services.lldap.settings | Free-form settings written directly to the lldap_config.toml file
|
| services.hylafax.modems.<name>.name | Name of modem device,
will be searched for in /dev.
|
| services.snipe-it.mail.from.name | Mail "from" name.
|
| services.tinc.networks.<name>.name | The name of the node which is used as an identifier when communicating
with the remote nodes in the mesh
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| image.repart.name | Name of the image
|
| services.h2o.settings | Configuration for H2O (see https://h2o.examp1e.net/configure.html)
|
| services.hickory-dns.settings | Settings for hickory-dns
|
| services.wakapi.settings | Settings for Wakapi
|
| services.screego.settings | Screego settings passed as Nix attribute set, they will be merged with
the defaults
|
| services.tor.settings | See torrc manual
for documentation.
|
| services.gokapi.settings | Configuration settings for the generated config json file
|
| services.misskey.settings.db | Database settings.
|
| services.opengfw.settings.io | IO settings.
|
| services.postgresql.systemCallFilter | Configures the syscall filter for postgresql.service
|
| services.g3proxy.settings | Settings of g3proxy.
|
| services.mailman.settings | Settings for mailman.cfg
|
| services.n8n.settings | Configuration for n8n, see https://docs.n8n.io/hosting/environment-variables/configuration-methods/
for supported values.
|
| systemd.user.slices.<name>.name | The name of this systemd unit, including its extension
|
| systemd.user.timers.<name>.name | The name of this systemd unit, including its extension
|
| services.sssd.settings | Contents of sssd.conf.
|
| services.bacula-fd.name | The client name that must be used by the Director when connecting
|
| services.aria2.settings | Generates the aria2.conf file
|
| services.bacula-dir.name | The director name used by the system administrator
|
| services.sanoid.settings | Free-form settings written directly to the config file
|
| virtualisation.oci-containers.containers.<name>.podman | Podman-specific settings in OCI containers
|
| services.privoxy.settings | This option is mapped to the main Privoxy configuration file
|
| services.tlp.settings | Options passed to TLP
|
| services.hercules-ci-agent.settings | These settings are written to the agent.toml file
|
| services.knot.settings | Extra configuration as nix values.
|
| services.qui.settings.port | The port qui listens on.
|
| services.maubot.settings | YAML settings for maubot
|
| services.pgadmin.settings | Settings for pgadmin4.
Documentation
|
| services.kimai.sites.<name>.database.name | Database name.
|
| services.fluent-bit.settings | See configurationFile.
configurationFile takes precedence over settings.
|
| services.yggdrasil.openMulticastPort | Whether to open the UDP port used for multicast peer discovery
|
| services.qui.settings.host | The host address qui listens on.
|
| services.umurmur.settings | Settings of uMurmur
|
| services.draupnir.settings | Free-form settings written to Draupnir's configuration file
|
| services.bee.settings | Ethereum Swarm Bee configuration
|
| services.pretix.settings | pretix configuration as a Nix attribute set
|
| services.openbao.settings | Settings of OpenBao
|
| services.opengfw.settings | Settings passed to OpenGFW. Example config
|
| services.k3s.autoDeployCharts.<name>.name | The name of the Helm chart
|
| services.ifm.settings | Configuration of the IFM service
|
| services.tor.settings.ORPort | See torrc manual.
|
| services.github-runners.<name>.name | Name of the runner to configure
|
| services.netbird.clients.<name>.user.name | A system user name for this client instance.
|
| services.netbird.tunnels.<name>.user.name | A system user name for this client instance.
|
| services.ntfy-sh.settings | Configuration for ntfy.sh, supported values are here.
|
| services.turn-rs.settings | Turn-rs server config file
|
| services.patroni.name | The name of the host
|
| services.lemmy.settings | Lemmy configuration
|
| services.aesmd.settings | AESM configuration
|
| services.stash.settings | Stash configuration
|
| services.private-gpt.settings | settings-local.yaml for private-gpt
|
| systemd.targets.<name>.name | The name of this systemd unit, including its extension
|
| systemd.sockets.<name>.name | The name of this systemd unit, including its extension
|
| services.frp.settings | Frp configuration, for configuration options
see the example of client
or server on github.
|
| services.mpd.settings.port | This setting is the TCP port that is desired for the daemon to get assigned
to.
|
| services.eintopf.settings | Settings to configure web service
|
| services.evremap.settings | Settings for evremap
|
| services.pds.settings.PDS_PORT | Port to listen on
|
| services.snipe-it.mail.replyTo.name | Mail "reply-to" name.
|
| services.haven.settings | See https://github.com/bitvora/haven for documentation.
|
| services.acme-dns.settings.api.ip | IP to bind the HTTP API on.
|
| services.ente.api.settings.db.port | The database port
|
| services.ente.api.settings.db.host | The database host
|
| services.ente.api.settings.db.user | The database user
|
| services.tor.settings.DirPort | See torrc manual.
|
| services.tor.settings.DNSPort | See torrc manual.
|
| services.tor.settings.PidFile | See torrc manual.
|
| services.zwave-js.settings | Configuration settings for the generated config file
|
| services.grafana.settings | Grafana settings
|
| services.acme-dns.settings.api.tls | TLS backend to use.
|
| services.public-inbox.settings | Settings for the public-inbox config file.
|
| services.isso.settings | Configuration for isso
|
| services.goss.settings | The global options in config file in yaml format
|
| services.kubo.settings | Attrset of daemon configuration
|
| services.nats.settings | Declarative NATS configuration
|
| services.envoy.settings | Specify the configuration for Envoy in Nix.
|
| services.wiki-js.settings | Settings to configure wiki-js
|
| services.nfs.settings | General configuration for NFS daemons and tools
|
| services.drupal.sites.<name>.database.name | Database name.
|
| services.apache-kafka.settings | Kafka broker configuration
server.properties
|
| services.cachix-agent.name | Agent name, usually same as the hostname
|
| services.wiki-js.settings.db.host | Hostname or socket-path to connect to.
|
| services.logind.settings.Login | Settings option for systemd-logind
|
| services.tor.settings.IPv6Exit | See torrc manual.
|
| services.tor.settings.ExtORPort | See torrc manual.
|
| services.tor.settings.GeoIPFile | See torrc manual.
|
| services.wiki-js.settings.port | TCP port the process should listen to.
|
| services.firezone.server.provision.accounts | All accounts to provision
|
| services.openssh.settings.Macs | Allowed MACs
Defaults to recommended settings from both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| services.inadyn.settings.custom | Settings for custom DNS providers.
|
| services.komga.settings | Komga configuration
|
| services.angrr.settings | Global configuration for angrr in TOML format.
|
| services.dunst.settings | Dunst configuration, see dunst(5)
|
| services.zrepl.settings | Configuration for zrepl
|
| services.oink.settings.apiKey | API key to use when modifying DNS records.
|
| services.umami.settings.BASE_PATH | Allows you to host Umami under a subdirectory
|
| services.zammad.redis.name | Name of the redis server
|
| services.pds.settings | Environment variables to set for the service
|
| services.wiki-js.settings.bindIP | IPs the service should listen to.
|
| services.i2pd.proto.httpProxy.name | The endpoint name.
|
| services.suricata.settings | Suricata settings
|
| services.omnom.settings.db.type | Database type.
|
| services.centrifugo.environmentFiles | Files to load environment variables from
|
| services.howdy.settings | Howdy configuration file
|
| services.gonic.settings | Configuration for Gonic, see https://github.com/sentriz/gonic#configuration-options for supported values.
|
| services.clatd.settings | Configuration of clatd
|
| services.plikd.settings | Configuration for plikd, see https://github.com/root-gg/plik/blob/master/server/plikd.cfg
for supported values.
|
| services.omnom.settings | Configuration options for the /etc/omnom/config.yml file.
|
| services.slskd.settings | Application configuration for slskd
|
| services.nipap.settings | Configuration options to set in /etc/nipap/nipap.conf.
|
| services.rimgo.settings.PORT | The port to use.
|
| services.umami.settings.PORT | The port to listen on.
|
| services.forgejo.settings | Free-form settings written directly to the app.ini configfile file
|
| services.tor.settings.NATDPort | See torrc manual.
|
| services.actual.settings | Server settings, refer to the documentation for available options
|
| systemd.user.sockets.<name>.name | The name of this systemd unit, including its extension
|
| systemd.user.targets.<name>.name | The name of this systemd unit, including its extension
|
| services.nvme-rs.settings | Configuration for nvme-rs in TOML format
|
| services.kmonad.keyboards.<name>.name | Keyboard name.
|
| services.kmscon.fonts.*.name | Font name, as used by fontconfig.
|
| services.karma.settings | Karma dashboard configuration as nix attributes
|
| services.hatsu.settings | Configuration for Hatsu, see
|
| services.gitea.settings | Gitea configuration
|
| services.tuned.settings | Configuration for TuneD
|
| services.xmrig.settings | XMRig configuration
|
| services.stash.settings.port | The port that Stash should listen on.
|
| systemd.oomd.settings.OOM | Settings option for systemd-oomd
|
| services.acme-dns.settings.api.port | Listen port for the HTTP API.
|
| services.akkoma.frontends.<name>.name | Akkoma frontend name.
|
| services.pretalx.settings | pretalx configuration as a Nix attribute set
|
| services.lokinet.settings | Configuration for Lokinet
|
| services.thinkfan.settings | Thinkfan settings
|
| services.tsidp.settings.port | Port to listen on (default: 443).
|
| services.tor.settings.DirCache | See torrc manual.
|
| services.tor.settings.GeoIPv6File | See torrc manual.
|
| services.stash.settings.host | The ip address that Stash should bind to.
|
| services.gatus.settings | Configuration for Gatus
|
| services.ulogd.settings | Configuration for ulogd
|
| services.pgscv.settings | Configuration for pgSCV, in YAML format
|
| services.tempo.settings | Specify the configuration for Tempo in Nix
|
| services.cross-seed.settingsFile | Path to a JSON file containing settings that will be merged with the
settings option
|
| services.postfix.masterConfig.<name>.name | The name of the service to run
|
| services.slskd.settings.web.port | The HTTP listen port.
|
| services.nvme-rs.settings.email.to | Recipient email address
|
| services.aria2.settings.dir | Directory to store downloaded files.
|
| services.dolibarr.settings | Dolibarr settings, see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example for details.
|
| services.mediamtx.settings | Settings for MediaMTX
|
| services.mympd.settings.ssl | Whether to enable listening on the SSL port
|
| services.paisa.settings.dbFile | Filename of the Paisa database.
|
| services.nvme-rs.settings.email | Email notification configuration
|
| services.rauc.settings | Rauc configuration that will be converted to INI
|
| services.crab-hole.settings | Crab-holes config
|
| services.lemmy.settings.port | Port where lemmy should listen for incoming requests.
|
| services.legit.settings | The primary legit configuration
|
| services.umami.settings | Additional configuration (environment variables) for Umami, see
https://umami.is/docs/environment-variables for supported values.
|
| services.pdns-recursor.settings | PowerDNS Recursor settings
|
| services.rke2.autoDeployCharts.<name>.name | The name of the Helm chart
|
| security.agnos.settings | Settings
|
| services.canaille.settings | Settings for Canaille
|
| services.cockpit.settings | Settings for cockpit that will be saved in /etc/cockpit/cockpit.conf
|
| services.tor.settings.HidServAuth | See torrc manual.
|
| services.inadyn.settings | See inadyn.conf (5)
|
| services.mbpfan.settings | INI configuration for Mbpfan.
|
| services.dex.settings | The available options can be found in
the example configuration
|
| services.kanidm.server.settings | Settings for Kanidm, see
the documentation
and example configuration
for possible values.
|
| services.sabnzbd.settings.ntfosd | NotifyOSD settings
|
| services.gatus.settings.web.port | The TCP port to serve the Gatus service at.
|
| services.kea.dhcp-ddns.settings | Kea DHCP-DDNS configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html.
|
| services.prosody.muc.*.name | The name to return in service discovery responses for the MUC service itself
|
| services.pds.settings.PDS_DID_PLC_URL | URL of DID PLC directory
|
| services.dsnet.settings.IP | The IPv4 address that the server will use on the network
|
| services.i2pd.proto.socksProxy.name | The endpoint name.
|
| services.alice-lg.settings | alice-lg configuration, for configuration options see the example on github
|
| services.cloud-init.settings | Structured cloud-init configuration.
|
| services.kismet.settings | Options for Kismet
|
| services.vector.settings | Specify the configuration for Vector in Nix.
|
| services.opengfw.settings.replay | PCAP replay settings.
|
| services.stash.settings.cache | Path to cache
|
| services.omnom.settings.smtp.tls | Whether to enable Whether TLS encryption should be used..
|
| services.kanboard.settings | Customize the default settings, refer to https://github.com/kanboard/kanboard/blob/main/config.default.php
for details on supported values.
|
| services.dendrite.settings | Configuration for dendrite, see:
https://github.com/matrix-org/dendrite/blob/main/dendrite-sample.yaml
for available options with which to populate settings.
|
| services.pixelfed.settings | .env settings for Pixelfed
|
| services.paisa.settings.dataDir | Path to paisa data directory.
|
| services.tor.settings.ExitRelay | See torrc manual.
|
| services.tor.settings.SOCKSPort | See torrc manual.
|
| services.tor.settings.TransPort | See torrc manual.
|
| services.tor.settings.PerConnBWRate | See torrc manual.
|
| services.part-db.settings | Options for part-db configuration
|
| services.omnom.settings.smtp.host | SMTP server hostname.
|
| services.kea.dhcp4.settings | Kea DHCP4 configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html.
|
| services.kea.dhcp6.settings | Kea DHCP6 configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html.
|
| services.evcc.settings | evcc configuration as a Nix attribute set
|
| services.zfs.zed.settings | ZFS Event Daemon /etc/zfs/zed.d/zed.rc content
See
zed(8)
for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables
|
| services.qui.settings | qui configuration options
|
| hardware.alsa.controls.<name>.name | Name of the control, as it appears in alsamixer
|
| services.atticd.settings | Structured configurations of atticd
|
| services.garage.settings | Garage configuration, see https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/ for reference.
|
| services.aesmd.settings.proxy | HTTP network proxy.
|
| services.godns.settings | Configuration for GoDNS
|
| services.sympa.settings | The sympa.conf configuration file as key value set
|
| services.harmonia.settings | Settings to merge with the default configuration
|
| services.dsnet.settings.IP6 | The IPv6 address that the server will use on the network
Leave this empty to let dsnet choose an address.
|
| services.v4l2-relayd.instances.<name>.name | The name of the instance.
|
| services.nfs.idmapd.settings | libnfsidmap configuration
|
| services.omnom.settings.smtp.port | SMTP server port address.
|
| services.actual.settings.port | The port to listen on
|
| services.kavita.settings.Port | Port to bind to.
|
| services.xray.settingsFile | The absolute path to the configuration file
|
| services.postfix.settings.main | The main.cf configuration file as key value set
|
| services.hebbot.settings | Configuration for Hebbot, see, for examples:
|
| services.kavita.settings | Kavita configuration options, as configured in appsettings.json.
|
| services.gancio.settings | Configuration for Gancio, see https://gancio.org/install/config for supported values.
|
| services.dgraph.settings | Contents of the dgraph config
|
| services.rsyncd.settings | Configuration for rsyncd
|
| services.slskd.settings.rooms | Chat rooms to join on startup.
|
| services.tor.settings.AuthDirPinKeys | See torrc manual.
|
| services.varnish.listen.*.name | Name is referenced in logs
|
| services.neard.settings | Neard INI-style configuration file as a Nix attribute set
|
| services.gitea.settings.log.LEVEL | General log level.
|
| services.nvme-rs.settings.email.from | Sender email address
|
| programs.nncp.settings | NNCP configuration, see
http://www.nncpgo.org/Configuration.html
|
| services.ente.api.settings.apps.cast | Set this to the URL where your cast page is running
|
| services.sftpgo.settings.smtp | SMTP configuration section.
|
| services.buildkite-agents.<name>.name | The name of the agent as seen in the buildkite dashboard.
|
| services.tt-rss.database.name | Name of the existing database.
|
| services.blocky.settings | Blocky configuration
|
| services.erigon.settings | Configuration for Erigon
Refer to https://github.com/ledgerwatch/erigon#usage for details on supported values.
|
| services.greetd.settings | greetd configuration (documentation)
as a Nix attribute set.
|
| services.gobgpd.settings | GoBGP configuration
|
| services.soft-serve.settings | The contents of the configuration file for soft-serve
|
| services.qdrant.settings | Configuration for Qdrant
Refer to https://github.com/qdrant/qdrant/blob/master/config/config.yaml for details on supported values.
|
| services.gerrit.settings | Gerrit configuration
|
| services.zeyple.settings | Zeyple configuration. refer to
https://github.com/infertux/zeyple/blob/master/zeyple/zeyple.conf.example
for details on supported values.
|
| services.gancio.settings.db.host | Connection string for the PostgreSQL database
|
| services.omnom.settings.app.debug | Whether to enable debug mode.
|
| services.opengfw.rules.*.name | Name of the rule.
|
| services.phpfpm.settings | PHP-FPM global directives
|
| services.artalk.settings.port | Artalk server listen port
|
| services.artalk.settings.host | Artalk server listen host
|
| services.tsidp.settings.hostName | The hostname to use for the tsnet node.
|
| services.tor.settings.DirPolicy | See torrc manual.
|
| services.rkvm.server.settings | Structured server daemon configuration
|
| services.rkvm.client.settings | Structured client daemon configuration
|
| services.homed.settings.Home | Options for systemd-homed
|
| services.kubo.settings.Mounts.MFS | Where to mount the MFS namespace to
|
| services.crowdsec.name | Name of the machine when registering it at the central or local api.
|
| services.sunshine.settings | Settings to be rendered into the configuration file
|
| services.movim.h2o.settings | Attrset to be transformed into YAML for host config
|
| services.wiki-js.settings.logLevel | Define how much detail is supposed to be logged at runtime.
|
| services.samba.settings | Configuration file for the Samba suite in ini format
|
| services.mopidy.settings | The configuration that Mopidy should use
|
| services.strfry.settings | Configuration options to set for the Strfry service
|
| services.mchprs.settings | Configuration for MCHPRS via Config.toml
|
| services.zenohd.settings | Config options for zenoh.json5 configuration file
|
| services.oink.settings.ttl | The TTL ("Time to Live") value to set for your DNS records
|
| services.kea.ctrl-agent.settings | Kea Control Agent configuration as an attribute set, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html.
|
| services.nezha-agent.settings.gpu | Enable GPU monitoring.
|
| services.legit.settings.meta.title | Website title.
|
| services.zwave-js-ui.settings | Extra environment variables passed to the zwave-js-ui process
|
| services.cross-seed.settings.port | Port the cross-seed daemon listens on.
|
| services.ente.api.settings | Museum yaml configuration
|
| services.taler.settings | Global configuration options for the taler config file
|
| services.chhoto-url.settings.port | The port to listen on.
|
| services.sftpgo.settings.smtp.from | From address.
|
| services.clight.settings | Additional configuration to extend clight.conf
|
| services.netbox.settings | Configuration options to set in configuration.py
|
| services.sftpgo.settings | The primary sftpgo configuration
|
| services.porn-vault.settings | Configuration for Porn-Vault
|
| services.pghero.settings | PgHero configuration
|
| services.tor.settings.HidServAuth.*.auth | Authentication cookie.
|
| services.nezha-agent.settings.tls | Enable SSL/TLS encryption.
|
| services.tor.settings.PerConnBWBurst | See torrc manual.
|
| services.cryptpad.settings | Cryptpad configuration settings
|
| services.mchprs.settings.port | Port for the server
|
| services.mchprs.settings.motd | Message of the day
|
| services.nostr-rs-relay.settings | See https://git.sr.ht/~gheartsfield/nostr-rs-relay/#configuration for documentation.
|
| services.pocket-id.settings | Environment variables to be passed
|
| services.opengfw.settings.workers | Worker settings.
|
| services.sftpgo.settings.smtp.user | SMTP username.
|
| services.gitea.settings.log.ROOT_PATH | Root path for log files.
|
| services.wiki-js.settings.db.type | Database driver to use for persistence
|
| services.paperless.settings | Extra paperless config options
|
| services.ananicy.settings | See https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
|
| services.radicle.settings | See https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275
|
| services.renovate.settings | Renovate's global configuration
|
| services.chhoto-url.settings | Configuration of Chhoto URL
|
| services.doh-server.settings | Configuration of doh-server in toml
|
| services.pihole-ftl.settings | Configuration options for pihole.toml
|
| services.aria2.settings.conf-path | Configuration file path.
|
| services.mympd.settings | Manages the configuration files declaratively
|
| services.kubo.settings.Mounts.IPNS | Where to mount the IPNS namespace to
|
| services.kubo.settings.Mounts.IPFS | Where to mount the IPFS namespace to
|
| services.sftpgo.settings.smtp.port | Port of the SMTP Server.
|
| services.doh-server.settings.path | HTTP path for resolve application
|
| services.tor.settings.ExitPolicy | See torrc manual.
|
| services.pocket-id.settings.APP_URL | The URL where you will access the app.
|
| services.i2pd.proto.i2pControl.name | The endpoint name.
|
| services.mealie.settings | Configuration of the Mealie service
|
| services.veilid.settings | Build veilid-server.conf with nix expression
|
| services.go2rtc.settings | go2rtc configuration as a Nix attribute set
|
| services.freeciv.settings | Parameters of freeciv-server.
|
| services.openssh.settings | Configuration for sshd_config(5).
|
| services.dwm-status.settings | Config options for dwm-status, see https://github.com/Gerschtli/dwm-status#configuration
for available options.
|
| services.netbird.tunnels.<name>.service.name | A systemd service name to use (without .service suffix).
|
| services.netbird.clients.<name>.service.name | A systemd service name to use (without .service suffix).
|
| services.mpd.settings.db_file | The path to MPD's database.
|
| services.tsidp.settings.localPort | Listen on localhost:.
|
| services.oncall.settings.db.conn.str | Database connection scheme
|
| services.openbao.settings.ui | Whether to enable the OpenBao web UI.
|
| services.llama-swap.settings | llama-swap configuration
|
| services.listmonk.settings | Static settings set in the config.toml, see https://github.com/knadh/listmonk/blob/master/config.toml.sample for details
|
| services.tsidp.settings.logLevel | Set logging level: debug, info, warn, error.
|
| services.mysql.galeraCluster.name | The logical name of the Galera cluster
|
| services.postfix.settings.master | The master.cf configuration file as an attribute set of service
defitions
|
| services.amule.settings.eMule.Port | TCP port for eD2k connections
|
| services.mysql.ensureUsers.*.name | Name of the user to ensure.
|
| services.litellm.settings | Configuration for LiteLLM
|
| services.grocy.phpfpm.settings | Options for grocy's PHPFPM pool.
|
| services.tor.settings.Address | See torrc manual.
|
| services.tor.settings.ClientUseIPv6 | See torrc manual.
|
| services.tor.settings.HSLayer3Nodes | See torrc manual.
|
| services.tor.settings.Sandbox | See torrc manual.
|
| services.tor.settings.HSLayer2Nodes | See torrc manual.
|
| services.tor.settings.ClientUseIPv4 | See torrc manual.
|
| services.knot.settingsFile | As alternative to settings, you can provide whole configuration
directly in the almost-YAML format of Knot DNS
|
| services.legit.settings.repo.scanPath | Directory where legit will scan for repositories.
|
| services.authelia.instances.<name>.name | Name is used as a suffix for the service name, user, and group
|
| services.glance.settings | Configuration written to a yaml file that is read by glance
|
| services.artalk.settings | The artalk configuration
|
| services.reaction.settings | Configuration for reaction
|
| services.rkvm.server.settings.key | TLS key path.
This should be generated with rkvm-certificate-gen.
|
| services.misskey.settings.db.port | The PostgreSQL port.
|
| services.misskey.settings.db.host | The PostgreSQL host.
|
| services.molly-brown.settings | molly-brown configuration
|
| services.gitea.database.name | Database name.
|
| services.movim.database.name | Database name.
|
| services.tuned.settings.daemon | Whether to enable the use of a daemon for TuneD.
|
| services.stash.settings.stash.*.path | location of your media files
|
| services.biboumi.settings | See biboumi 9.0
for documentation.
|
| services.waagent.settings | The waagent.conf configuration, see https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux for documentation.
|
| services.zipline.settings | Configuration of Zipline
|
| services.pretix.settings.mail.host | Hostname of the SMTP server use for mail delivery.
|
| services.pretix.settings.mail.port | Port of the SMTP server to use for mail delivery.
|
| services.paisa.settings | Paisa configuration
|
| services.sing-box.settings | The sing-box configuration, see https://sing-box.sagernet.org/configuration/ for documentation
|
| services.amule.settings.eMule.TempDir | Directory where aMule stores incomplete downloads (.part/.part.met files).
|
| services.pds.settings.PDS_BSKY_APP_VIEW_DID | DID of bsky frontend
|
| services.freeciv.settings.read | Startup script.
|
| services.sslh.settings.timeout | Timeout in seconds.
|
| programs.rust-motd.settings | Settings on what to generate
|
| services.nzbget.settings | NZBGet configuration, passed via command line using switch -o
|
| services.grafana-to-ntfy.settings.bauthPass | The path to the password you will use in the Grafana webhook settings.
|
| services.openssh.settings.Ciphers | Allowed ciphers
Defaults to recommended settings from both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| services.schleuder.settings | Settings for schleuder.yml
|
| services.tor.settings.HidServAuth.*.onion | Onion address.
|
| services.tor.settings.DirPortFrontPage | See torrc manual.
|
| services.pretix.settings.mail.from | E-Mail address used in the FROM header of outgoing mails.
|
| services.glance.settings.pages | List of pages to be present on the dashboard
|
| services.legit.settings.server.host | Host address.
|
| services.legit.settings.server.port | Legit port.
|
| services.legit.settings.repo.ignore | Repositories to ignore.
|
| services.displayManager.ly.settings | Extra settings merged in and overwriting defaults in config.ini.
|
| services.sharkey.settings.id | The ID generation method for Sharkey to use
|
| services.pds.settings.PDS_BSKY_APP_VIEW_URL | URL of bsky frontend
|
| services.zitadel.settings.Port | The port that ZITADEL listens on.
|
| services.misskey.settings.db.user | The user used for database authentication.
|
| services.opengfw.settings.io.sndBuf | Netlink send buffer size.
|
| services.misskey.settings.db.pass | The password used for database authentication.
|
| services.opengfw.settings.io.rcvBuf | Netlink receive buffer size.
|
| services.uptime-kuma.settings | Additional configuration for Uptime Kuma, see
https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
for supported values.
|
| services.glpiAgent.settings | GLPI Agent configuration options
|
| services.invidious.settings | The settings Invidious should use
|
| services.nominatim.settings | Nominatim configuration settings
|
| services.snipe-it.database.name | Database name.
|
| services.kanidm.unix.settings | Configure Kanidm unix daemon
|
| xdg.portal.wlr.settings | Configuration for xdg-desktop-portal-wlr
|
| services.stash.settings.stash | Add directories containing your adult videos and images
|
| services.pds.settings.LOG_ENABLED | Enable logging
|
| services.go-httpbin.settings.PORT | The port to listen on.
|
| services.go-httpbin.settings.HOST | The host to listen on.
|
| services.firezone.relay.name | The name of this gateway as shown in firezone
|
| services.oauth2-proxy.cookie.name | The name of the cookie that the oauth_proxy creates.
|
| services.legit.settings.repo.readme | Readme files to look for.
|
| services.karma.settings.listen.port | HTTP port to listen on.
|
| services.nipap.settings.nipapd.port | Port to bind nipapd to.
|
| services.autobrr.settings | Autobrr configuration options
|
| services.klipper.settings | Configuration for Klipper
|
| services.readeck.settings | Additional configuration for Readeck, see
https://readeck.org/en/docs/configuration
for supported values.
|
| services.redmine.settings | Redmine configuration (configuration.yml)
|
| services.misskey.settings | Configuration for Misskey, see
example.yml
for all supported options.
|
| services.zitadel.settings | Contents of the runtime configuration file
|
| services.vikunja.settings | Vikunja configuration
|
| services.misskey.settings.id | The ID generation method to use
|
| services.freeciv.settings.auth | Whether to enable server authentication.
|
| services.dwm-status.settings.order | List of enabled features in order.
|
| services.freeciv.settings.port | Listen for clients on given port
|
| services.openssh.settings.UsePAM | Whether to enable PAM authentication.
|
| services.tor.settings.TransProxyType | See torrc manual.
|
| services.misskey.settings.port | The port your Misskey server should listen on.
|
| services.tor.settings.SocksPolicy | See torrc manual.
|
| services.tor.settings.BridgeRelay | See torrc manual.
|
| services.tor.settings.LongLivedPorts | See torrc manual.
|
| services.sharkey.settings.port | The port that Sharkey will listen on.
|
| services.xonotic.settings.port | The port Xonotic will listen on.
|
| services.nezha-agent.settings | Generate to config.json as a Nix attribute set
|
| services.hound.settings | The full configuration of the Hound daemon
|
| services.memos.settings | The environment variables to configure Memos.
At time of writing, there is no clear documentation about possible values
|
| services.komga.settings.server.port | The port that Komga will listen on.
|
| services.legit.settings.dirs.static | Directories where static files are located.
|
| services.omnom.settings.smtp.sender | Omnom sender e-mail.
|
| services.dashy.settings | Settings serialized into user-data/conf.yml before build
|
| services.corteza.settings | Configuration for Corteza, will be passed as environment variables
|
| services.orthanc.settings | Configuration written to a json file that is read by orthanc
|
| services.zeronet.settings | zeronet.conf configuration
|
| services.heartbeat.name | Name of the beat
|
| services.mediawiki.name | Name of the wiki.
|
| services.teeworlds.name | Name of the server.
|
| services.doh-server.settings.tries | Number of tries if upstream DNS fails
|
| services.gns3-server.settings | The global options in config file in ini format
|
| services.oink.settings.secretApiKey | Secret API key to use when modifying DNS records.
|
| services.sftpgo.settings.smtp.host | Location of SMTP email server
|
| services.maubot.settings.server | Listener config
|
| services.go-httpbin.settings | Configuration of go-httpbin
|
| services.lokinet.settings.dns.bind | Address to bind to for handling DNS requests.
|
| services.rsync.jobs.<name>.user | The name of an existing user account under which the rsync process should run.
|
| services.tor.settings.HTTPTunnelPort | See torrc manual.
|
| services.tor.settings.CookieAuthFile | See torrc manual.
|
| services.tor.settings.AuthDirListBadExits | See torrc manual.
|
| services.h2o.hosts.<name>.serverName | Server name to be used for this virtual host
|
| services.goeland.settings | Configuration of goeland
|
| services.corerad.settings | Configuration for CoreRAD, see https://github.com/mdlayher/corerad/blob/main/internal/config/reference.toml
for supported values
|
| services.merecat.settings | Merecat configuration
|
| services.sharkey.settings | Configuration options for Sharkey
|
| services.sabnzbd.settings | The sabnzbd configuration (see also
sabnzbd's wiki
for extra documentation)
|
| services.davis.database.name | Database name, only used when the databse is created locally.
|
| services.livekit.settings.port | Main TCP port for RoomService and RTC endpoint.
|
| services.grafana.settings.smtp.host | Host to connect to.
|
| services.openiscsi.name | Name of this iscsi initiator
|
| services.opengfw.settings.io.rst | Set to true if you want to send RST for blocked TCP connections, needs local = false.
|
| virtualisation.oci-containers.containers.<name>.capabilities | Capabilities to configure for the container
|
| services.mysql.settings | MySQL configuration
|
| services.sharkey.settings.url | The full URL that the Sharkey instance will be publically accessible on
|
| services.pretalx.settings.site.url | The base URI below which your pretalx instance will be reachable.
|
| services.go-csp-collector.settings | Settings for go-csp-collector
|
| services.xonotic.settings | Generates the server.cfg file
|
| services.amule.settings.WebServer.Port | Web server port
|
| services.grafana.settings.smtp.user | User used for authentication.
|
| services.misskey.settings.db.extra | Extra connection options.
|
| services.frigate.settings.mqtt.host | MQTT server hostname
|
| services.kanidm.client.settings.uri | Address of the Kanidm server.
|
| services.biboumi.settings.port | The TCP port to use to connect to the local XMPP component.
|
| services.tsidp.settings.enableSts | Enable OAuth token exchange using RFC 8693.
|
| services.displayManager.sddm.settings | Extra settings merged in and overwriting defaults in sddm.conf.
|
| services.oncall.settings | Extra configuration options to append or override
|
| services.evremap.settings.remap | List of remappings.
|
| services.rimgo.settings.ADDRESS | The address to listen on.
|
| services.docuseal.redis.name | Name of the redis server
|
| services.inadyn.settings.provider | Settings for DDNS providers built-in to inadyn
|
| services.nsd.zones.<name>.notify | This primary server will notify all given secondary servers about
zone changes
|
| services.xinetd.services.*.name | Name of the service.
|
| services.tor.settings.ControlPort | See torrc manual.
|
| services.tor.settings.FetchDirInfoEarly | See torrc manual.
|
| services.tor.settings.ContactInfo | See torrc manual.
|
| services.homer.settings | Settings serialized into config.yml before build
|
| services.grafana-to-ntfy.settings.bauthUser | The user that you will authenticate with in the Grafana webhook settings
|
| services.step-ca.settings | Settings that go into ca.json
|
| services.mtr-exporter.jobs.*.name | Name of ICMP pinging job.
|
| services.lasuite-meet.livekit.settings | Settings to pass to the livekit server
|
| services.go2rtc.settings.ffmpeg.bin | The ffmpeg package to use for transcoding.
|
| services.homebox.settings | The homebox configuration as environment variables
|
| services.bonsaid.settings | State transition definitions
|
| services.unbound.settings | Declarative Unbound configuration
See the unbound.conf(5) manpage for a list of
available options.
|
| services.osquery.settings | Configuration to be written to the osqueryd JSON configuration file
|
| services.grocy.settings.culture | Display language of the frontend.
|
| power.ups.upsmon.settings | Additional settings to add to upsmon.conf.
|
| services.inadyn.settings.allow-ipv6 | Whether to get IPv6 addresses from interfaces.
|
| services.haste-server.settings | Configuration for haste-server
|
| services.zabbixProxy.settings | Zabbix Proxy configuration
|
| services.zabbixAgent.settings | Zabbix Agent configuration
|
| services.forgejo.settings.log.LEVEL | General log level.
|
| services.pretix.settings.tools.pdftk | Path to the pdftk executable.
|
| services.nipap.settings.nipapd.debug | Enable debug logging.
|
| services.tsidp.settings.debugTsnet | For development
|
| services.wiki-js.settings.offline | Disable latest file updates and enable
sideloading.
|
| services.wordpress.sites.<name>.database.name | Database name.
|
| services.opengfw.settingsFile | Path to file containing OpenGFW settings.
|
| services.dovecot2.mailboxes.<name>.name | The name of the mailbox.
|
| services.zitadel.settings.TLS.KeyPath | Path to the TLS certificate private key.
|
| services.lidarr.settings | Attribute set of arbitrary config options
|
| services.cross-seed.settings | Configuration options for cross-seed
|
| services.sonarr.settings | Attribute set of arbitrary config options
|
| services.radarr.settings | Attribute set of arbitrary config options
|
| services.peertube.settings | Configuration for peertube.
|
| services.quickwit.settings | Quickwit configuration.
|
| services.warpgate.settings | Warpgate configuration.
|
| services.vmalert.settings | vmalert configuration, passed via command line flags
|
| services.i2pd.websocket.name | The endpoint name.
|
| services.monica.database.name | Database name.
|
| services.moodle.database.name | Database name.
|
| services.zammad.database.name | Database name.
|
| services.freeciv.settings.debug | Set debug log level.
|
| services.tor.settings.V3AuthUseLegacyKey | See torrc manual.
|
| services.sympa.database.name | Database name
|
| services.lidarr.settings.server.port | Port Number
|
| services.maubot.settings.server.port | The port to listen on
|
| services.radarr.settings.server.port | Port Number
|
| services.sonarr.settings.server.port | Port Number
|
| services.chhoto-url.settings.db_url | The path of the sqlite database.
|
| services.apache-kafka.settings."log.dirs" | Log file directories.
|
| services.amule.settings.eMule.UDPPort | UDP port for eD2k traffic (searches, source exchange) and all Kad network communication
|
| services.sabnzbd.settings.misc.port | Port for the Web UI to listen on for incoming connections.
|
| services.pretix.settings.pretix.url | The installation’s full URL, without a trailing slash.
|
| services.sabnzbd.settings.misc.host | Address for the Web UI to listen on for incoming connections.
|
| services.patroni.settings | The primary patroni configuration
|
| services.livekit.settings | LiveKit configuration file expressed in nix
|
| services.opendkim.settings | Additional opendkim configuration
|
| services.cross-seed.settings.linkDirs | List of directories where cross-seed will create links
|
| services.immich.database.name | The name of the immich database.
|
| services.glance.settings.server.port | Glance port to listen on
|
| services.glance.settings.server.host | Glance bind address
|
| services.legit.settings.repo.mainBranch | Main branch to look for.
|
| services.zitadel.settings.TLS.CertPath | Path to the TLS certificate.
|
| systemd.mounts.*.name | The name of this systemd unit, including its extension
|
| services.clamav.daemon.settings | ClamAV configuration
|
| services.scrutiny.settings | Scrutiny settings to be rendered into the configuration file
|
| services.bluesky-pds.settings.PDS_PORT | Port to listen on
|
| services.nezha-agent.settings.server | Address to the dashboard.
|
| services.zipline.settings.CORE_PORT | The port to listen on.
|
| services.gitea.settings.server.ROOT_URL | Full public URL of gitea server.
|
| services.sonic-server.settings | Sonic Server configuration options
|
| services.go2rtc.settings.api.listen | API listen address, conforming to a Go address string.
|
| services.doh-server.settings.listen | HTTP listen address and port
|
| services.tor.settings.DisableAllSwap | See torrc manual.
|
| services.sslh.settings.numeric | Whether to disable reverse DNS lookups, thus keeping IP
address literals in the log.
|
| services.misskey.settings.redis.host | The Redis host.
|
| services.omnom.settings.storage.type | Storage type.
|
| services.misskey.settings.redis.port | The Redis port.
|
| services.aria2.settings.enable-rpc | Enable JSON-RPC/XML-RPC server.
|
| services.lxd-image-server.settings | Configuration for lxd-image-server
|
| services.misskey.settings.redis | ioredis options
|
| systemd.network.networks.<name>.name | The name of the network interface to match against.
|
| services.packagekit.settings | Additional settings passed straight through to PackageKit.conf
|
| services.influxdb.settings | Extra configuration options for influxdb
|
| services.crowdsec.settings | Set of various configuration attributes
|
| services.openldap.settings | Configuration for OpenLDAP, in OLC format
|
| services.minidlna.settings | Configuration for minidlna.conf(5).
|
| services.actual.settings.userFiles | The server will put all the budget files in this directory as binary blobs.
|
| services.wakapi.database.name | The name of the database to use for Wakapi.
|
| services.hickory-dns.settings.zones | List of zones to serve.
|
| services.wyoming.piper.servers.<name>.zeroconf.name | The advertised name for zeroconf discovery.
|
| services.crowdsec.settings.general | Settings for the main CrowdSec configuration file
|
| services.traccar.settingsFile | File used as configuration for traccar
|
| services.automx2.settings | Bootstrap json to populate database
|
| services.freeciv.settings.exit-on-end | Whether to enable exit instead of restarting when a game ends.
|
| services.polaris.settings | Contents for the TOML Polaris config, applied each start
|
| services.fediwall.settings.tags | Tags to follow
|
| services.hedgedoc.settings.port | Port to listen on.
|
| services.hedgedoc.settings.host | Address to listen on.
|
| services.lasuite-docs.settings.DB_USER | User of the database
|
| services.lasuite-meet.settings.DB_HOST | Host of the database
|
| services.lasuite-meet.settings.DB_USER | User of the database
|
| services.lasuite-docs.settings.DB_HOST | Host of the database
|
| services.hedgedoc.settings | HedgeDoc configuration, see
https://docs.hedgedoc.org/configuration/
for documentation.
|
| services.olivetin.settings | Configuration of OliveTin
|
| services.routedns.settings | Configuration for RouteDNS, see https://github.com/folbricht/routedns/blob/master/doc/configuration.md
for more information.
|
| services.tor.settings.ClientAutoIPv6ORPort | See torrc manual.
|
| services.opengfw.settings.io.local | Set to false if you want to run OpenGFW on FORWARD chain. (e.g. on a router)
|
| services.spacecookie.settings | Settings for spacecookie
|
| services.radicle.ci.broker.settings.db | Database file path.
|
| services.forgejo.settings.log.ROOT_PATH | Root path for log files.
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.name | The name of this authentication provider
|
| services.zabbixWeb.database.name | Database name.
|
| services.wg-access-server.settings | See https://www.freie-netze.org/wg-access-server/2-configuration/ for possible options
|
| services.rsync.jobs.<name>.group | The name of an existing user group under which the rsync process should run.
|
| services.bonsaid.settings.*.type | Type of transition
|
| services.oncall.settings.db.conn.kwargs.host | Database host.
|
| services.oncall.settings.db.conn.kwargs.user | Database user.
|
| services.crowdsec.settings.capi | CAPI Configuration attributes
|
| services.crowdsec.settings.lapi | LAPI Configuration attributes
|
| services.resolved.settings.Resolve | Settings option for systemd-resolved
|
| services.ergochat.settings | Ergo IRC daemon configuration file.
https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml
|
| services.spotifyd.settings | Configuration for Spotifyd
|
| services.netatalk.settings | Configuration for Netatalk
|
| services.gancio.settings.db.storage | Location for the SQLite database.
|
| services.gancio.settings.db.dialect | The database dialect to use
|
| services.opengfw.settings.io.queueSize | IO queue size.
|
| services.pdns-recursor.yaml-settings | PowerDNS Recursor settings
|
| services.firefly-iii.settings.DB_PORT | The port your database is listening at. sqlite does not require
this value to be filled.
|
| services.pds.settings.PDS_CRAWLERS | URL of crawlers
|
| programs.yazi.settings | Configuration included in $YAZI_CONFIG_HOME.
|
| services.rkvm.server.settings.listen | An internet socket address to listen on, either IPv4 or IPv6.
|
| services.aesmd.settings.proxyType | Type of proxy to use
|
| services.misskey.settings.url | The final user-facing URL
|
| services.dsnet.settings | The settings to use for dsnet
|
| services.rathole.settings | Rathole configuration, for options reference
see the example on GitHub
|
| services.frigate.settings | Frigate configuration as a nix attribute set
|
| services.tor.settings.ClientOnionAuthDir | See torrc manual.
|
| services.quickwit.settings.rest | Rest server configuration for Quickwit
|
| hardware.sane.brscan5.netDevices.<name>.name | The friendly name you give to the network device
|
| hardware.sane.brscan4.netDevices.<name>.name | The friendly name you give to the network device
|
| services.udisks2.settings | Options passed to udisksd
|
| services.nvme-rs.settings.email.use_tls | Use TLS for SMTP connection
|
| services.peroxide.settings | Configuration for peroxide
|
| services.fediwall.settings | Fediwall configuration
|
| services.ferretdb.settings | Additional configuration for FerretDB, see
https://docs.ferretdb.io/configuration/flags/
for supported values.
|
| services.bluesky-pds.settings | Environment variables to set for the service
|
| services.gitea.settings.server.HTTP_PORT | Listen port
|
| services.cross-seed.settings.outputDir | Directory where cross-seed will place torrent files it finds.
|
| services.tinc.networks.<name>.hosts | The name of the host in the network as well as the configuration for that host
|
| services.lasuite-docs.settings.DATA_DIR | Path to the data directory
|
| services.rkvm.client.settings.server | An RKVM server's internet socket address, either IPv4 or IPv6.
|
| services.kanidm.server.settings.role | The role of this server
|
| services.firefly-iii.settings.APP_ENV | The app environment
|
| services.gitlab.pages.settings.pages-root | The directory where pages are stored.
|
| services.auto-cpufreq.settings | Configuration for auto-cpufreq
|
| services.gemstash.settings.bind | Host and port combination for the server to listen on.
|
| services.suricata.settings.vars | Variables to be used within the suricata rules.
|
| services.oink.settings.interval | Seconds to wait before sending another request.
|
| services.suricata.settings.pcap | Cross platform libpcap capture support.
|
| services.firezone.gui-client.name | The name of this client as shown in firezone
|
| services.gokapi.settingsFile | Path to config file to parse and append to settings
|
| services.warpgate.settings.http.key | Path to HTTPS listener private key.
|
| nix.settings.max-jobs | This option defines the maximum number of jobs that Nix will try to
build in parallel
|
| services.gitlab-runner.settings | Global gitlab-runner configuration
|
| services.libeufin.settings | Global configuration options for the libeufin bank system config file.
|
| services.temporal.settings | Temporal configuration
|
| services.sshwifty.settings | Configuration for Sshwifty
|
| services.zabbixServer.settings | Zabbix Server configuration
|
| services.gitea.settings.server.HTTP_ADDR | Listen address
|
| services.dnsmasq.settings.server | The DNS servers which dnsmasq should query.
|
| services.grafana-to-ntfy.settings.ntfyUrl | The URL to the ntfy-sh topic.
|
| services.gancio.settings.baseurl | The full URL under which the server is reachable.
|
| services.tor.settings.DisableOOSCheck | See torrc manual.
|
| services.moosefs.master.settings | Master configuration options (mfsmaster.cfg).
|
| programs.bat.settings | Parameters to be written to the system-wide bat configuration file.
|
| services.nipap.settings.nipapd.listen | IP address to bind nipapd to.
|
| services.warpgate.settings.ssh.keys | Path to store SSH host & client keys.
|
| services.scion.scion-router.settings | scion-router configuration
|
| services.scion.scion-daemon.settings | scion-daemon configuration
|
| services.castopod.settings | Environment variables used for Castopod
|
| services.radicale.settings | Configuration for Radicale
|
| services.immich-kiosk.settings | Configuration for immich-kiosk
|
| services.misskey.settings.socket | The UNIX socket your Misskey server should listen on.
|
| services.paisa.settings.journalFile | Filename of the main journal / ledger file.
|
| services.pocket-id.settings.TRUST_PROXY | Whether the app is behind a reverse proxy.
|
| services.immich-kiosk.settings.kiosk.port | Port on which immich-kiosk will listen.
|
| services.suricata.settings.run-as.user | Run Suricata with a specific user-id.
|
| services.ntfy-sh.settings.base-url | Public facing base URL of the service
This setting is required for any of the following features:
- attachments (to return a download URL)
- e-mail sending (for the topic URL in the email footer)
- iOS push notifications for self-hosted servers
(to calculate the Firebase poll_request topic)
- Matrix Push Gateway (to validate that the pushkey is correct)
|
| services.kanidm.client.settings | Configure Kanidm clients, needed for the PAM daemon
|
| services.doh-server.settings.timeout | Upstream timeout
|
| services.doh-server.settings.verbose | Enable logging
|
| services.umami.settings.HOSTNAME | The address to listen on.
|
| services.radicle.ci.broker.settings | Configuration of radicle-ci-broker
|
| programs.schroot.settings | Schroot configuration settings
|
| services.immich.settings | Configuration for Immich
|
| services.prosody-filer.settings | Configuration for Prosody Filer
|
| programs.atop.settings | Parameters to be written to /etc/atoprc.
|
| services.readarr.settings.server.port | Port Number
|
| services.vmalert.settings.rule | Path to the files with alerting and/or recording rules.
Consider using the services.vmalert.rules option as a convenient alternative for declaring rules
directly in the nix language.
|
| services.tor.settings.ExtORPortCookieAuthFile | See torrc manual.
|
| services.tor.settings.AuthDirTestEd25519LinkKeys | See torrc manual.
|
| services.tomcat.virtualHosts.*.name | name of the virtualhost
|
| services.pangolin.settings | Additional attributes to be merged with the configuration options and written to Pangolin's config.yml file.
|
| services.pinnwand.settings | Your pinnwand.toml as a Nix attribute set
|
| services.postsrsd.settings | Configuration options for the postsrsd.conf file
|
| services.freeciv.settings.Guests | Whether to enable guests to login if auth is enabled.
|
| services.saunafs.master.settings | Contents of config file (sfsmaster.cfg(5)).
|
| services.readarr.settings | Attribute set of arbitrary config options
|
| services.minidlna.settings.port | Port number for HTTP traffic (descriptions, SOAP, media transfer).
|
| services.bluesky-pds.settings.PDS_DID_PLC_URL | URL of DID PLC directory
|
| services.openldap.settings.attrs | Attributes of the parent entry.
|
| services.stash.settings.database | Path to the SQLite database
|
| services.scrutiny.settings.log.level | Log level for Scrutiny.
|
| services.actual.settings.dataDir | Directory under which Actual runs and saves its data
|
| services.forgejo.database.name | Database name.
|
| services.redmine.database.name | Database name.
|
| services.dsnet.settings.Network | The IPv4 network that the server will use to allocate IPs on the network
|
| services.clamav.updater.settings | freshclam configuration
|
| services.zitadel.settings.TLS.Key | The TLS certificate private key, as a base64-encoded string
|
| services.anubis.defaultOptions.policy.settings | Additional policy settings merged into the policy file
|
| services.firezone.server.provision.accounts.<name>.actors.<name>.name | The name of this actor
|
| services.firezone.server.provision.accounts.<name>.groups.<name>.name | The name of this group
|
| services.sunshine.settings.port | Base port -- others used are offset from this one, see https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#port for details.
|
| services.pocket-id.settings.PUBLIC_APP_URL | The URL where you will access the app.
|
| services.tor.settings.FetchDirInfoExtraEarly | See torrc manual.
|
| services.tor.settings.ControlSocket | See torrc manual.
|
| services.cross-seed.settings.dataDirs | Paths to be searched for matching data
|
| services.webdav-server-rs.settings | Attrset that is converted and passed as config file
|
| hardware.cpu.x86.msr.settings | Parameters for the msr kernel module.
|
| services.aria2.settings.listen-port | Set UDP listening port range used by DHT(IPv4, IPv6) and UDP tracker.
|
| services.microbin.settings | Additional configuration for MicroBin, see
https://microbin.eu/docs/installation-and-configuration/configuration/
for supported values
|
| services.wastebin.settings | Additional configuration for wastebin, see
https://github.com/matze/wastebin#usage for supported values
|
| services.freeciv.settings.saves | Save games to given directory,
a sub-directory named after the starting date of the service
will me inserted to preserve older saves.
|
| services.pdfding.database.name | PostgreSQL database name
|
| services.tlsrpt.fetcher.settings | Flags from tlsrpt-fetcher(1) as key-value pairs.
|
| services.tlsrpt.reportd.settings | Flags from tlsrpt-reportd(1) as key-value pairs.
|
| services.sharkey.settings.socket | If specified, creates a UNIX socket at the given path that Sharkey listens on.
|
| services.openssh.settings.PrintMotd | Whether to enable printing /etc/motd when a user logs in interactively.
|
| services.lasuite-docs.settings.REDIS_URL | URL of the redis backend
|
| services.lasuite-meet.settings.REDIS_URL | URL of the redis backend
|
| services.webdav.settings | Attrset that is converted and passed as config file
|
| services.froide-govplan.settings | Configuration options to set in extra_settings.py.
|
| services.pdns-recursor.old-settings | Older PowerDNS Recursor settings
|
| services.cgit.<name>.user | User to run the cgit service as.
|
| services.pds.settings.PDS_BLOB_UPLOAD_LIMIT | Size limit of uploaded blobs in bytes
|
| services.grocy.settings.currency | ISO 4217 code for the currency to display.
|
| services.stash.settings.no_proxy | A list of domains for which the proxy must not be used
|
| services.slskd.settings.web.url_base | The base path in the url for web requests.
|
| services.warpgate.settings.mysql.key | Path to MySQL listener private key.
|
| services.lasuite-docs.settings | Configuration options of docs
|
| services.dsnet.settings.Network6 | The IPv6 network that the server will use to allocate IPs on the
network
|
| services.zitadel.settings.TLS.Cert | The TLS certificate, as a base64-encoded string
|
| services.zwave-js.settings.storage.cacheDir | Cache directory
|
| networking.networkmanager.ensureProfiles.profiles | Declaratively define NetworkManager profiles
|
| services.c2fmzq-server.settings | Configuration for c2FmZQ-server passed as CLI arguments
|
| services.teleport.settings | Contents of the teleport.yaml config file
|
| services.nsd.zones.<name>.zoneStats | When set to something distinct to null NSD is able to collect
statistics per zone
|
| services.nomad.settings | Configuration for Nomad
|
| services.fediwall.settings.hideBots | Hide posts from bot accounts
|
| services.cryptpad.settings.httpPort | Port on which the Node.js server should listen
|
| services.firezone.gateway.name | The name of this gateway as shown in firezone
|
| services.sourcehut.settings."meta.sr.ht::settings".user-invites | How many invites each user is issued upon registration
(only applicable if open registration is disabled).
|
| services.angrr.settings.owned-only | Only monitors owned symbolic link target of GC roots.
- "auto": behaves like true for normal users, false for root.
- "true": only monitor GC roots owned by the current user.
- "false": monitor all GC roots.
|
| programs.yazi.settings.vfs | Configuration included in vfs.toml
|
| services.lldap.settings.http_url | The public URL of the server, for password reset links.
|
| services.buffyboard.settings | Settings to include in /etc/buffyboard.conf
|
| services.radicle.ci.adapters.native.instances.<name>.name | Adapter name that is used in the radicle-ci-broker configuration
|
| services.borgmatic.settings | See https://torsion.org/borgmatic/docs/reference/configuration/
|
| services.dolibarr.h2o.settings | Attrset to be transformed into YAML for host config
|
| services.cryptpad.settings.logLevel | Controls log level
|
| services.biboumi.settings.admin | The bare JID of the gateway administrator
|
| services.listmonk.database.settings | Dynamic settings in the PostgreSQL database, set by a SQL script, see https://github.com/knadh/listmonk/blob/master/schema.sql#L177-L230 for details.
|
| services.h2o.hosts.<name>.tls | TLS options for virtual host
|
| services.maubot.settings.logging | Python logging configuration
|
| services.dnsproxy.settings | Contents of the config.yaml config file
|
| services.stalwart.settings | Configuration options for the Stalwart server
|
| services.suricata.settings.run-as.group | Run Suricata with a specific group-id.
|
| services.ente.api.settings.apps.accounts | Set this to the URL where your accounts page is running
|
| services.keycloak.settings.http-host | On which address Keycloak should accept new connections.
|
| nix.settings.cores | This option defines the maximum number of concurrent tasks during
one build
|
| services.frigate.settings.ffmpeg.path | Package providing the ffmpeg and ffprobe executables below the bin/ directory.
|
| services.suricata.settings.af-xdp | Linux high speed af-xdp capture support, see
docs/capture-hardware/af-xdp.
|
| services.omnom.settings.server.address | Server address.
|
| services.lasuite-meet.settings | Configuration options of meet
|
| services.mediagoblin.settings | Settings which are written into mediagoblin.ini.
|
| services.zabbixProxy.database.name | Database name.
|
| services.hedgedoc.settings.urlPath | URL path for the website
|
| services.sourcehut.settings | The configuration for the sourcehut network.
|
| services.bitmagnet.settings | Bitmagnet configuration (https://bitmagnet.io/setup/configuration.html).
|
| services.tinyproxy.settings | Configuration for tinyproxy.
|
| services.pretix.settings.pretix.logdir | Directory for storing log files.
|
| services.transfer-sh.settings | Additional configuration for transfer-sh, see
https://github.com/dutchcoders/transfer.sh#usage-1
for supported values
|
| services.tor.settings.MainloopStats | See torrc manual.
|
| services.tor.settings.NewCircuitPeriod | See torrc manual.
|
| services.tor.settings.OfflineMasterKey | See torrc manual.
|
| services.snips-sh.settings | The configuration of snips-sh is done through environment variables,
therefore you must use upper snake case (e.g. SNIPS_HTTP_INTERNAL)
|
| services.nezha-agent.settings.uuid | Must be set to a unique identifier, preferably a UUID according to
RFC 4122
|
| services.librenms.settings | Attrset of the LibreNMS configuration
|
| services.gemstash.settings | Configuration for Gemstash
|
| boot.initrd.unl0kr.settings | Configuration for unl0kr
|
| services.keycloak.settings.http-port | On which port Keycloak should listen for new HTTP connections.
|
| services.hedgedoc.settings.path | Path to UNIX domain socket to listen on
If specified, host and port will be ignored.
|
| services.karma.settings.listen.address | Hostname or IP to listen on.
|
| services.selfoss.database.name | Name of the existing database (has no effect if type is "sqlite").
|
| services.sharkey.settings.address | The address that Sharkey binds to.
|
| services.sabnzbd.settings.servers | Usenet provider specification
|
| services.geth.<name>.http.apis | APIs to enable over WebSocket
|
| services.caddy.settings | Structured configuration for Caddy to generate a Caddy JSON configuration file
|
| services.aria2.settings.save-session | Save error/unfinished downloads to FILE on exit.
|
| services.gitlab.pages.settings.listen-http | The address(es) to listen on for HTTP requests.
|
| services.gancio.settings.server.socket | The unix socket for the gancio server to listen on.
|
| services.firefly-iii.settings | Options for firefly-iii configuration
|
| services.maubot.settings.admins | List of administrator users
|
| services.hatsu.settings.HATSU_LISTEN_PORT | Port where hatsu should listen for incoming requests.
|
| services.hatsu.settings.HATSU_LISTEN_HOST | Host where hatsu should listen for incoming requests.
|
| services.gitea.settings.server.SSH_PORT | SSH port displayed in clone URL
|
| services.waagent.settings.HttpProxy.Host | If you set http proxy, waagent will use is proxy to access the Internet.
|
| services.waagent.settings.HttpProxy.Port | If you set http proxy, waagent will use this proxy to access the Internet.
|
| services.openssh.settings.LogLevel | Gives the verbosity level that is used when logging messages from sshd(8)
|
| services.firezone.server.settings | Environment variables for the Firezone server
|
| services.tor.settings.ClientPreferIPv6ORPort | See torrc manual.
|
| services.umurmur.settings.ca_path | Path to your SSL CA certificate.
|
| services.hedgedoc.settings.db | Specify the configuration for sequelize
|
| services.kubo.settings.Mounts.FuseAllowOther | Allow all users to access the FUSE mount points
|
| services.kanidm.server.settings.origin | The origin of your Kanidm instance
|
| services.gitea-actions-runner.instances.<name>.name | The name identifying the runner instance towards the Gitea/Forgejo instance.
|
| services.mchprs.settings.address | Address for the server
|
| services.go2rtc.settings.streams | Stream source configuration
|
| services.glitchtip.settings | Configuration of GlitchTip
|
| services.supergfxd.settings | The content of /etc/supergfxd.conf
|
| services.rosenpass.settings | Configuration for Rosenpass, see https://rosenpass.eu/ for further information.
|
| services.mackerel-agent.settings | Options for mackerel-agent.conf
|
| services.manticore.settings | Configuration for Manticoresearch
|
| services.mosquitto.settings | Global configuration options for the mosquitto broker.
|
| services.pomerium.settings | The contents of Pomerium's config.yaml, in Nix expressions
|
| services.apache-kafka.settings."broker.id" | Broker ID. -1 or null to auto-allocate in zookeeper mode.
|
| services.scion.scion-control.settings | scion-control configuration
|
| services.gancio.settings.log_path | Directory Gancio logs into
|
| services.fediwall.settings.showMedia | Show media in posts
|
| services.navidrome.settings.Port | Port to run Navidrome on.
|
| services.tinyproxy.settings.Port | Specify which port to listen to.
|
| services.pinnwand.settings.footer | The footer in raw HTML.
|
| services.forgejo.settings.server.ROOT_URL | Full public URL of Forgejo server.
|
| services.slskd.settings.shares.filters | Regular expressions of files to exclude from sharing.
|
| services.canaille.settings.CANAILLE_OIDC | OpenID Connect settings
|
| services.ndppd.proxies.<name>.rules.<name>.network | This is the target address is to match against
|
| services.filebrowser.settings | Settings for FileBrowser
|
| services.frigate.settings.cameras | Attribute set of cameras configurations.
https://docs.frigate.video/configuration/cameras
|
| services.xonotic.settings.sv_motd | Text displayed when players join the server.
|
| services.acme-dns.settings.general.listen | IP+port combination to bind and serve the DNS server on.
|
| services.pretix.settings.celery.broker | URI to the celery broker used for the asynchronous job queue.
|
| services.aria2.settings.rpc-listen-port | Specify a port number for JSON-RPC/XML-RPC server to listen to
|
| services.firefox-syncserver.settings | Settings for the sync server
|
| services.etebase-server.settings | Configuration for etebase-server
|
| services.matrix-tuwunel.settings | Generates the tuwunel.toml configuration file
|
| services.slskd.settings.global.upload.slots | Limit of the number of concurrent upload slots.
|
| services.veilid.settings.logging.api.level | The minimum priority of api events to be logged.
|
| services.suricata.settings.app-layer | app-layer configuration, see upstream docs.
|
| services.openssh.settings.DenyUsers | If specified, login is denied for all listed users
|
| services.warpgate.settings.ssh.enable | Whether to enable SSH listener.
|
| services.warpgate.settings.ssh.listen | Listen endpoint of SSH listener.
|
| programs.yazi.settings.yazi | Configuration included in yazi.toml
|
| services.immich-public-proxy.settings | Configuration for IPP
|
| services.swapspace.settings | Config file for swapspace
|
| services.navidrome.settings | Configuration for Navidrome, see https://www.navidrome.org/docs/usage/configuration-options/ for supported values.
|
| services.nextcloud.settings | Extra options which should be appended to Nextcloud's config.php file.
|
| services.pgbouncer.settings | Configuration for PgBouncer, see https://www.pgbouncer.org/config.html
for supported values.
|
| services.part-db.settings.DATABASE_URL | The postgresql database server to connect to
|
| services.rkvm.server.settings.switch-keys | A key list specifying a host switch combination.
A list of key names is available in https://github.com/htrefil/rkvm/blob/master/switch-keys.md.
|
| services.kanboard.phpfpm.settings | Options for kanboard's PHPFPM pool.
|
| services.inadyn.settings.forced-update | Duration (in seconds) after which an update is forced.
|
| services.tor.settings.KeyDirectory | See torrc manual.
|
| services.tor.settings.ClientPreferIPv6DirPort | See torrc manual.
|
| services.tor.settings.ReducedExitPolicy | See torrc manual.
|
| services.gitea.settings.mailer.ENABLED | Whether to use an email service to send notifications.
|
| services.i2pd.inTunnels.<name>.port | Bind port for ‹name› endpoint.
|
| services.tsidp.settings.enableFunnel | Use Tailscale Funnel to make tsidp available on the public internet so it works with SaaS products.
|
| services.firefly-iii.settings.APP_URL | The APP_URL used by firefly-iii internally
|
| security.pam.u2f.settings.debug | Debug output to stderr.
|
| services.grafana.settings.smtp.enabled | Whether to enable SMTP.
|
| services.saunafs.master.settings.DATA_PATH | Data storage directory.
|
| users.users.<name>.home | The user's home directory.
|
| services.veilid.settings.core.network.upnp | Should the app try to improve its incoming network connectivity using UPnP?
|
| services.firezone.server.provision.accounts.<name>.relayGroups.<name>.name | The name of this relay group
|
| services.stash.settings.ui.frontPageContent | Search filters to display on the front page.
|
| services.openssh.settings.AllowUsers | If specified, login is allowed only for the listed users
|
| services.firewalld.settings | FirewallD config file
|
| services.moonraker.settings | Configuration for Moonraker
|
| services.mobilizon.settings | Mobilizon Elixir documentation, see
https://docs.joinmobilizon.org/administration/configure/reference/
for supported values.
|
| services.typesense.settings | Typesense configuration
|
| services.ente.api.settings.apps.public-albums | If you're running a self hosted instance and wish to serve public links,
set this to the URL where your albums web app is running.
|
| services.prowlarr.settings.server.port | Port Number
|
| services.pretix.settings.database.user | Database username.
|
| services.whisparr.settings.server.port | Port Number
|
| services.dsnet.settings.Networks | The CIDR networks that should route through this server
|
| services.geth.<name>.port | Port number Go Ethereum will be listening on, both TCP and UDP.
|
| services.livekit.ingress.settings | LiveKit Ingress configuration
|
| services.umami.settings.DATABASE_URL | Connection string for the database
|
| hardware.nfc-nci.settings | Configuration to be written to the libncf-nci configuration files
|
| programs.regreet.font.name | Name of the font to use for regreet.
|
| services.gitlab.pages.settings.pages-domain | The domain to serve static pages on.
|
| services.moosefs.master.settings.DATA_PATH | Directory for storing master metadata.
|
| services.frigate.settings.mqtt.enabled | Whether to enable MQTT support.
|
| services.traefik.static.settings | Static configuration for Traefik, written in Nix.
This will be serialized to JSON (which is considered valid YAML) at build, and passed to Traefik as --configfile.
|
| services.rspamd-trainer.settings | IMAP authentication configuration for rspamd-trainer
|
| services.peroxide.settings.UserPortImap | The port on which to listen for IMAP connections.
|
| services.peroxide.settings.UserPortSmtp | The port on which to listen for SMTP connections.
|
| services.tor.settings.ControlPortWriteToFile | See torrc manual.
|
| services.tor.settings.ServerDNSResolvConfFile | See torrc manual.
|
| services.tor.settings.DisableNetwork | See torrc manual.
|
| services.sympa.settingsFile | Set of files to be linked in /var/lib/sympa.
|
| services.libeufin.bank.settings | Configuration options for the libeufin bank system config file
|
| services.slskd.settings.web.https.disabled | Disable the built-in HTTPS server
|
| services.workout-tracker.settings | Extra config options.
|
| services.knot-resolver.settings | Nix-based (RFC 42) configuration for Knot Resolver
|
| services.nipap.settings.nipapd.db_host | PostgreSQL host to connect to
|
| services.geth.<name>.http.port | Port number of Go Ethereum HTTP API.
|
| services.paperless.exporter.settings | Settings to pass to the document exporter as CLI arguments.
|
| services.keycloak.settings.https-port | On which port Keycloak should listen for new HTTPS connections.
|
| services.gemstash.settings.db_url | The database to connect to when using postgres, mysql, or mysql2.
|
| services.h2o.hosts.<name>.acme | ACME options for virtual host.
|
| services.h2o.hosts.<name>.http | HTTP options for virtual host
|
| services.mediagoblin.paste.settings | Settings which are written into paste.ini.
|
| services.tuned.settings.sections | attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.autossh.sessions.*.name | Name of the local AutoSSH session
|
| services.meilisearch.settings | Configuration settings for Meilisearch
|
| services.bookstack.settings.DB_PORT | The port your database is listening at.
|
| services.gitlab.pages.settings.listen-https | The address(es) to listen on for HTTPS requests.
|
| services.amule.settings.WebServer.Enabled | Set to 1 to enable the web server
|
| services.gitlab.pages.settings.listen-proxy | The address(es) to listen on for proxy requests.
|
| services.factorio.game-name | Name of the game as it will appear in the game listing.
|
| services.i2pd.outTunnels.<name>.port | Bind port for ‹name› endpoint.
|
| services.bcg.rename | Rename nodes to different name.
|
| services.misskey.settings.chmodSocket | The file access mode of the UNIX socket.
|
| services.suricata.settings.af-packet | Linux high speed capture support.
|
| services.misskey.settings.redisForJobQueue.port | The Redis port.
|
| services.misskey.settings.redisForJobQueue.host | The Redis host.
|
| services.prowlarr.settings | Attribute set of arbitrary config options
|
| services.whisparr.settings | Attribute set of arbitrary config options
|
| services.pds.settings.PDS_REPORT_SERVICE_DID | DID of mod service
|
| services.bluesky-pds.settings.PDS_BSKY_APP_VIEW_DID | DID of bsky frontend
|
| services.go-csp-collector.settings.port | The port to listen on.
|
| services.minidlna.settings.db_dir | Specify the directory to store database and album art cache.
|
| services.gitea.settings.server.DISABLE_SSH | Disable external SSH feature.
|
| services.pretix.settings.database.host | Database host or socket path.
|
| services.warpgate.settings.http.listen | Listen endpoint of HTTP listener.
|
| services.create_ap.settings | Configuration for create_ap
|
| services.watchdogd.settings | Configuration to put in watchdogd.conf
|
| services.waagent.settings.OS.EnableRDMA | If enabled, the agent attempts to install and then load an RDMA kernel driver
that matches the version of the firmware on the underlying hardware.
|
| services.transmission.settings | Settings whose options overwrite fields in
.config/transmission-daemon/settings.json
(each time the service starts)
|
| services.biboumi.settings.ca_file | Specifies which file should be used as the list of trusted CA
when negotiating a TLS session.
|
| services.forgejo.settings.server.HTTP_PORT | Listen port
|
| services.scrutiny.settings.web.listen.port | Port for web application to listen on.
|
| services.bookstack.settings.DB_HOST | The IP or hostname which hosts your database.
|
| services.anuko-time-tracker.settings.helpLink | Help link from the main menu.
|
| services.tor.settings.DownloadExtraInfo | See torrc manual.
|
| services.tor.settings.DataDirectory | See torrc manual.
|
| services.tor.settings.BandwidthRate | See torrc manual.
|
| services.postfix-tlspol.settings | The postfix-tlspol configuration file as a Nix attribute set
|
| services.sourcehut.settings.mail.pgp-key-id | OpenPGP key identifier.
|
| services.headscale.settings.log.level | headscale log level.
|
| services.kanidm.server.settings.db_path | Path to Kanidm database.
|
| services.evremap.settings.remap.*.input | The key sequence that should be remapped
|
| services.stalwart-mail.settings | Configuration options for the Stalwart email server
|
| services.sftpgo.settings.ftpd.bindings | Configure listen addresses and ports for ftpd.
|
| services.tlsrpt.collectd.settings | Flags from tlsrpt-collectd(1) as key-value pairs.
|
| services.cross-seed.settings.torrentDir | Directory containing torrent files, or if you're using a torrent
client integration and injection - your torrent client's .torrent
file store/cache.
|
| services.pds.settings.PDS_REPORT_SERVICE_URL | URL of mod service
|
| services.bluesky-pds.settings.PDS_BSKY_APP_VIEW_URL | URL of bsky frontend
|
| services.lldap.settings.ldap_port | The port on which to have the LDAP server.
|
| services.stash.settings.generated | Path to generated files
|
| services.dnscrypt-proxy.settings | Attrset that is converted and passed as TOML config file
|
| services.dolibarr.database.name | Database name.
|
| services.castopod.database.name | Database name.
|
| services.agorakit.database.name | Database name.
|
| services.mastodon.database.name | Database name.
|
| services.peertube.database.name | Database name.
|
| services.pixelfed.database.name | Database name.
|
| services.windmill.database.name | Database name.
|
| services.zabbixServer.database.name | Database name.
|
| power.ups.ups.<name>.port | The serial port to which your UPS is connected. /dev/ttyS0 is
usually the first port on Linux boxes, for example.
|
| services.scrutiny.settings.web.listen.host | Interface address for web application to bind to.
|
| services.forgejo.settings.server.HTTP_ADDR | Listen address
|
| services.taler.settings.taler.CURRENCY | The currency which taler services will operate with
|
| services.lemmy.settings.captcha.enabled | Enable Captcha.
|
| services.opengfw.settings.ruleset.geoip | Path to geoip.dat.
|
| services.chhoto-url.settings.site_url | The URL under which Chhoto URL is externally reachable.
|
| services.mx-puppet-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.open-web-calendar.settings | Configuration for the server
|
| services.cgit.<name>.group | Group to run the cgit service as.
|
| services.firefly-iii.settings.DB_HOST | The machine which hosts your database
|
| services.homepage-dashboard.settings | Homepage settings
|
| services.kanidm.server.settings.tls_key | TLS key in pem format.
|
| services.fediwall.settings.hideBoosts | Hide boosts
|
| services.bluesky-pds.settings.LOG_ENABLED | Enable logging
|
| services.openssh.settings.StrictModes | Whether sshd should check file modes and ownership of directories
|
| services.matrix-synapse.settings | The primary synapse configuration
|
| services.smartdns.settings | A set that will be generated into configuration file, see the SmartDNS README for details of configuration parameters
|
| services.cryptpad.settings.adminKeys | List of public signing keys of users that can access the admin panel
|
| services.tor.settings.TestingTorNetwork | See torrc manual.
|
| services.tor.settings.LogMessageDomains | See torrc manual.
|
| services.tor.settings.RefuseUnknownExits | See torrc manual.
|
| services.rosenpass.settings.peers | List of peers to exchange keys with.
|
| services.h2o.hosts.<name>.tls.port | Override the default TLS port for this virtual host.
|
| services.dawarich.database.name | The name of the dawarich database.
|
| services.cloudlog.database.name | MySQL database name.
|
| services.freshrss.database.name | Database name for FreshRSS.
|
| services.acme-dns.settings.database.engine | Database engine to use.
|
| boot.zfs.pools.<name>.devNodes | Name of directory from which to import ZFS device, this is passed to zpool import
as the value of the -d option
|
| users.users.<name>.uid | The account UID
|
| services.acme-dns.settings.general.nsadmin | Zone admin email address for SOA.
|
| nix.settings.extra-sandbox-paths | Directories from the host filesystem to be included
in the sandbox.
|
| services.armagetronad.servers.<name>.name | The name of this server.
|
| services.displayManager.gdm.settings | Options passed to the gdm daemon
|
| services.misskey.settings.redisForJobQueue | ioredis options for the job queue
|
| services.fediwall.settings.loadPublic | Load public posts
|
| services.fediwall.settings.playVideos | Autoplay videos in posts
|
| services.fediwall.settings.loadTrends | Load trending posts
|
| services.libeufin.nexus.settings | Configuration options for the libeufin nexus config file
|
| services.taler.exchange.settings | Configuration options for the taler exchange config file
|
| services.taler.merchant.settings | Configuration options for the taler merchant config file
|
| services.hedgedoc.settings.domain | Domain to use for website
|
| services.journald.upload.settings | Configuration for journal-upload
|
| services.suricata.settings.rule-files | Files to load suricata-update managed rules, relative to 'default-rule-path'.
|
| services.misskey.settings.redisForPubsub.port | The Redis port.
|
| services.misskey.settings.redisForPubsub.host | The Redis host.
|
| services.wyoming.satellite.name | Name of the satellite.
|
| services.gnome.gnome-settings-daemon.enable | Whether to enable GNOME Settings Daemon.
|
| services.stash.settings.nobrowser | If we should not auto-open a browser window on startup
|
| services.headscale.settings | Overrides to config.yaml as a Nix attribute set
|
| services.hedgedoc.settings.useSSL | Enable to use SSL server.
|
| hardware.amdgpu.amdvlk.settings | Runtime settings for AMDVLK to be configured /etc/amd/amdVulkanSettings.cfg
|
| nix.settings | Configuration for Nix, see
https://nixos.org/manual/nix/stable/command-ref/conf-file.html or
nix.conf(5) for available options
|
| services.anuko-time-tracker.settings.email.mode | Mail sending mode
|
| services.pretix.settings.pretix.datadir | Directory for storing user uploads and similar data.
|
| programs.yazi.settings.theme | Configuration included in theme.toml
|
| services.matrix-synapse.settings.redis | Redis configuration for synapse
|
| services.rauc.slots.<name>.*.type | The type of the device.
|
| services.zram-generator.settings | Configuration for zram-generator,
see https://github.com/systemd/zram-generator for documentation.
|
| services.samba.settings.global.security | Samba security type.
|
| services.lldap.settings.ldap_host | The host address that the LDAP server will be bound to.
|
| services.lldap.settings.http_host | The host address that the HTTP server will be bound to.
|
| services.lldap.settings.http_port | The port on which to have the HTTP server, for user login and administration.
|
| services.pretalx.settings.redis.session | Whether to use redis as the session storage.
|
| services.imaginary.settings | Command line arguments passed to the imaginary executable, stripped of
the prefix -
|
| services.crowdsec.settings.console | Console Configuration attributes
|
| services.fediwall.settings.servers | Servers to load posts from
|
| services.quickwit.settings.version | Configuration file version.
|
| services.umurmur.settings.channels | Channel tree definitions.
|
| services.pretalx.settings.celery.broker | URI to the celery broker used for the asynchronous job queue.
|
| services.pretix.settings.celery.backend | URI to the celery backend used for the asynchronous job queue.
|
| services.neard.settings.General.ResetOnError | Power cycle the adapter when getting a driver error from the kernel.
|
| services.draupnir.settings.dataPath | The path Draupnir will store its state/data in.
This option is read-only.
If you want to customize where this data is stored, use a bind mount.
|
| services.sourcehut.settings.mail.smtp-from | Outgoing SMTP FROM.
|
| services.blackfire-agent.settings | See https://blackfire.io/docs/up-and-running/configuration/agent
|
| services.kea.dhcp6.configFile | Kea DHCP6 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html
|
| services.kea.dhcp4.configFile | Kea DHCP4 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html
|
| services.cgit.<name>.scanPath | A path which will be scanned for repositories.
|
| services.gitlab.pages.settings.gitlab-server | Public GitLab server URL.
|
| services.legit.settings.dirs.templates | Directories where template files are located.
|
| services.gitea.settings.mailer.PROTOCOL | Which mail server protocol to use.
|
| services.headscale.settings.oidc.scope | Scopes used in the OIDC flow.
|
| services.misskey.settings.db.disableCache | Whether to disable caching queries.
|
| services.warpgate.settings.mysql.enable | Whether to enable MySQL listener.
|
| services.warpgate.settings.mysql.listen | Listen endpoint of MySQL listener.
|
| services.journald.remote.settings | Configuration in the journal-remote configuration file
|
| services.zammad.database.settings | The database.yml configuration file as key value set
|
| services.suwayomi-server.settings | Configuration to write to server.conf
|
| security.please.settings | Please configuration
|
| services.nylon.<name>.port | What port to listen for client requests, default is 1080.
|
| services.canaille.settings.SECRET_KEY | Flask Secret Key
|
| services.misskey.settings.redisForPubsub | ioredis options for pubsub
|
| services.pgbouncer.settings.users | Optional
|
| services.pgbouncer.settings.peers | Optional
|
| services.gitea.settings.server.STATIC_ROOT_PATH | Upper level of template and static files path.
|
| services.livekit.settings.redis.address | Host and port used to connect to a redis instance.
|
| services.opengfw.settings.workers.count | Number of workers
|
| services.influxdb2.settings | configuration options for influxdb2, see https://docs.influxdata.com/influxdb/v2.0/reference/config-options for details.
|
| services.openssh.settings.DenyGroups | If specified, login is denied for all users part of the listed
groups
|
| services.opengfw.rules.*.modifier.name | Name of the modifier.
|
| services.peering-manager.settings | Configuration options to set in configuration.py
|
| services.anuko-time-tracker.settings.forumLink | Forum link from the main menu.
|
| services.tor.settings.BandwidthBurst | See torrc manual.
|
| services.tsidp.settings.debugAllRequests | For development
|
| services.tor.settings.CacheDirectory | See torrc manual.
|
| services.umurmur.settings.bindport | Port to bind to (UDP and TCP).
|
| services.openbao.settings.listener | Configure a listener for responding to requests.
|
| services.sourcehut.settings.mail.smtp-port | Outgoing SMTP port.
|
| services.sourcehut.settings.mail.smtp-host | Outgoing SMTP host.
|
| services.sourcehut.settings.mail.smtp-user | Outgoing SMTP user.
|
| services.nvme-rs.settings.email.smtp_port | SMTP server port
|
| services.rkvm.client.settings.password | Shared secret token to authenticate the client
|
| services.rkvm.server.settings.password | Shared secret token to authenticate the client
|
| services.kubo.settings.Addresses.Swarm | Where Kubo listens for incoming p2p connections
|
| services.sftpgo.settings.httpd.bindings | Configure listen addresses and ports for httpd.
|
| services.pretix.settings.redis.sessions | Whether to use redis as the session storage.
|
| services.sftpgo.settings.sftpd.bindings | Configure listen addresses and ports for sftpd.
|
| services.suricata.settings.stats.enable | Whether to enable suricata global stats.
|
| services.maubot.settings.database | The full URI to the database
|
| services.rsyncd.settings.sections | attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.cryptpad.settings.logToStdout | Controls whether log output should go to stdout of the systemd service
|
| services.pds.settings.PDS_DATA_DIRECTORY | Directory to store state
|
| services.lasuite-meet.settings.DJANGO_DATA_DIR | Path to the data directory
|
| services.peertube-runner.settings | Configuration for peertube-runner
|
| services.grafana.settings.paths.plugins | Directory where grafana will automatically scan and look for plugins
|
| programs.regreet.theme.name | Name of the theme to use for regreet.
|
| services.anuko-time-tracker.settings.email.smtpHost | MTA hostname.
|
| services.grafana.settings.database.type | Database type.
|
| services.anuko-time-tracker.settings.email.smtpPort | MTA port.
|
| services.pretalx.settings.database.user | Database username.
|
| services.acme-dns.settings.general.records | Predefined DNS records served in addition to the _acme-challenge TXT records.
|
| programs.foot.settings | Configuration for foot terminal emulator
|
| programs.htop.settings | Extra global default configuration for htop
which is read on first startup only
|
| services.gitwatch.<name>.user | The name of services's user
|
| services.freeciv.settings.quitidle | Quit if no players for given time in seconds.
|
| services.freeciv.settings.Database | Enable database connection with given configuration.
|
| services.umurmur.settings.password | Required password to join server, if specified.
|
| services.postsrsd.settings.domains | List of local domains, that do not require rewriting.
|
| services.firezone.server.provision.accounts.<name>.gatewayGroups.<name>.name | The name of this gateway group
|
| services.sourcehut.settings.mail.error-to | Address receiving application exceptions
|
| services.suricata.settings.vars.port-groups | The port group variables for suricata.
|
| services.openssh.settings.AcceptEnv | Specifies what environment variables sent by the client will be copied into the session's
environment
|
| services.opensearch.settings | OpenSearch configuration.
|
| services.wgautomesh.settings | Configuration for wgautomesh.
|
| services.tuned.settings.globalSection | global section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.openssh.settings.AllowGroups | If specified, login is allowed only for users part of the
listed groups
|
| services.firefly-iii.settings.APP_KEY_FILE | The path to your appkey
|
| programs.direnv.settings | Direnv configuration
|
| services.hatsu.settings.HATSU_DATABASE_URL | Database URL.
|
| services.public-inbox.settings.coderepo | code repositories
|
| services.gitea.settings.server.PROTOCOL | Listen protocol. +unix means "over unix", not "in addition to."
|
| services.tor.settings.ShutdownWaitLength | See torrc manual.
|
| services.anuko-time-tracker.settings.email.smtpAuth | MTA requires authentication.
|
| services.anuko-time-tracker.settings.email.smtpUser | MTA authentication username.
|
| services.headscale.settings.log.format | headscale log format.
|
| services.headscale.settings.dns.split | Split DNS configuration (map of domains and which DNS server to use for each)
|
| services.nsd.zones.<name>.requestXFR | Format: [AXFR|UDP] <ip-address> <key-name | NOKEY>
|
| services.freeciv.settings.Announce | Announce game in LAN using given protocol.
|
| services.umurmur.settings.bindaddr | IPv4 address to bind to
|
| services.headscale.settings.derp.urls | List of urls containing DERP maps
|
| services.suricata.settings.stats | Engine statistics such as packet counters, memory use counters and others can be logged in several ways
|
| services.wastebin.settings.RUST_LOG | Influences logging
|
| services.amule.settings.eMule.IncomingDir | Directory where aMule moves completed downloads
|
| services.lokinet.settings.network.exit | Whether to act as an exit node
|
| users.users.<name>.homeMode | The user's home directory mode in numeric format
|
| services.litestream.settings | See the documentation.
|
| services.rebuilderd.settings | Configuration for rebuilderd (rebuilderd.conf)
|
| services.resolved.settings.Resolve.DNS | List of IP addresses to query as recursive DNS resolvers.
|
| services.gancio.settings.log_level | Gancio log level.
|
| services.hedgedoc.settings.allowOrigin | List of domains to whitelist.
|
| services.tinyproxy.settings.Listen | Specify which address to listen to.
|
| services.mchprs.settings.schemati | Mimic the verification and directory layout used by the
Open Redstone Engineers
Schemati plugin
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.name | The name of this resource
|
| services.postgrest.settings.db-uri | libpq connection parameters as documented in:
https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
The settings.db-uri.password and settings.db-uri.passfile options are blocked
|
| services.opengfw.settings.ruleset | The path to load specific local geoip/geosite db files
|
| services.h2o.hosts.<name>.http.port | Override the default HTTP port for this virtual host.
|
| services.h2o.hosts.<name>.host | Set the host address for this virtual host
|
| programs.gamemode.settings | System-wide configuration for GameMode (/etc/gamemode.ini)
|
| services.suricata.settings.vars.address-groups | The address group variables for suricata, if not defined the
default value of suricata (see example) will be used
|
| services.grafana.settings.database.user | The database user (not applicable for sqlite3).
|
| services.grafana.settings.smtp.key_file | File path to a key file.
|
| services.sabnzbd.settings.misc.email_to | Receiving address for email alerts
|
| services.pretalx.settings.database.host | Database host or socket path.
|
| services.parsedmarc.settings.smtp.to | The addresses to send outgoing mail to.
|
| services.frigate.settings.database.path | Path to the SQLite database used
|
| networking.nftables.tables.<name>.name | Table name.
|
| services.scanservjs.settings.host | The IP to listen on.
|
| services.scanservjs.settings.port | The port to listen on.
|
| services.freeciv.settings.Newusers | Whether to enable new users to login if auth is enabled.
|
| services.aesmd.settings.whitelistUrl | URL to retrieve authorized Intel SGX enclave signers.
|
| services.suricata.settings.plugins | Plugins -- Experimental -- specify the filename for each plugin shared object.
|
| services.openssh.settings.PermitRootLogin | Whether the root user can login using ssh.
|
| security.pam.u2f.settings | Options to pass to the PAM module
|
| services.grafana.settings.database.wal | For sqlite3 only
|
| services.corosync.nodelist.*.name | Node name
|
| services.tor.settings.FascistFirewall | See torrc manual.
|
| services.yggdrasil.settings | Configuration for yggdrasil, as a structured Nix attribute set
|
| services.opengfw.settings.workers.queueSize | Worker queue size.
|
| services.scanservjs.settings | Config to set in config.local.js's afterConfig.
|
| services.reposilite.settings | Configuration written to the reposilite.cdn file
|
| services.dnsmasq.settings | Configuration of dnsmasq
|
| services.traccar.settings | config.xml configuration as a Nix attribute set
|
| security.krb5.settings | Structured contents of the krb5.conf file
|
| boot.iscsi-initiator.name | Name of the iSCSI initiator to boot from
|
| services.grafana.settings.server.socket | Path where the socket should be created when protocol=socket
|
| services.sourcehut.settings."sr.ht".site-info | The top-level info page for your site.
|
| services.matrix-hookshot.settings | config.yml configuration as a Nix attribute set
|
| services.minidlna.settings.inotify | Whether to enable inotify monitoring to automatically discover new files.
|
| services.cryptpad.settings.httpSafeOrigin | Cryptpad sandbox URL
|
| services.reposilite.settings.port | The TCP port to bind to.
|
| services.postgresql.settings.port | The port on which PostgreSQL listens.
|
| services.waagent.settings.Logs.Verbose | If you set this option, log verbosity is boosted
|
| services.mautrix-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.pretix.settings.redis.location | URI to the redis server, used to speed up locking, caching and session storage.
|
| services.warpgate.settings.log.send_to | Path of UNIX socket of log forwarder
|
| services.forgejo.settings.server.SSH_PORT | SSH port displayed in clone URL
|
| services.sourcehut.settings."hg.sr.ht".origin | URL hg.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."hg.sr.ht".hg_ssh | Path to hg-ssh (if not in $PATH).
|
| services.sourcehut.settings."hg.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."hg.sr.ht".debug-port | Port to bind the debug server to.
|
| services.snapserver.settings.tcp.port | Port to listen on for snapclient connections.
|
| services.tlsrpt.fetcher.settings.storage | Path to the collectd sqlite database.
|
| services.matrix-conduit.settings | Generates the conduit.toml configuration file
|
| services.rosenpass.settings.listen | List of local endpoints to listen for connections.
|
| services.umami.settings.DISABLE_UPDATES | Disables the check for new versions of Umami.
|
| services.broadcast-box.settings | Attribute set of environment variables.
https://github.com/Glimesh/broadcast-box#environment-variables
The status API exposes stream keys so DISABLE_STATUS is enabled
by default.
|
| services.epgstation.settings | Options to add to config.yml
|
| hardware.deviceTree.name | The name of an explicit dtb to be loaded, relative to the dtb base
|
| security.auditd.settings | auditd configuration file contents
|
| services.fediwall.settings.hideReplies | Hide replies
|
| services.dsnet.settings.ExternalIP | The external IP address of the server
|
| services.routinator.settings.log | A string specifying where to send log messages to
|
| services.hickory-dns.settings.zones.*.file | Path to the .zone file
|
| services.journalbeat.name | Name of the beat
|
| services.firezone.server.provision.accounts.<name>.name | The account name
|
| services.netbox.settings.ALLOWED_HOSTS | A list of valid fully-qualified domain names (FQDNs) and/or IP
addresses that can be used to reach the NetBox service.
|
| services.tahoe.nodes.<name>.nickname | The nickname of this Tahoe node.
|
| services.headscale.settings.oidc.issuer | URL to OpenID issuer.
|
| services.c2fmzq-server.settings.verbose | The level of logging verbosity: 1:Error 2:Info 3:Debug
|
| services.evremap.settings.remap.*.output | The key sequence that should be output when the input sequence is entered
|
| services.grafana-to-ntfy.settings.ntfyBAuthPass | The path to the password for the specified ntfy-sh user
|
| services.epgstation.settings.port | HTTP port for EPGStation to listen on.
|
| services.tor.settings.VirtualAddrNetworkIPv4 | See torrc manual.
|
| services.tor.settings.VirtualAddrNetworkIPv6 | See torrc manual.
|
| services.snips-sh.settings.SNIPS_SSH_INTERNAL | The internal SSH address of the service
|
| services.tor.settings.AccountingMax | See torrc manual.
|
| services.veilid.settings.logging.api.enabled | Events of type 'api' will be logged.
|
| services.veilid.settings.logging.system.level | The minimum priority of system events to be logged.
|
| services.anuko-time-tracker.database.name | Database name.
|
| services.parsedmarc.settings.smtp.ssl | Use an encrypted SSL/TLS connection.
|
| services.parsedmarc.settings.imap.ssl | Use an encrypted SSL/TLS connection.
|
| services.gateone.settingsDir | Path of configuration files for GateOne.
|
| services.yggdrasil.settings.Peers | List of outbound peer connection strings
|
| services.metricbeat.settings | Configuration for metricbeat
|
| services.routinator.settings | Configuration for Routinator 3000, see https://routinator.docs.nlnetlabs.nl/en/stable/manual-page.html#configuration-file for options.
|
| services.sourcehut.settings."sr.ht".site-blurb | Blurb for your site.
|
| services.lasuite-meet.settings.LIVEKIT_API_URL | URL to the livekit server
|
| services.wg-access-server.settings.storage | A storage backend connection string
|
| services.postsrsd.settings.chroot-dir | Path to chroot into at runtime as an additional layer of protection.
We confine the runtime environment through systemd hardening instead, so this option is read-only.
|
| services.sourcehut.settings.mail.error-from | Address sending application exceptions
|
| services.sourcehut.settings."hub.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."man.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."git.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."man.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."git.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."man.sr.ht".origin | URL man.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."hub.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."git.sr.ht".origin | URL git.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."hub.sr.ht".origin | URL hub.sr.ht is being served at (protocol://domain)
|
| services.acme-dns.settings.general.protocol | Protocols to serve DNS responses on.
|
| services.pretix.settings.pretix.cachedir | Directory for storing temporary files.
|
| services.lokinet.settings.dns.upstream | Upstream resolver(s) to use as fallback for non-loki addresses
|
| services.libeufin.nexus.settings.nexus-ebics.BIC | BIC of the bank account that is associated with the EBICS subscriber.
|
| services.sourcehut.settings."hg.sr.ht".repos | Path to mercurial repositories on disk
|
| services.bluesky-pds.settings.PDS_CRAWLERS | URL of crawlers
|
| services.zipline.settings.CORE_HOSTNAME | The hostname to listen on.
|
| services.cryptpad.settings.maxWorkers | Number of child processes, defaults to number of cores available
|
| services.meshcentral.settings | Settings for MeshCentral
|
| services.grafana.settings.database.path | Only applicable to sqlite3 database
|
| <imports = [ pkgs.php.services.default ]>.php-fpm.settings | PHP FPM configuration
|
| services.actual.settings.serverFiles | The server will put an account.sqlite file in this directory, which will contain the (hashed) server password, a list of all the budget files the server knows about, and the active session token (along with anything else the server may want to store in the future).
|
| services.anuko-time-tracker.settings.email.smtpDebug | Debug mail sending.
|
| services.anuko-time-tracker.settings.email.sender | Default sender for mail.
|
| services.parsedmarc.settings.imap.port | The IMAP server port.
|
| services.parsedmarc.settings.smtp.user | The SMTP server username.
|
| services.parsedmarc.settings.smtp.port | The SMTP server port.
|
| services.omnom.settings.db.connection | Database connection URI.
|
| services.parsedmarc.settings.imap.user | The IMAP server username.
|
| services.lubelogger.settings | Additional configuration for LubeLogger, see https://docs.lubelogger.com/Environment%20Variables for supported values.
|
| services.photoprism.settings | See the getting-started guide for available options.
|
| services.hedgedoc.settings.uploadsPath | Directory for storing uploaded images.
|
| services.cryptpad.settings.httpAddress | Address on which the Node.js server should listen
|
| services.tor.settings.AssumeReachable | See torrc manual.
|
| services.tor.settings.ServerDNSSearchDomains | See torrc manual.
|
| services.tor.settings.WarnPlaintextPorts | See torrc manual.
|
| services.nvme-rs.settings.thresholds | Threshold configuration for NVMe monitoring
|
| services.tor.settings.RelayBandwidthRate | See torrc manual.
|
| services.tor.settings.UnixSocksGroupWritable | See torrc manual.
|
| services.tor.settings.AutomapHostsOnResolve | See torrc manual.
|
| services.tor.settings.DormantOnFirstStartup | See torrc manual.
|
| services.nsd.zones.<name>.data | The actual zone data
|
| services.bookstack.settings.APP_URL | The root URL that you want to host BookStack on
|
| services.grafana-to-ntfy.settings.ntfyBAuthUser | The ntfy-sh user to use for authenticating with the ntfy-sh instance
|
| services.librechat.settings | A free-form attribute set that will be written to librechat.yaml
|
| users.users.<name>.group | The user's primary group.
|
| services.metricbeat.settings.tags | Tags to place on the shipped metrics
|
| services.pretalx.settings.celery.backend | URI to the celery backend used for the asynchronous job queue.
|
| services.prometheus.exporters.nginxlog.settings | All settings of nginxlog expressed as an Nix attrset
|
| services.i2pd.inTunnels.<name>.enable | Whether to enable ‹name›.
|
| programs.yazi.settings.keymap | Configuration included in keymap.toml
|
| services.go-autoconfig.settings | Configuration for go-autoconfig
|
| services.mosquitto.listeners.*.settings | Additional settings for this listener.
|
| services.aesmd.settings.defaultQuotingType | Attestation quote type.
|
| services.libeufin.nexus.settings.nexus-httpd.PORT | The port on which libeufin-bank should listen.
|
| services.mympd.settings.http_port | The HTTP port where mympd's web interface will be available
|
| services.gitea.settings.mailer.SENDMAIL_PATH | Path to sendmail binary or script.
|
| services.grafana.settings.smtp.startTLS_policy | StartTLS policy when connecting to server.
|
| services.suwayomi-server.settings.server.ip | The ip that Suwayomi will bind to.
|
| services.snapserver.settings.http.port | Port to listen on for snapclient connections.
|
| services.parsedmarc.settings.smtp.from | The From address to use for the
outgoing mail.
|
| services.filesender.settings | Configuration options used by FileSender
|
| services.homebridge.settings | Configuration options for homebridge
|
| services.snapserver.settings | Snapserver configuration
|
| services.privatebin.settings | Options for privatebin configuration
|
| services.mattermost.settings | Additional configuration options as Nix attribute set in config.json schema.
|
| services.sourcehut.settings."git.sr.ht".repos | Path to git repositories on disk
|
| services.headscale.settings.derp.paths | List of file paths containing DERP maps
|
| services.cgit.<name>.enable | Whether to enable cgit.
|
| services.rsyncd.settings.globalSection | global section of an INI file (attrs of INI atom (null, bool, int, float or string))
|
| services.shairport-sync.settings | Configuration options for Shairport-Sync
|
| services.c2fmzq-server.settings.database | Path of the database
|
| services.stash.settings.blobs_path | Path to blobs
|
| services.samba.settings.global."invalid users" | List of users who are denied to login via Samba.
|
| services.sourcehut.settings.mail.pgp-pubkey | OpenPGP public key.
|
| services.libeufin.nexus.settings.nexus-ebics.NAME | Legal entity that is associated with the EBICS subscriber.
|
| services.slskd.settings.global.download.slots | Limit of the number of concurrent download slots.
|
| services.rosenpass.settings.peers.*.peer | WireGuard public key corresponding to the remote Rosenpass peer.
|
| services.tor.settings.CellStatistics | See torrc manual.
|
| services.snips-sh.settings.SNIPS_HTTP_INTERNAL | The internal HTTP address of the service
|
| services.tor.settings.OptimisticData | See torrc manual.
|
| services.tor.settings.DirReqStatistics | See torrc manual.
|
| services.sourcehut.settings."lists.sr.ht".redis | The Redis connection used for the Celery worker.
|
| services.etebase-server.settings.global.debug | Whether to set django's DEBUG flag.
|
| services.parsedmarc.settings.imap.host | The IMAP server hostname or IP address.
|
| services.parsedmarc.settings.smtp.host | The SMTP server hostname or IP address.
|
| services.tts.servers.<name>.model | Name of the model to download and use for speech synthesis
|
| services.lokinet.settings.network.exit-node | Specify a .loki address and an optional ip range to use as an exit broker
|
| services.bacula-sd.device.<name>.archiveDevice | The specified name-string gives the system file name of the storage
device managed by this storage daemon
|
| services.sftpgo.settings.smtp.auth_type |
0: Plain
1: Login
2: CRAM-MD5
|
| services.opensnitch.settings | opensnitchd configuration
|
| services.x2goserver.settings | x2goserver.conf ini configuration as nix attributes
|
| services.postfix-tlspol.settings.server.log-level | Log level
|
| services.garage.settings.data_dir | The directory in which Garage will store the data blocks of objects
|
| services.scrutiny.settings.web.influxdb.org | InfluxDB organisation under which to store data.
|
| services.gitlab.pages.settings | Configuration options to set in the GitLab Pages config
file
|
| services.grocy.settings.calendar.firstDayOfWeek | Which day of the week (0=Sunday, 1=Monday etc.) should be the
first day.
|
| services.cgit.<name>.nginx.virtualHost | VirtualHost to serve cgit on, defaults to the attribute name.
|
| services.wgautomesh.settings.peers | wgautomesh peer list.
|
| services.kavita.settings.IpAddresses | IP Addresses to bind to
|
| security.krb5.settings.module | Modules to obtain Kerberos configuration from.
|
| services.bookstack.database.name | Database name.
|
| services.mediawiki.database.name | Database name.
|
| services.dsnet.settings.ExternalIP6 | The external IPv6 address of the server
|
| services.suricata.settings.host-mode | If the Suricata box is a router for the sniffed networks, set it to 'router'
|
| services.sourcehut.settings."todo.sr.ht".origin | URL todo.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."meta.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."todo.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."meta.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."todo.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."meta.sr.ht".origin | URL meta.sr.ht is being served at (protocol://domain)
|
| services.forgejo.settings.server.DISABLE_SSH | Disable external SSH feature.
|
| services.libeufin.nexus.settings.nexus-ebics.IBAN | IBAN of the bank account that is associated with the EBICS subscriber.
|
| services.amule.settings.WebServer.Password | MD5 hash of the password, obtainaible with echo "<password>" | md5sum | cut -d ' ' -f 1
|
| services.privoxy.settings.listen-address | Pair of address:port the proxy server is listening to.
|
| services.sftpgo.settings.ftpd.bindings.*.port | The port for serving FTP requests
|
| services.geth.<name>.gcmode | Blockchain garbage collection mode.
|
| services.uhub.<name>.enable | Whether to enable hub instance.
|
| services.pretix.settings.pretix.currency | Default currency for events in its ISO 4217 three-letter code.
|
| services.i2pd.outTunnels.<name>.enable | Whether to enable ‹name›.
|
| services.autotierfs.settings | The contents of the configuration file for autotier
|
| services.opencloud.settings | Additional YAML configuration for OpenCloud services
|
| services.invoiceplane.sites.<name>.database.name | Database name.
|
| services.tor.settings.ServerDNSAllowBrokenConfig | See torrc manual.
|
| services.tor.settings.ExitPolicyRejectPrivate | See torrc manual.
|
| services.watchdogd.settings.safe-exit | With safeExit enabled, the daemon will ask the driver to disable the WDT before exiting
|
| services.typesense.settings.server.api-port | Port on which the Typesense API service listens.
|
| services.warpgate.settings.postgres.key | Path to PostgreSQL listener private key.
|
| services.languagetool.settings | Configuration file options for LanguageTool, see
'languagetool-http-server --help'
for supported settings.
|
| services.kanidm.server.settings.domain | The domain that Kanidm manages
|
| services.discourse.database.name | Discourse database name.
|
| services.radicle.ci.broker.settings.triggers | CI triggers.
|
| services.bind.zones.<name>.file | Zone file resource records contain columns of data, separated by whitespace, that define the record.
|
| services.opengfw.settings.ruleset.geosite | Path to geosite.dat.
|
| services.h2o.hosts.<name>.acme.root | Directory for the ACME challenge, which is public
|
| services.openssh.settings.GatewayPorts | Specifies whether remote hosts are allowed to connect to
ports forwarded for the client
|
| services.headscale.settings.policy.mode | The mode can be "file" or "database" that defines
where the ACL policies are stored and read from.
|
| services.headscale.settings.policy.path | If the mode is set to "file", the path to a
HuJSON file containing ACL policies.
|
| services.hans.clients | Each attribute of this option defines a systemd service that
runs hans
|
| services.umami.settings.APP_SECRET_FILE | A file containing a secure random string
|
| services.sourcehut.settings."sr.ht".owner-email | Owner's email.
|
| services.navidrome.settings.Address | Address to run Navidrome on.
|
| services.pid-fan-controller.settings.fans | List of fans to be controlled.
|
| services.watchdogd.settings.timeout | The WDT timeout before reset.
|
| services.h2o.hosts.<name>.tls.quic | Enables HTTP/3 over QUIC on the UDP port for TLS
|
| services.yggdrasil-jumper.settings | Configuration for Yggdrasil Jumper as a Nix attribute set.
|
| services.reaction.settingsFiles | Configuration for reaction, see the wiki.
reaction supports JSON, YAML and JSONnet
|
| services.postgrest.settings | PostgREST configuration as documented in:
https://docs.postgrest.org/en/stable/references/configuration.html#list-of-parameters
db-uri is represented as an attribute set, see settings.db-uri
The settings.jwt-secret option is blocked
|
| services.centrifugo.settings | Declarative Centrifugo configuration
|
| services.typesense.settings.server.data-dir | Path to the directory where data will be stored on disk.
|
| services.sourcehut.settings."sr.ht".source-url | The source code for your fork of sr.ht.
|
| services.imaginary.settings.return-size | Return the image size in the HTTP headers.
|
| services.postgrest.settings.server-port | The TCP port to bind the web server.
|
| services.scrutiny.settings.web.influxdb.port | The port of the InfluxDB instance.
|
| services.vmalert.settings."notifier.url" | Prometheus Alertmanager URL
|
| services.yggdrasil.settings.Listen | Listen addresses for incoming connections
|
| services.nntp-proxy.users.<name>.username | Username
|
| services.mautrix-discord.settings.bridge | Bridge configuration
|
| programs.lazygit.settings | Lazygit configuration
|
| services.nginx.virtualHosts.<name>.serverName | Name of this virtual host
|
| services.geth.<name>.enable | Whether to enable Go Ethereum Node.
|
| services.geth.<name>.extraArgs | Additional arguments passed to Go Ethereum.
|
| services.crab-hole.settings.blocklist.lists | List of blocklists
|
| services.librespeed.frontend.settings | Override default settings of the speedtest web client
|
| services.bitmagnet.settings.dht_server | DHT server settings
|
| services.angrr.settings.touch.project-globs | List of glob patterns to include or exclude files when touching GC roots
|
| services.angrr.settings.profile-policies | Profile GC root policies.
|
| services.moosefs.cgiserver.settings | GUI server configuration options.
|
| services.tor.settings.RelayBandwidthBurst | See torrc manual.
|
| services.opensearch.settings."http.port" | The port to listen on for HTTP traffic.
|
| services.hercules-ci-agent.settings.apiBaseUrl | API base URL that the agent will connect to
|
| services.nsd.zones.<name>.allowNotify | Listed primary servers are allowed to notify this secondary server
|
| services.sitespeed-io.runs.*.settings | Configuration for sitespeed-io, see
https://www.sitespeed.io/documentation/sitespeed.io/configuration/
for available options
|
| services.invidious-router.settings | Configuration for invidious-router
|
| services.canaille.settings.CANAILLE.ACL | Access Control Lists
|
| services.postgrest.settings.db-config | Enables the in-database configuration.
https://docs.postgrest.org/en/stable/references/configuration.html#in-database-configuration
This is enabled by default upstream, but disabled by default in this module.
|
| services.matrix-hookshot.settings.passFile | A passkey used to encrypt tokens stored inside the bridge
|
| services.scrutiny.settings.web.influxdb.host | IP or hostname of the InfluxDB instance.
|
| services.grafana.settings.server.protocol | Which protocol to listen.
|
| services.openldap.settings.children | Child entries of the current entry, with recursively the same structure.
|
| services.openldap.settings.includes | LDIF files to include after the parent's attributes but before its children.
|
| systemd.settings.Manager | Options for the global systemd service manager
|
| services.dnscrypt-proxy2.settings | Attrset that is converted and passed as TOML config file
|
| services.pretalx.settings.redis.location | URI to the redis server, used to speed up locking, caching and session storage.
|
| services.listmonk.database.settings.smtp | List of outgoing SMTP servers
|
| services.suwayomi-server.settings.server.port | The port that Suwayomi will listen to.
|
| services.journald.remote.settings.Remote.Seal | Periodically sign the data in the journal using Forward Secure
Sealing.
|
| services.traefik.dynamic.settings | Dynamic configuration for Traefik, written in Nix
|
| services.k3s.manifests.<name>.target | Name of the symlink (relative to /var/lib/rancher/k3s/server/manifests)
|
| services.bluesky-pds.settings.PDS_BLOB_UPLOAD_LIMIT | Size limit of uploaded blobs in bytes
|
| services.umurmur.settings.max_users | Maximum number of concurrent clients allowed.
|
| programs.regreet.iconTheme.name | Name of the icon theme to use for regreet.
|
| services.parsedmarc.settings | Configuration parameters to set in
parsedmarc.ini
|
| services.postfix-tlspol.settings.server.cache-file | Path to the cache file.
|
| services.tlsrpt.collectd.settings.storage | Storage backend definition.
|
| services.crowdsec-firewall-bouncer.settings | Settings for the main CrowdSec Firewall Bouncer
|
| programs.regreet.settings | ReGreet configuration file
|
| services.sourcehut.settings."hg.sr.ht".api-origin | Origin URL for the API
|
| services.grocy.settings.calendar.showWeekNumber | Show the number of the weeks in the calendar views.
|
| services.tor.settings.UseDefaultFallbackDirs | See torrc manual.
|
| services.tor.settings.AccountingStart | See torrc manual.
|
| services.tor.settings.ProtocolWarnings | See torrc manual.
|
| services.tor.settings.EntryStatistics | See torrc manual.
|
| services.lasuite-docs.settings.CELERY_BROKER_URL | URL of the redis backend for celery
|
| services.lasuite-meet.settings.CELERY_BROKER_URL | URL of the redis backend for celery
|
| security.pam.rssh.settings | Options to pass to the pam_rssh module
|
| services.suricata.settings.dpdk.eal-params.proc-type | dpdk eal-params.proc-type, see data plane development kit docs.
|
| services.scrutiny.collector.settings | Collector settings to be rendered into the collector configuration file
|
| services.filebeat.settings | Configuration for filebeat
|
| services.umurmur.settings.bindaddr6 | IPv6 address to bind to
|
| services.syncthing.settings.options | The options element contains all other global configuration options
|
| services.xonotic.settings.sv_public | Controls whether the server will be publicly listed.
|
| nix.settings.require-sigs | If enabled (the default), Nix will only download binaries from binary caches if
they are cryptographically signed with any of the keys listed in
nix.settings.trusted-public-keys
|
| services.nsd.zones.<name>.dnssec | Whether to enable DNSSEC.
|
| services.slskd.settings.filters.search.request | Incoming search requests which match this filter are ignored.
|
| services.firewalld.settings.RFC3964_IPv4 | Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet.
|
| services.sourcehut.settings."paste.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."pages.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."pages.sr.ht".origin | URL pages.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."lists.sr.ht".debug-port | Port to bind the debug server to.
|
| services.sourcehut.settings."paste.sr.ht".origin | URL paste.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."paste.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."lists.sr.ht".origin | URL lists.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."pages.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."lists.sr.ht".debug-host | Address to bind the debug server to.
|
| services.moosefs.cgiserver.settings.PORT | Port for CGI server to listen on.
|
| services.crowdsec.settings.console.tokenFile | The Console Token file to use.
|
| services.grafana.settings.smtp.cert_file | File path to a cert file.
|
| services.kubo.settings.Addresses.Gateway | Where the IPFS Gateway can be reached
|
| security.loginDefs.settings.UMASK | The file mode creation mask is initialized to this value.
|
| security.pam.u2f.settings.cue | By default pam-u2f module does not inform user
that he needs to use the u2f device, it just waits without a prompt
|
| security.loginDefs.settings.UID_MAX | Range of user IDs used for the creation of regular users by useradd or newusers.
|
| security.loginDefs.settings.UID_MIN | Range of user IDs used for the creation of regular users by useradd or newusers.
|
| services.taler.merchant.settings.merchant.DB | Plugin to use for the database.
|
| services.taler.exchange.settings.exchange.DB | Plugin to use for the database.
|
| services.forgejo.settings.server.STATIC_ROOT_PATH | Upper level of template and static files path.
|
| services.sftpgo.settings.sftpd.bindings.*.port | The port for serving SFTP requests
|
| services.nsd.keys.<name>.keyFile | Path to the file which contains the actual base64 encoded
key
|
| programs.gnupg.agent.settings | Configuration for /etc/gnupg/gpg-agent.conf
|
| services.reposilite.settings.sslPort | SSL port to bind to
|
| services.hostapd.radios.<name>.networks.<name>.ssid | SSID to be used in IEEE 802.11 management frames.
|
| services.sourcehut.settings."git.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."hub.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."man.sr.ht".api-origin | Origin URL for the API
|
| services.openafsClient.cellServDB.<name>.*.dnsname | DNS full-qualified domain name of a database server
|
| services.openafsServer.cellServDB.<name>.*.dnsname | DNS full-qualified domain name of a database server
|
| services.sourcehut.settings."builds.sr.ht".redis | The Redis connection used for the Celery worker.
|
| services.resolved.settings.Resolve.DNSSEC | Whether to validate DNSSEC for DNS lookups.
|
| services.sftpgo.settings.webdavd.bindings | Configure listen addresses and ports for webdavd.
|
| services.tor.settings.ExitPortStatistics | See torrc manual.
|
| services.tor.settings.AutomapHostsSuffixes | See torrc manual.
|
| services.collabora-online.settings | Configuration for Collabora Online WebSocket Daemon, see
https://sdk.collaboraonline.com/docs/installation/Configuration.html, or
https://github.com/CollaboraOnline/online/blob/master/coolwsd.xml.in for the default
configuration.
|
| services.cntlm.username | Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
|
| services.writefreely.admin.name | The name of the first admin user.
|
| services.sftpgo.settings.httpd.bindings.*.port | The port for serving HTTP(S) requests
|
| services.sourcehut.settings."pages.sr.ht".max-site-size | Maximum size of any given site (post-gunzip), in MiB.
|
| services.sourcehut.settings."hg.sr.ht".srhtext | Path to the srht mercurial extension
(defaults to where the hgsrht code is)
|
| nix.settings.trusted-users | A list of names of users that have additional rights when
connecting to the Nix daemon, such as the ability to specify
additional binary caches, or to import unsigned NARs
|
| networking.interfaces.<name>.name | Name of the interface.
|
| services.geth.<name>.http.enable | Whether to enable Go Ethereum HTTP API.
|
| services.matrix-synapse.settings.redis.enabled | Whether to use redis support
|
| services.knot-resolver.settings.workers | The number of running kresd (Knot Resolver daemon) workers
|
| services.radicle.ci.broker.settings.adapters | CI adapters
|
| services.wg-access-server.settings.dns.enabled | Enable/disable the embedded DNS proxy server
|
| services.dependency-track.settings | See https://docs.dependencytrack.org/getting-started/configuration/#default-configuration for possible options
|
| services.resolved.settings.Resolve.DNSOverTLS | Whether to use TLS encryption for DNS queries
|
| services.hylafax.modems.<name>.type | Name of modem configuration file,
will be searched for in config
in the spooling area directory.
|
| services.mautrix-signal.settings | config.yaml configuration as a Nix attribute set
|
| security.loginDefs.settings.GID_MAX | Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
|
| security.loginDefs.settings.GID_MIN | Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
|
| services.postsrsd.settings.srs-domain | Dedicated mail domain used for ephemeral SRS envelope addresses
|
| services.forgejo.settings.server.PROTOCOL | Listen protocol. +unix means "over unix", not "in addition to."
|
| services.mbpfan.settings.general.low_temp | If temperature is below this, fans will run at minimum speed.
|
| services.mbpfan.settings.general.max_temp | If temperature is above this, fans will run at maximum speed.
|
| nix.settings.system-features | The set of features supported by the machine
|
| security.pam.u2f.settings.appid | By default pam-u2f module sets the application
ID to pam://$HOSTNAME
|
| services.bonsaid.settings.*.command | Command to run when this transition is taken
|
| services.lidarr.settings.update.mechanism | which update mechanism to use
|
| services.sonarr.settings.update.mechanism | which update mechanism to use
|
| services.radarr.settings.update.mechanism | which update mechanism to use
|
| services.kanidm.server.settings.log_level | Log level of the server.
|
| services.sourcehut.settings."todo.sr.ht::mail".sock | Path for the lmtp daemon's unix socket
|
| services.journald.upload.settings.Upload.URL | The URL to upload the journal entries to
|
| services.suricata.settings.default-rule-path | Path in which suricata-update managed rules are stored by default.
|
| services.uhub.<name>.enableTLS | Whether to enable TLS support.
|
| services.sourcehut.settings."todo.sr.ht".notify-from | Outgoing email for notifications generated by users.
|
| services.kubo.settings.Addresses.API | Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on
|
| services.scrutiny.settings.web.influxdb.token | Authentication token for connecting to InfluxDB.
|
| services.samba.settings.global."passwd program" | Path to a program that can be used to set UNIX user passwords.
|
| services.epgstation.settings.encode | Encoding presets for recorded videos.
|
| services.tor.settings.ServerDNSRandomizeCase | See torrc manual.
|
| services.tor.settings.BridgeRecordUsageByCountry | See torrc manual.
|
| nix.settings.allowed-users | A list of names of users (separated by whitespace) that are
allowed to connect to the Nix daemon
|
| services.sabnzbd.settings.misc.email_rss | Whether to send alerts for jobs added by RSS feeds
|
| services.pretix.settings.database.backend | Database backend to use
|
| services.apache-kafka.settings.listeners | Kafka Listener List
|
| services.suricata.settings.stats.stream-events | Add stream events as stats.
|
| services.kanidm.server.settings.tls_chain | TLS chain in pem format.
|
| users.groups.<name>.gid | The group GID
|
| hardware.apple.touchBar.settings | Configuration for tiny-dfr
|
| services.peroxide.settings.ServerAddress | The address on which to listen for connections.
|
| services.corteza.settings.HTTP_WEBAPP_ENABLED | Whether to enable webapps.
|
| services.firewalld.settings.DefaultZone | Default zone for connections.
|
| services.matrix-synapse.settings.pid_file | The file to store the PID in.
|
| services.umami.settings.DATABASE_URL_FILE | A file containing a connection string for the database
|
| services.libeufin.nexus.settings.nexus-ebics.USER_ID | User ID of the EBICS subscriber
|
| services.grafana.settings.server.cert_key | Path to the certificate key file (if protocol is set to https or h2).
|
| services.tlsrpt.reportd.settings.fetchers | Comma-separated list of fetcher programs that retrieve collectd data.
|
| services.hatsu.settings.HATSU_PRIMARY_ACCOUNT | The primary account of your instance (eg 'example.com').
|
| services.homebridge.settings.bridge.port | The port homebridge listens on
|
| services.opengfw.settings.workers.udpMaxStreams | UDP max streams.
|
| services.hbase-standalone.settings | configurations in hbase-site.xml, see https://github.com/apache/hbase/blob/master/hbase-server/src/test/resources/hbase-site.xml for details.
|
| services.tinyproxy.settings.Filter | Tinyproxy supports filtering of web sites based on URLs or domains
|
| services.prometheus.exporters.fritz.settings | Configuration settings for fritz-exporter.
|
| services.sourcehut.settings."meta.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."todo.sr.ht".api-origin | Origin URL for the API
|
| services.suricata.settings.includes | Files to include in the suricata configuration
|
| services.filebrowser.settings.port | The port to listen on.
|
| services.sourcehut.settings."hg.sr.ht".oauth-client-id | hg.sr.ht's OAuth client id for meta.sr.ht.
|
| services.anubis.defaultOptions.settings | Freeform configuration via environment variables for Anubis
|
| services.gitea.settings.session.COOKIE_SECURE | Marks session cookies as "secure" as a hint for browsers to only send
them via HTTPS
|
| services.tor.settings.MaxCircuitDirtiness | See torrc manual.
|
| services.tor.settings.RejectPlaintextPorts | See torrc manual.
|
| services.grafana-image-renderer.settings | Configuration attributes for grafana-image-renderer.
|
| services.cryptpad.settings.httpUnsafeOrigin | This is the URL that users will enter to load your instance
|
| services.snapserver.settings.stream.port | Port to listen on for snapclient connections.
|
| services.opensnitch.settings.Rules.Path | Path to the directory where firewall rules can be found and will
get stored by the NixOS module.
|
| services.libeufin.nexus.settings.nexus-ebics.HOST_BASE_URL | URL of the EBICS server.
|
| services.firezone.headless-client.name | The name of this client as shown in firezone
|
| services.routinator.settings.retry | An integer value specifying the number of seconds an RTR client is requested to wait after it failed to receive a data set.
|
| services.sourcehut.settings."meta.sr.ht::aliases" | Aliases for the client IDs of commonly used OAuth clients.
|
| services.privoxy.settings.enable-edit-actions | Whether the web-based actions file editor may be used.
|
| services.veilid.settings.logging.system.enabled | Events of type 'system' will be logged.
|
| services.xserver.displayManager.gdm.settings | Options passed to the gdm daemon
|
| services.headscale.settings.oidc.pkce.method | PKCE method to use:
- plain: Use plain code verifier
- S256: Use SHA256 hashed code verifier (default, recommended)
|
| services.opensnitch.settings.LogLevel | Default log level from 0 to 4 (debug, info, important, warning,
error).
|
| services.anuko-time-tracker.settings.reportFooter | Defines whether to use a footer on reports.
|
| services.pid-fan-controller.settings.fans.*.minPwm | Minimum PWM value.
|
| services.pid-fan-controller.settings.fans.*.maxPwm | Maximum PWM value.
|
| services.postfix-tlspol.settings.dns.address | IP and port to your DNS resolver
|
| services.taler.settings.taler.CURRENCY_ROUND_UNIT | Smallest amount in this currency that can be transferred using the underlying RTGS
|
| services.opengfw.settings.replay.realtime | Whether the packets in the PCAP file should be replayed in "real time" (instead of as fast as possible).
|
| services.keycloak.database.name | Database name to use when connecting to an external or
manually provisioned database; has no effect when a local
database is automatically provisioned
|
| services.reposilite.settings.basePath | Custom base path for this Reposilite instance
|
| services.firewalld.settings.ReloadPolicy | The policy during reload.
|
| services.sourcehut.settings."man.sr.ht".oauth-client-id | man.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."git.sr.ht".oauth-client-id | git.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."hub.sr.ht".oauth-client-id | hub.sr.ht's OAuth client id for meta.sr.ht.
|
| services.listmonk.database.settings.smtp.*.port | Port for the SMTP server
|
| services.listmonk.database.settings.smtp.*.host | Hostname for the SMTP server
|
| services.mautrix-discord.settings.logging | Logging configuration
|
| services.szurubooru.server.settings | Configuration to write to config.yaml
|
| services.prometheus.remoteRead.*.name | Name of the remote read config, which if specified must be unique among remote read configs
|
| services.taler.merchant.settings.merchant.PORT | Port on which the HTTP server listens.
|
| services.taler.exchange.settings.exchange.PORT | Port on which the HTTP server listens.
|
| services.ndppd.proxies.<name>.rules.<name>.method | static: Immediately answer any Neighbor Solicitation Messages
(if they match the IP rule).
iface: Forward the Neighbor Solicitation Message through the specified
interface and only respond if a matching Neighbor Advertisement
Message is received.
auto: Same as iface, but instead of manually specifying the outgoing
interface, check for a matching route in /proc/net/ipv6_route.
|
| services.firezone.server.web.settings | Environment variables for this component of the Firezone server
|
| services.firezone.server.api.settings | Environment variables for this component of the Firezone server
|
| services.filesender.settings.admin | UIDs (as per the configured saml_uid_attribute) of FileSender administrators
|
| services.bookstack.settings.APP_KEY_FILE | The path to your appkey
|
| services.rauc.slots.<name>.*.device | The device to update.
|
| services.sourcehut.settings."meta.sr.ht::settings".registration | Whether to enable public registration.
|
| services.filebrowser.settings.root | The directory where FileBrowser stores files.
|
| services.tor.settings.ExtraInfoStatistics | See torrc manual.
|
| services.mollysocket.settings.port | Listening port of the web server
|
| services.tor.settings.CookieAuthFileGroupReadable | See torrc manual.
|
| services.mollysocket.settings.host | Listening address of the web server
|
| services.displayManager.lemurs.settings | Configuration for lemurs, provided as a Nix attribute set and automatically
serialized to TOML
|
| services.prometheus.exporters.script.settings.scripts | All settings expressed as an Nix attrset
|
| services.postsrsd.settings.secrets-file | Path to the file containing the secret keys.
Secrets are passed using LoadCredential= on the systemd unit,
so this options is read-only
|
| services.routinator.settings.log-level | A string value specifying the maximum log level for which log messages should be emitted
|
| services.sourcehut.settings."builds.sr.ht".debug-host | Address to bind the debug server to.
|
| services.sourcehut.settings."builds.sr.ht".origin | URL builds.sr.ht is being served at (protocol://domain)
|
| services.sourcehut.settings."builds.sr.ht".debug-port | Port to bind the debug server to.
|
| services.knot-resolver.settings.network.listen | List of interfaces to listen to and its configuration.
|
| services.warpgate.settings.log.retention | How long Warpgate keep its logs.
|
| services.szurubooru.server.settings.smtp.port | Port of the SMTP server.
|
| services.mysql.initialDatabases.*.name | The name of the database to create.
|
| services.matrix-conduit.settings.global.port | The port Conduit will be running on
|
| services.livekit.ingress.settings.redis.address | Address or hostname and port for redis connection
|
| services.bitmagnet.settings.postgres | PostgreSQL database configuration
|
| services.mchprs.settings.bungeecord | Enable compatibility with
BungeeCord
|
| services.i2pd.inTunnels.<name>.address | Bind address for ‹name› endpoint.
|
| security.krb5.settings.include | Files to include in the Kerberos configuration.
|
| services.nix-store-gcs-proxy.<name>.bucketName | Name of Google storage bucket
|
| services.suricata.settings.stats.interval | The interval field (in seconds) controls the interval at
which stats are updated in the log.
|
| services.hostapd.radios.<name>.networks.<name>.group | Members of this group can access the control socket for this interface.
|
| security.loginDefs.settings.SYS_UID_MAX | Range of user IDs used for the creation of system users by useradd or newusers.
|
| security.loginDefs.settings.SYS_UID_MIN | Range of user IDs used for the creation of system users by useradd or newusers.
|
| services.moosefs.cgiserver.settings.DATA_PATH | Directory for lock files.
|
| services.firewalld.settings.FlushAllOnReload | Whether to flush all runtime rules on a reload.
|
| services.routinator.settings.log-file | A string value containing the path to a file to which log messages will be appended if the log configuration value is set to file
|
| services.buildkite-agents.<name>.hooksPath | Path to the directory storing the hooks
|
| services.amule.settings.ExternalConnect.ECPort | TCP port for external connections, like remote control via amule-gui
|
| networking.vswitches.<name>.interfaces.<name>.name | Name of the interface
|
| services.sourcehut.settings."lists.sr.ht".notify-from | Outgoing email for notifications generated by users.
|
| services.libeufin.bank.settings.libeufin-bank.PORT | The port on which libeufin-bank should listen.
|
| services.szurubooru.server.settings.smtp.user | User to connect to the SMTP server.
|
| services.autosuspend.settings | Configuration for autosuspend, see
https://autosuspend.readthedocs.io/en/latest/configuration_file.html#general-configuration
for supported values.
|
| services.immichframe.settings | Configuration for ImmichFrame
|
| services.mollysocket.settings | Configuration for MollySocket
|
| services.bluesky-pds.settings.PDS_REPORT_SERVICE_DID | DID of mod service
|
| power.ups.ups.<name>.driver | Specify the program to run to talk to this UPS. apcsmart,
bestups, and sec are some examples.
|
| services.matrix-tuwunel.settings.global.port | The port(s) tuwunel will be running on
|
| services.pppd.peers.<name>.enable | Whether to enable this PPP peer.
|
| services.tts.servers.<name>.port | Port to bind the TTS server to.
|
| services.phpfpm.pools.<name>.user | User account under which this pool runs.
|
| services.evremap.settings.dual_role | List of dual-role remappings that output different key sequences based on whether the
input key is held or tapped.
|
| services.biboumi.settings.log_level | Indicate what type of log messages to write in the logs.
0 is debug, 1 is info, 2 is warning, 3 is error.
|
| services.lokinet.settings.network.keyfile | The private key to persist address with
|
| services.bitmagnet.settings.postgres.user | User to connect as
|
| services.writefreely.settings.app.theme | The theme to apply.
|
| services.github-runners.<name>.replace | Replace any existing runner with the same name
|
| services.tahoe.nodes.<name>.tub.port | The port on which the tub will listen
|
| services.tahoe.nodes.<name>.web.port | The port on which the Web server will listen
|
| services.hickory-dns.settings.directory | The directory in which hickory-dns should look for .zone files,
whenever zones aren't specified by absolute path.
|
| services.firewalld.settings.CleanupOnExit | Whether to clean up firewall rules when firewalld stops.
|
| services.chhoto-url.settings.slug_style | The slug style to use for auto-generated URLs.
|
| services.sourcehut.settings."todo.sr.ht::mail".sock-group | The lmtp daemon will make the unix socket group-read/write
for users in this group.
|
| services.keycloak.settings | Configuration options corresponding to parameters set in
conf/keycloak.conf
|
| services.gotosocial.settings | Contents of the GoToSocial YAML config
|
| services.pgbackrest.settings | An attribute set of options as described in:
https://pgbackrest.org/configuration.html
All globally available options, i.e. all except stanza options, can be used
|
| services.nginx.proxyCachePath.<name>.keysZoneName | Set name to shared memory zone.
|
| services.veilid.settings.logging.terminal.level | The minimum priority of terminal events to be logged.
|
| services.sourcehut.settings."builds.sr.ht".allow-free | Whether to enable nonpaying users to submit builds.
|
| services.opensnitch.settings.Stats.MaxStats | Max stats per item to keep in backlog.
|
| services.sabnzbd.settings.misc.https_key | Path to the TLS key for the web UI
|
| services.grafana.settings.database.host | Only applicable to MySQL or Postgres
|
| services.bluesky-pds.settings.PDS_REPORT_SERVICE_URL | URL of mod service
|
| services.umami.settings.COLLECT_API_ENDPOINT | Allows you to send metrics to a location different than the default /api/send.
|
| services.writefreely.settings | Writefreely configuration (config.ini)
|
| services.immich.settings.newVersionCheck.enabled | Check for new versions
|
| services.sftpgo.settings.smtp.encryption | Encryption scheme:
0: No encryption
1: TLS
2: STARTTLS
|
| security.loginDefs.settings.SYS_GID_MAX | Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
|
| security.loginDefs.settings.SYS_GID_MIN | Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
|
| services.hostapd.radios.<name>.networks.<name>.utf8Ssid | Whether the SSID is to be interpreted using UTF-8 encoding.
|
| services.sourcehut.settings."pages.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."lists.sr.ht".api-origin | Origin URL for the API
|
| services.sourcehut.settings."paste.sr.ht".api-origin | Origin URL for the API
|
| services.scrutiny.settings.web.influxdb.bucket | InfluxDB bucket in which to store data.
|
| services.sourcehut.settings."hg.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.sourcehut.settings."lists.sr.ht".allow-new-lists | Whether to enable creation of new lists.
|
| services.sourcehut.settings."todo.sr.ht".oauth-client-id | todo.sr.ht's OAuth client id for meta.sr.ht.
|
| services.moosefs.cgiserver.settings.BIND_HOST | IP address to bind CGI server to.
|
| services.healthchecks.settings | Environment variables which are read by healthchecks (local)_settings.py
|
| services.scrutiny.collector.settings.host.id | Host ID for identifying/labelling groups of disks
|
| services.bind.zones.<name>.master | Master=false means slave server
|
| services.bind.zones.<name>.slaves | Addresses who may request zone transfers.
|
| services.nsd.zones.<name>.minRetrySecs | Limit retry time for secondary zones.
|
| services.rauc.slots.<name>.*.enable | Whether to enable this RAUC slot.
|
| services.i2pd.outTunnels.<name>.address | Bind address for ‹name› endpoint.
|
| hardware.cpu.x86.msr.settings.allow-writes | Whether to allow writes to MSRs ("on") or not ("off").
|
| services.grafana.settings.server.http_port | Listening port.
|
| services.ndppd.proxies.<name>.rules.<name>.interface | Interface to use when method is iface.
|
| services.searx.settingsFile | The path of the Searx server settings.yml file
|
| services.nylon.<name>.enable | Enables nylon as a running service upon activation.
|
| services.wastebin.settings.WASTEBIN_TITLE | Overrides the HTML page title
|
| services.cryptpad.settings.installMethod | Install method is listed in telemetry if you agree to it through the consentToContact
setting in the admin panel.
|
| services.birdwatcher.settings | birdwatcher configuration, for configuration options see the example on github
|
| services.meshtasticd.settings | The Meshtastic configuration file
|
| services.szurubooru.server.settings.debug | Whether to generate server logs.
|
| services.neard.settings.General.DefaultPowered | Automatically turn an adapter on when being discovered.
|
| services.spacecookie.settings.log.level | Log level for the spacecookie service.
|
| services.warpgate.settings.postgres.enable | Whether to enable PostgreSQL listener.
|
| services.warpgate.settings.postgres.listen | Listen endpoint of PostgreSQL listener.
|
| services.biboumi.settings.password | The password used to authenticate the XMPP component to your XMPP server
|
| services.sourcehut.settings."meta.sr.ht::settings".onboarding-redirect | Where to redirect new users upon registration.
|
| services.swapspace.settings.swappath | Location where swapspace may create and delete swapfiles
|
| services.minidlna.settings.log_level | Defines the type of messages that should be logged and down to which level of importance.
|
| services.lasuite-docs.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.lasuite-meet.settings.DJANGO_SECRET_KEY_FILE | The path to the file containing Django's secret key
|
| services.scrutiny.settings.web.influxdb.scheme | URL scheme to use when connecting to InfluxDB.
|
| security.loginDefs.settings | Config options for the /etc/login.defs file, that defines
the site-specific configuration for the shadow password suite
|
| services.szurubooru.server.settings.smtp.host | Host of the SMTP server used to send reset password.
|
| services.grafana.settings.smtp.password | Password used for authentication
|
| services.bitmagnet.settings.http_server | HTTP server settings
|
| services.sourcehut.settings."pages.sr.ht".user-domain | Configures the user domain, if enabled
|
| services.filesender.database.name | Database name.
|
| services.limesurvey.database.name | Database name.
|
| services.zoneminder.database.name | Name of database.
|
| services.readarr.settings.update.mechanism | which update mechanism to use
|
| services.canaille.settings.CANAILLE_LDAP | Configuration for the LDAP backend
|
| services.syncthing.settings.folders | Folders which should be shared by Syncthing
|
| services.sourcehut.settings."git.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.snapserver.settings.tcp.enabled | Whether to enable the TCP JSON-RPC.
|
| services.nipap.settings.nipapd.foreground | Remain in foreground rather than forking to background.
|
| services.clamav.fangfrisch.settings | fangfrisch configuration
|
| services.blackfire-agent.settings.server-id | Sets the server id used to authenticate with Blackfire
You can find your personal server-id at https://blackfire.io/my/settings/credentials
|
| services.phpfpm.pools.<name>.phpEnv | Environment variables used for this PHP-FPM pool.
|
| services.cgit.<name>.package | The cgit package to use.
|
| services.geth.<name>.package | The geth package to use.
|
| services.uhub.<name>.plugins | Uhub plugin configuration.
|
| services.postfix-tlspol.settings.server.address | Path or address/port where postfix-tlspol binds its socket to.
|
| services.matrix-conduit.settings.global.address | Address to listen on for connections by the reverse proxy/tls terminator.
|
| services.opengfw.settings.workers.tcpTimeout | How long a connection is considered dead when no data is being transferred
|
| services.geoipupdate.settings | geoipupdate configuration options
|
| services.acme-dns.settings.logconfig.loglevel | Level to log on.
|
| services.legit.settings.meta.description | Website description.
|
| services.prometheus.remoteWrite.*.name | Name of the remote write config, which if specified must be unique among remote write configs
|
| services.moosefs.metalogger.settings | Metalogger configuration options (mfsmetalogger.cfg).
|
| services.tor.settings.ServerTransportPlugin | See torrc manual.
|
| services.tor.settings.MaxClientCircuitsPending | See torrc manual.
|
| services.librespeed.settings | LibreSpeed configuration written as Nix expression
|
| services.canaille.settings.CANAILLE.SMTP | SMTP configuration
|
| services.tlsrpt.reportd.settings.log_level | Level of log messages to emit.
|
| services.tlsrpt.fetcher.settings.log_level | Level of log messages to emit.
|
| services.suricata.settings.stats.decoder-events | Add decode events to stats
|
| services.szurubooru.database.name | Name of the PostgreSQL database.
|
| services.linkwarden.database.name | The name of the Linkwarden database.
|
| services.syncthing.settings.devices | Peers/devices which Syncthing should communicate with
|
| services.suricata.settings.logging.outputs.file.type | Type of logfile.
|
| services.matrix-synapse.settings.database.args.user | Username to connect with psycopg2, set to null
when using sqlite3.
|
| services.botamusique.settings | Your configuration.ini as a Nix attribute set
|
| services.zigbee2mqtt.settings | Your configuration.yaml as a Nix attribute set
|
| services.bluesky-pds.settings.PDS_RATE_LIMITS_ENABLED | Enable rate limiting
|
| services.suricata.settings.vars.address-groups.HOME_NET | HOME_NET variable.
|
| services.postgrest.settings.admin-server-port | Specifies the port for the admin server, which can be used for healthchecks.
https://docs.postgrest.org/en/stable/references/admin_server.html#admin-server
|
| services.scion.scion-dispatcher.settings | scion-dispatcher configuration
|
| services.postsrsd.settings.socketmap | Listener configuration in socket map format native to Postfix configuration.
|
| services.tor.settings.ServerTransportPlugin.exec | Command of pluggable transport.
|
| services.mautrix-telegram.settings | config.yaml configuration as a Nix attribute set
|
| services.firewalld.settings.LogDenied | Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type.
|
| services.neard.settings.General.ConstantPoll | Enable constant polling
|
| services.postgresql.settings | PostgreSQL configuration
|
| services.tsidp.settings.useLocalTailscaled | Use local tailscaled instead of tsnet.
|
| services.stash.settings.theme_color | Sets the theme-color property in the UI
|
| services.watchdogd.settings.filenr.enabled | Whether to enable watchdogd plugin filenr.
|
| services.canaille.settings.CANAILLE_LDAP.BIND_PW | The LDAP bind password
|
| services.bitmagnet.settings.postgres.host | Address, hostname or Unix socket path of the database server
|
| services.immich.settings.server.externalDomain | Domain for publicly shared links, including http(s)://.
|
| services.misskey.settings.redisForTimelines.port | The Redis port.
|
| services.misskey.settings.redisForTimelines.host | The Redis host.
|
| services.bacula-sd.director.<name>.tls.verifyPeer | Verify peer certificate
|
| services.bacula-fd.director.<name>.tls.verifyPeer | Verify peer certificate
|
| services.postgresql.ensureUsers.*.name | Name of the user to ensure.
|
| services.mattermost.database.name | Local Mattermost database name.
|
| users.extraUsers.<name>.home | The user's home directory.
|
| services.pretalx.settings.database.backend | Database backend to use
|
| hardware.sata.timeout.drives.*.name | Drive name without the full path.
|
| services.sabnzbd.settings.misc.email_from | 'From:' field for emails (needs to be an address)
|
| services.opensnitch.settings.Stats.MaxEvents | Max events to send to the GUI.
|
| services.pretalx.settings.filesystem.data | Base path for all other storage paths.
|
| services.litellm.settings.router_settings | LiteLLM Router settings
|
| services.pgbackrest.stanzas.<name>.jobs.<name>.type | Backup type as described in:
https://pgbackrest.org/command.html#command-backup/category-command/option-type
|
| services.evremap.settings.dual_role.*.tap | The key sequence that should be output when the input key is tapped
|
| services.mbpfan.settings.general.high_temp | If temperature is above this, fan speed will gradually increase.
|
| services.watchdogd.settings.filenr.warning | The high watermark level
|
| services.xonotic.settings.maxplayers | Number of player slots on the server, including spectators.
|
| services.waagent.settings.OS.RootDeviceScsiTimeout | Configures the SCSI timeout in seconds on the OS disk and data drives
|
| services.grafana.settings.server.cdn_url | Specify a full HTTP URL address to the root of your Grafana CDN assets
|
| services.waagent.settings.ResourceDisk.SwapSizeMB | Specifies the size of the swap file in MiB (1024×1024 bytes)
|
| services.fediwall.settings.loadFederated | Load federated posts
|
| services.immich-kiosk.settings.immich_url | URL of the immich instance.
|
| services.bluesky-pds.settings.PDS_DATA_DIRECTORY | Directory to store state
|
| services.syncthing.settings | Extra configuration options for Syncthing
|
| services.sharkey.settings.mediaDirectory | Path to the folder where Sharkey stores uploaded media such as images and attachments.
|
| services.prometheus.xmpp-alerts.settings | Configuration for prometheus xmpp-alerts, see
https://github.com/jelmer/prometheus-xmpp-alerts/blob/master/xmpp-alerts.yml.example
for supported values.
|
| services.nvme-rs.settings.email.smtp_server | SMTP server address
|
| services.postgrest.settings.server-host | Where to bind the PostgREST web server.
The admin server will also bind here, but potentially exposes sensitive information
|
| services.scrutiny.collector.settings.log.level | Log level for Scrutiny collector.
|
| services.hedgedoc.settings.protocolUseSSL | Use https:// for all links
|
| services.opensnitch.settings.Server.LogFile | File to write logs to (use /dev/stdout to write logs to standard
output).
|
| services.i2pd.inTunnels.<name>.type | Tunnel type.
|
| services.postfix.settings.main.relayhost | List of hosts to use for relaying outbound mail.
Putting the hostname in angled brackets, e.g. [relay.example.com], turns off MX and SRV lookups for the hostname.
https://www.postfix.org/postconf.5.html#relayhost
|
| services.watchdogd.settings.interval | The kick interval, i.e. how often watchdogd(8) should reset the WDT timer.
|
| services.sourcehut.settings."meta.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.sourcehut.settings."todo.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.sourcehut.settings."lists.sr.ht".oauth-client-id | lists.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."pages.sr.ht".oauth-client-id | pages.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."paste.sr.ht".oauth-client-id | paste.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sabnzbd.settings.misc.email_full | Whether to send alerts for full disks
|
| services.snapserver.settings.http.enabled | Whether to enable the HTTP JSON-RPC.
|
| services.go-csp-collector.settings.output-format | Define how the violation reports are formatted for output.
|
| services.reposilite.settings.cachedLogSize | Amount of messages stored in the cache logger.
|
| services.rke2.manifests.<name>.target | Name of the symlink (relative to /var/lib/rancher/rke2/server/manifests)
|
| services.grafana.settings.server.cert_file | Path to the certificate file (if protocol is set to https or h2).
|
| services.watchdogd.settings.filenr.logmark | Whether to log current stats every poll interval.
|
| services.litellm.settings.model_list | List of supported models on the server, with model-specific configs.
|
| services.matrix-appservice-irc.settings | Configuration for the appservice, see
https://github.com/matrix-org/matrix-appservice-irc/blob/4.0.0/config.sample.yaml
for supported values
|
| services.lidarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.sonarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.suricata.settings.unix-command.enabled | Enable unix-command socket.
|
| services.radarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.cryptpad.settings.websocketPort | Port for the websocket that needs to be separate
|
| services.filebrowser.settings.cache-dir | The directory where FileBrowser stores its cache.
|
| services.tor.settings.ControlPortFileGroupReadable | See torrc manual.
|
| services.reposilite.settings.enforceSsl | Whether to redirect all traffic to SSL.
|
| services.suricata.settings.threshold-file | Suricata threshold configuration file.
|
| services.tor.settings.ServerDNSDetectHijacking | See torrc manual.
|
| services.tor.settings.PaddingStatistics | See torrc manual.
|
| services.homebridge.uiSettings.name | Name of the homebridge UI platform
|
| users.extraUsers.<name>.homeMode | The user's home directory mode in numeric format
|
| xdg.terminal-exec.settings | Configuration options for the Default Terminal Execution Specification
|
| services.pretalx.settings.filesystem.logs | Path to the log directory, that pretalx logs message to.
|
| services.gemstash.settings.base_path | Path to store the gem files and the sqlite database
|
| services.sftpgo.settings.webdavd.bindings.*.port | The port for serving WebDAV requests
|
| services.iodine.clients | Each attribute of this option defines a systemd service that
runs iodine
|
| services.epgstation.database.name | Name of the MySQL database that holds EPGStation's data.
|
| programs.starship.settings | Configuration included in starship.toml
|
| services.sourcehut.settings."pages.sr.ht".gemini-certs | An absolute file path (which should be outside the Nix-store)
to Gemini certificates.
|
| services.sourcehut.settings.mail.smtp-password | Outgoing SMTP password.
|
| services.tinc.networks.<name>.hostSettings | The name of the host in the network as well as the configuration for that host
|
| services.saunafs.metalogger.settings | Contents of metalogger config file (see sfsmetalogger.cfg(5)).
|
| services.netbird.tunnels.<name>.user.group | A system group name for this client instance.
|
| services.netbird.clients.<name>.user.group | A system group name for this client instance.
|
| services.sourcehut.settings."builds.sr.ht".api-origin | Origin URL for the API
|
| services.pppd.peers.<name>.config | pppd configuration for this peer, see the pppd(8) man page.
|
| services.gitlab.pages.settings.artifacts-server | API URL to proxy artifact requests to.
|
| services.typesense.settings.server.api-address | Address to which Typesense API service binds.
|
| services.nginx.virtualHosts.<name>.locations.<name>.root | Root directory for requests.
|
| services.netbird.tunnels.<name>.dir.baseName | A systemd service name to use (without .service suffix).
|
| services.netbird.clients.<name>.dir.baseName | A systemd service name to use (without .service suffix).
|
| services.vmalert.settings."datasource.url" | Datasource compatible with Prometheus HTTP API.
|
| services.fediwall.settings.hideSensitive | Hide sensitive (potentially NSFW) posts
|
| services.openssh.settings.X11Forwarding | Whether to allow X11 connections to be forwarded.
|
| services.journald.remote.settings.Remote.SplitMode | With "host", a separate output file is used, based on the
hostname of the other endpoint of a connection
|
| services.suricata.settings.app-layer.error-policy | The error-policy setting applies to all app-layer parsers
|
| services.spacecookie.settings.log.hide-ips | If enabled, spacecookie will hide personal
information of users like IP addresses from
log output.
|
| services.routinator.settings.expire | An integer value specifying the number of seconds an RTR client is requested to use a data set if it cannot get an update before throwing it away and continuing with no data at all.
|
| programs.spacefm.settings | The system-wide spacefm configuration
|
| services.firefox-syncserver.settings.port | Port to bind to.
|
| services.misskey.settings.redisForTimelines | ioredis options for timelines
|
| boot.initrd.network.ifstate.settings | Content of IfState's initrd configuration file
|
| services.grafana.settings.users.home_page | Path to a custom home page
|
| services.spacecookie.settings.log.hide-time | If enabled, spacecookie will not print timestamps
at the beginning of every log line.
|
| services.spacecookie.settings.log.enable | Whether to enable logging for spacecookie.
|
| services.snapserver.settings.tcp-control.port | Port to listen on for snapclient connections.
|
| services.tor.settings.DirAllowPrivateAddresses | See torrc manual.
|
| services.tor.settings.AuthDirSharedRandomness | See torrc manual.
|
| services.tor.settings.EnforceDistinctSubnets | See torrc manual.
|
| services.evremap.settings.dual_role.*.hold | The key sequence that should be output when the input key is held
|
| services.reposilite.settings.sslEnabled | Whether to listen for encrypted connections on settings.sslPort.
|
| services.wgautomesh.settings.peers.*.pubkey | Wireguard public key of this peer.
|
| services.quicktun.<name>.privateKey | Local secret key in hexadecimal form.
This option is deprecated
|
| services.etebase-server.settings.database.engine | The database engine to use.
|
| services.grafana-image-renderer.settings.server.addr | Listen address of the service.
|
| services.lemmy.settings.captcha.difficulty | The difficultly of the captcha to solve.
|
| services.taler.merchant.settings.merchant.SERVE | Whether the HTTP server should listen on a UNIX domain socket ("unix") or on a TCP socket ("tcp").
|
| services.postsrsd.settings.separator | SRS tag separator used in generated sender addresses
|
| services.i2pd.outTunnels.<name>.type | Tunnel type.
|
| services.rspamd.locals.<name>.text | Text of the file.
|
| services.healthchecks.settings.DB | Database engine to use.
|
| services.oncall.settings.oncall_host | FQDN for the Oncall instance.
|
| services.opensearch.settings."network.host" | Which port this service should listen on.
|
| services.scrutiny.settings.web.listen.basepath | If Scrutiny will be behind a path prefixed reverse proxy, you can override this
value to serve Scrutiny on a subpath.
|
| services.i2pd.inTunnels.<name>.keys | Keyset used for tunnel identity.
|
| services.phpfpm.pools.<name>.group | Group account under which this pool runs.
|
| programs.regreet.cursorTheme.name | Name of the cursor theme to use for regreet.
|
| services.geth.<name>.metrics.port | Port number of Go Ethereum metrics service.
|
| services.geth.<name>.http.address | Listen address of Go Ethereum HTTP API.
|
| services.sslh.settings.transparent | Whether the services behind sslh (Apache, sshd and so on) will see the
external IP and ports as if the external world connected directly to
them.
|
| services.maubot.settings.server.public_url | Public base URL where the server is visible.
|
| services.stash.settings.stash_boxes | Stash-box facilitates automated tagging of scenes and performers based on fingerprints and filenames
|
| services.szurubooru.server.settings.smtp.passFile | File containing the password associated to the given user for the SMTP server.
|
| services.autorandr.profiles.<name>.config.<name>.dpi | Output DPI configuration.
|
| services.sourcehut.settings."builds.sr.ht".shell | Scripts used to launch on SSH connection.
/usr/bin/master-shell on master,
/usr/bin/runner-shell on runner
|
| services.evremap.settings.dual_role.*.input | The key that should be remapped
|
| services.guacamole-client.settings | Configuration written to guacamole.properties.
The Guacamole web application uses one main configuration file called
guacamole.properties
|
| services.postgrest.settings.server-unix-socket | Unix domain socket where to bind the PostgREST web server.
|
| services.headscale.settings.dns.magic_dns | Whether to use MagicDNS.
|
| nix.settings.trusted-public-keys | List of public keys used to sign binary caches
|
| services.suricata.settings.logging.outputs.file.level | Loglevel for logs written to the logfile.
|
| services.tor.settings.DormantCanceledByStartup | See torrc manual.
|
| services.tor.settings.DoSConnectionEnabled | See torrc manual.
|
| services.tor.settings.ExtORPortCookieAuthFileGroupReadable | See torrc manual.
|
| services.grafana.settings.server.http_addr | Listening address.
This setting intentionally varies from upstream's default to be a bit more secure by default.
|
| services.snapserver.settings.stream.source | One or multiple URIs to PCM input streams.
|
| services.spacecookie.settings.root | The directory spacecookie should serve via gopher
|
| services.geth.<name>.network | The network to connect to
|
| services.doh-server.settings.upstream | Upstream DNS resolver
|
| services.anuko-time-tracker.settings.emailRequired | Defines whether an email is required for new registrations.
|
| services.matrix-synapse.settings.turn_uris | The public URIs of the TURN server to give to clients
|
| users.extraUsers.<name>.uid | The account UID
|
| services.writefreely.settings.server.port | The port WriteFreely should listen on.
|
| services.wastebin.settings.WASTEBIN_BASE_URL | Base URL for the QR code display
|
| services.sourcehut.settings."lists.sr.ht::worker".sock | Path for the lmtp daemon's unix socket
|
| services.geth.<name>.authrpc.port | Port number of Go Ethereum Auth RPC API.
|
| services.tts.servers.<name>.useCuda | Whether to offload computation onto a CUDA compatible GPU.
|
| services.sourcehut.settings."lists.sr.ht".webhooks | The Redis connection used for the webhooks worker.
|
| services.froide-govplan.settings.ALLOWED_HOSTS | A list of valid fully-qualified domain names (FQDNs) and/or IP
addresses that can be used to reach the Froide-Govplan service.
|
| services.nextcloud.settings.log_type | Logging backend to use.
systemd automatically adds the php-systemd extensions to services.nextcloud.phpExtraExtensions
|
| services.suricata.settings.af-xdp.*.interface | af-xdp capture interface, see upstream docs.
|
| services.reposilite.settings.idleTimeout | Default idle timeout used by Jetty.
|
| services.wastebin.settings.WASTEBIN_MAX_BODY_SIZE | Number of bytes to accept for POST requests
|
| services.sourcehut.settings.objects.s3-access-key | Access key to the S3-compatible object storage service
|
| services.szurubooru.server.settings.domain | Full URL to the homepage of this szurubooru site (with no trailing slash).
|
| services.h2o.hosts.<name>.tls.policy | add will additionally listen for TLS connections. only will
disable TLS connections. force will redirect non-TLS traffic
to the TLS connection.
|
| services.sourcehut.settings."lists.sr.ht::worker".reject-url | Reject URL.
|
| services.forgejo.settings.session.COOKIE_SECURE | Marks session cookies as "secure" as a hint for browsers to only send
them via HTTPS
|
| services.pid-fan-controller.settings.fans.*.cutoff | Whether to stop the fan when minPwm is reached.
|
| services.lasuite-docs.settings.DJANGO_ALLOWED_HOSTS | Comma-separated list of hosts that are able to connect to the server
|
| services.lasuite-meet.settings.DJANGO_ALLOWED_HOSTS | Comma-separated list of hosts that are able to connect to the server
|
| services.botamusique.settings.server.port | Port of the mumble server to connect to.
|
| services.botamusique.settings.server.host | Hostname of the mumble server to connect to.
|
| services.livekit.ingress.settings.rtmp_port | TCP port for RTMP connections
|
| services.livekit.ingress.settings.whip_port | TCP port for WHIP connections
|
| services.tor.settings.DoSCircuitCreationEnabled | See torrc manual.
|
| services.rosenpass.settings.verbosity | Verbosity of output produced by the service.
|
| services.suricata.settings.pcap.*.interface | pcap capture interface, see upstream docs.
|
| services.autorandr.profiles.<name>.config.<name>.mode | Output resolution.
|
| services.autorandr.profiles.<name>.config.<name>.rate | Output framerate.
|
| services.netbird.clients.<name>.bin.suffix | A system group name for this client instance.
|
| services.netbird.tunnels.<name>.bin.suffix | A system group name for this client instance.
|
| services.rsync.jobs.<name>.sources | Source directories.
|
| services.saunafs.metalogger.settings.DATA_PATH | Data storage directory
|
| services.prowlarr.settings.update.mechanism | which update mechanism to use
|
| services.whisparr.settings.update.mechanism | which update mechanism to use
|
| services.thanos.query.grpc-client-server-name | Server name to verify the hostname on the returned gRPC certificates
|
| services.i2pd.outTunnels.<name>.keys | Keyset used for tunnel identity.
|
| i18n.inputMethod.fcitx5.settings.addons | The addon configures in conf folder in ini format with global sections
|
| services.webhook.hooks.<name>.id | The ID of your hook
|
| services.privoxy.settings.filterfile | List of paths to Privoxy filter files
|
| services.opensnitch.settings.Firewall | Which firewall backend to use.
|
| services.sourcehut.settings."builds.sr.ht".oauth-client-id | builds.sr.ht's OAuth client id for meta.sr.ht.
|
| services.sourcehut.settings."hg.sr.ht".oauth-client-secret | hg.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.watchdogd.settings.loadavg.enabled | Whether to enable watchdogd plugin loadavg.
|
| services.watchdogd.settings.meminfo.enabled | Whether to enable watchdogd plugin meminfo.
|
| services.sabnzbd.settings.misc.html_login | Prompt for login with an html login mask if enabled,
otherwise prompt for basic auth (useful for SSO)
|
| services.postfix.masterConfig.<name>.command | A program name specifying a Postfix service/daemon process
|
| services.openssh.settings.KexAlgorithms | Allowed key exchange algorithms
Uses the lower bound recommended in both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| services.hostapd.radios.<name>.networks.<name>.logLevel | Levels (minimum value for logged events):
0 = verbose debugging
1 = debugging
2 = informational messages
3 = notification
4 = warning
|
| services.buffyboard.settings.input.pointer | Enable or disable the use of a hardware mouse or other pointing device.
|
| services.parsedmarc.settings.mailbox.watch | Use the IMAP IDLE command to process messages as they arrive.
|
| services.suricata.settings.app-layer.protocols | app-layer protocols, see upstream docs.
|
| services.headscale.settings.oidc.pkce.enabled | Enable or disable PKCE (Proof Key for Code Exchange) support
|
| services.nginx.virtualHosts.<name>.locations.<name>.index | Adds index directive.
|
| services.nginx.virtualHosts.<name>.locations.<name>.alias | Alias directory for requests.
|
| services.firezone.server.domain.settings | Environment variables for this component of the Firezone server
|
| services.blackfire-agent.settings.server-token | Sets the server token used to authenticate with Blackfire
You can find your personal server-token at https://blackfire.io/my/settings/credentials
|
| services.headscale.settings.oidc.client_id | OpenID Connect client ID.
|
| services.tlsrpt.collectd.settings.log_level | Level of log messages to emit.
|
| services.moosefs.metalogger.settings.DATA_PATH | Directory for storing metalogger data.
|
| services.watchdogd.settings.filenr.interval | Amount of seconds between every poll.
|
| services.sftpgo.settings.ftpd.bindings.*.address | Network listen address
|
| services.crowdsec.settings.simulation | Attributes inside the simulation.yaml file.
|
| services.chhoto-url.settings.slug_length | The length of auto-generated slugs.
|
| services.chhoto-url.settings.public_mode | Whether to enable public mode.
|
| services.pinnwand.settings.paste_size | Maximum size of a paste in bytes.
|
| services.watchdogd.settings.loadavg.warning | The high watermark level
|
| services.watchdogd.settings.meminfo.warning | The high watermark level
|
| services.cgit.<name>.extraConfig | These lines go to the end of cgitrc verbatim.
|
| systemd.services.<name>.preStop | Shell commands executed to stop the service.
|
| services.sabnzbd.settings.misc.https_cert | Path to the TLS certificate for the web UI
|
| services.awstats.configs.<name>.domain | The domain name to collect stats for.
|
| services.postfix-tlspol.settings.server.prefetch | Whether to prefetch DNS records when the TTL of a cached record is about to expire.
|
| services.bookstack.settings.DB_PASSWORD_FILE | The file containing your mysql/mariadb database password.
|
| services.rosenpass.settings.peers.*.endpoint | Endpoint of the remote Rosenpass peer.
|
| services.pgbouncer.settings.databases | Detailed information about PostgreSQL database definitions:
https://www.pgbouncer.org/config.html#section-databases
|
| services.openafsServer.roles.backup.cellServDB.<name>.*.dnsname | DNS full-qualified domain name of a database server
|
| services.hedgedoc.settings.allowGravatar | Whether to enable Libravatar as
profile picture source on your instance
|
| services.mautrix-whatsapp.settings | config.yaml configuration as a Nix attribute set
|
| systemd.user.services.<name>.preStop | Shell commands executed to stop the service.
|
| services.hostapd.radios.<name>.networks.<name>.macDeny | Specifies the MAC addresses to deny if macAcl is set to "deny" or "radius"
|
| services.hercules-ci-agent.settings.labels | A key-value map of user data
|
| services.routinator.settings.rtr-listen | An array of string values each providing an address and port on which the RTR server should listen in TCP mode
|
| services.autorandr.profiles.<name>.config.<name>.crtc | Output video display controller.
|
| services.nezha-agent.settings.temperature | Enable temperature monitoring.
|
| services.nezha-agent.settings.disable_nat | Disable NAT penetration.
|
| services.your_spotify.settings.PORT | The port of the api server
|
| services.autorandr.profiles.<name>.config.<name>.scale.y | Vertical scaling factor/pixels.
|
| services.autorandr.profiles.<name>.config.<name>.scale.x | Horizontal scaling factor/pixels.
|
| services.sourcehut.settings."git.sr.ht".oauth-client-secret | git.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."hub.sr.ht".oauth-client-secret | hub.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."man.sr.ht".oauth-client-secret | man.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.mchprs.settings.max_players | Maximum number of simultaneous players
|
| services.sourcehut.settings."sr.ht".network-key | An absolute file path (which should be outside the Nix-store)
to a secret key to encrypt internal messages with
|
| services.umami.settings.DISABLE_TELEMETRY | Umami collects completely anonymous telemetry data in order help improve the application
|
| services.headscale.settings.prefixes.v6 | Each prefix consists of either an IPv4 or IPv6 address,
and the associated prefix length, delimited by a slash
|
| services.headscale.settings.prefixes.v4 | Each prefix consists of either an IPv4 or IPv6 address,
and the associated prefix length, delimited by a slash
|
| services.watchdogd.settings.loadavg.logmark | Whether to log current stats every poll interval.
|
| services.watchdogd.settings.meminfo.logmark | Whether to log current stats every poll interval.
|
| services.ferretdb.settings.FERRETDB_SQLITE_URL | SQLite URI (directory) for 'sqlite' handler
|
| services.libeufin.nexus.settings.nexus-ebics.PARTNER_ID | Partner ID of the EBICS subscriber
|
| services.slskd.settings.retention.files.complete | Lifespan of completely downloaded files in minutes.
|
| services.veilid.settings.logging.terminal.enabled | Events of type 'terminal' will be logged.
|
| services.h2o.hosts.<name>.acme.enable | Whether to ask Let’s Encrypt to sign a certificate for this
virtual host
|
| services.buffyboard.settings.theme.default | Selects the default theme on boot
|
| services.grafana.settings.users.login_hint | Text used as placeholder text on login page for login/username input.
|
| services.ferretdb.settings.FERRETDB_HANDLER | Backend handler
|
| systemd.units.<name>.text | Text of this systemd unit.
|
| power.ups.ups.<name>.summary | Lines which would be added inside ups.conf for handling this UPS.
|
| services.readarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.warpgate.settings.recordings.path | Path to store session recordings.
|
| services.minidlna.settings.media_dir | Directories to be scanned for media files
|
| services.bitcoind.<name>.rpc.users.<name>.passwordHMAC | Password HMAC-SHA-256 for JSON-RPC connections
|
| services.akkoma.config.":pleroma".":instance".name | Instance name.
|
| services.nginx.upstreams.<name>.servers.<name>.backup | Marks the server as a backup server
|
| services.suricata.settings.vars.address-groups.DNP3_SERVER | DNP3_SERVER variable.
|
| services.suricata.settings.vars.address-groups.DNP3_CLIENT | DNP3_CLIENT variable.
|
| services.nylon.<name>.logging | Enable logging, default is no logging.
|
| services.reposilite.settings.debugEnabled | Whether to enable debug mode.
|
| services.tor.settings.ReachableAddresses | See torrc manual.
|
| services.httpd.virtualHosts.<name>.locations.<name>.index | Adds DirectoryIndex directive
|
| services.httpd.virtualHosts.<name>.locations.<name>.alias | Alias directory for requests
|
| services.firefly-iii.settings.DB_CONNECTION | The type of database you wish to use
|
| services.headscale.settings.database.sqlite.path | Path to the sqlite3 database file.
|
| services.radicle.ci.broker.settings.triggers.*.filters | Trigger filter.
|
| services.ax25.axports.<name>.tty | Location of hardware kiss tnc for this interface.
|
| services.opensnitch.settings.Ebpf.ModulesPath | Configure eBPF modules path
|
| services.drupal.sites.<name>.filesDir | The location of the Drupal files directory.
|
| services.botamusique.settings.bot.comment | Comment displayed for the bot.
|
| services.radicle.ci.broker.settings.report_dir | Directory where HTML and JSON report pages are written.
|
| systemd.services.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.ndppd.proxies.<name>.ttl | Controls how long a valid or invalid entry remains in the cache, in
milliseconds.
|
| systemd.user.services.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.i2pd.inTunnels.<name>.inPort | Service port
|
| services.anuko-time-tracker.settings.weekendStartDay | This option defines which days are highlighted with weekend color.
6 means Saturday
|
| services.routinator.settings.http-listen | An array of string values each providing an address and port on which the HTTP server should listen
|
| services.gvpe.nodename | GVPE node name
|
| services.nebula.networks.<name>.tun.device | Name of the tun device
|
| services.snapserver.settings.http.doc_root | Path to serve from the HTTP servers root.
|
| services.headscale.settings.database.type | Database engine to use
|
| services.sourcehut.settings."git.sr.ht".post-update-script | A post-update script which is installed in every git repo
|
| services.matrix-tuwunel.settings.global.address | Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator
|
| services.sourcehut.settings."lists.sr.ht".posting-domain | Posting domain.
|
| services.suricata.settings.logging.outputs.file.format | Logformat for logs written to the logfile.
|
| services.suricata.settings.logging.outputs.file.enable | Whether to enable logging to file.
|
| services.suricata.settings.logging.outputs.syslog.type | Type of logs send to syslog.
|
| services.redis.servers.<name>.logfile | Specify the log file name
|
| services.wastebin.settings.WASTEBIN_CACHE_SIZE | Number of rendered syntax highlight items to cache
|
| services.hostapd.radios.<name>.networks.<name>.apIsolate | Isolate traffic between stations (clients) and prevent them from
communicating with each other.
|
| services.anuko-time-tracker.settings.multiorgMode | Defines whether users see the Register option in the menu of Time Tracker that allows them
to self-register and create new organizations (top groups).
|
| services.rkvm.server.settings.certificate | TLS certificate path.
This should be generated with rkvm-certificate-gen.
|
| services.rkvm.client.settings.certificate | TLS ceritficate path.
This should be generated with rkvm-certificate-gen.
|
| services.fedimintd.<name>.nginx.config.serverName | Name of this virtual host
|
| services.grafana.settings.server.root_url | This is the full URL used to access Grafana from a web browser
|
| services.tahoe.nodes.<name>.sftpd.port | The port on which the SFTP server will listen
|
| services.misskey.settings.meilisearch.ssl | Whether to connect via SSL.
|
| services.filebrowser.settings.address | The address to listen on.
|
| services.pinnwand.settings.paste_help | Raw HTML help text shown in the header area.
|
| services.sourcehut.settings."lists.sr.ht::worker".sock-group | The lmtp daemon will make the unix socket group-read/write
for users in this group.
|
| systemd.user.services.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.nginx.virtualHosts.<name>.locations.<name>.tryFiles | Adds try_files directive.
|
| services.cryptpad.settings.blockDailyCheck | Disable telemetry
|
| services.tor.settings.ReachableORAddresses | See torrc manual.
|
| services.tor.settings.FetchHidServDescriptors | See torrc manual.
|
| services.pid-fan-controller.settings.heatSources | List of heat sources to be monitored.
|
| services.sourcehut.settings.objects.s3-secret-key | An absolute file path (which should be outside the Nix-store)
to the secret key of the S3-compatible object storage service.
|
| systemd.services.<name>.wants | Start the specified units when this unit is started.
|
| services.sourcehut.settings."meta.sr.ht".welcome-emails | Whether to enable sending stock sourcehut welcome emails after signup.
|
| services.drupal.sites.<name>.stateDir | The location of the Drupal site state directory.
|
| systemd.user.services.<name>.wants | Start the specified units when this unit is started.
|
| services.acme-dns.settings.database.connection | Database connection string.
|
| services.matrix-synapse.settings.listeners.*.type | The type of the listener, usually http.
|
| services.sourcehut.settings."todo.sr.ht".oauth-client-secret | todo.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.parsedmarc.settings.mailbox.delete | Delete messages after processing them, instead of archiving them.
|
| services.pretalx.settings.filesystem.static | Path to the directory that contains static files.
|
| systemd.tmpfiles.settings | Declare systemd-tmpfiles rules to create, delete, and clean up volatile
and temporary files and directories
|
| services.misskey.settings.meilisearch | Meilisearch connection options.
|
| services.transmission.settings.rpc-port | The RPC port to listen to.
|
| services.open-web-calendar.settings.ALLOWED_HOSTS | The hosts that the Open Web Calendar permits
|
| services.gemstash.settings.db_adapter | Which database type to use
|
| services.sourcehut.settings."git.sr.ht".outgoing-domain | Outgoing domain.
|
| services.sourcehut.settings."todo.sr.ht::mail".posting-domain | Posting domain.
|
| services.misskey.settings.meilisearch.host | The Meilisearch host.
|
| services.misskey.settings.meilisearch.port | The Meilisearch port.
|
| services.grafana-image-renderer.settings.browser.path | Path to the executable of the chromium to use.
|
| security.pam.u2f.settings.origin | By default pam-u2f module sets the origin
to pam://$HOSTNAME
|
| services.suricata.settings.vars.address-groups.ENIP_CLIENT | ENIP_CLIENT variable.
|
| services.suricata.settings.vars.address-groups.ENIP_SERVER | ENIP_SERVER variable.
|
| services.lldap.settings.database_url | Database URL.
|
| services.lldap.settings.ldap_user_dn | Admin username
|
| services.stash.settings.plugins_path | Path to scrapers
|
| services.mchprs.settings.chat_format | How to format chat message interpolating username
and message with curly braces
|
| services.quicktun.<name>.publicKey | Remote public key in hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| services.matrix-synapse.settings.listeners.*.port | The port to listen for HTTP(S) requests on.
|
| services.matrix-synapse.settings.listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.sftpgo.settings.sftpd.bindings.*.address | Network listen address
|
| services.sftpgo.settings.httpd.bindings.*.address | Network listen address
|
| services.anuko-time-tracker.settings.email.smtpPasswordFile | Path to file containing the MTA authentication password.
|
| services.omnom.settings.activitypub.pubkey | ActivityPub public key
|
| services.your_spotify.settings | Your Spotify Configuration
|
| services.rsync.jobs.<name>.timerConfig | When to run the job.
|
| services.reposilite.settings.keyPath | Path to the .jsk KeyStore or paths to the PKCS#8 certificate and private key, separated by a space (see example)
|
| services.autorandr.profiles.<name>.config.<name>.gamma | Output gamma configuration.
|
| services.tor.settings.KeyDirectoryGroupReadable | See torrc manual.
|
| services.umurmur.settings.welcometext | Welcome message for connected clients.
|
| services.tor.settings.ReachableDirAddresses | See torrc manual.
|
| services.moosefs.chunkserver.settings | Chunkserver configuration options (mfschunkserver.cfg).
|
| services.xonotic.settings.net_address | The address Xonotic will listen on.
|
| security.pam.services.<name>.text | Contents of the PAM service file.
|
| services.minidlna.settings.wide_links | Set this to yes to allow symlinks that point outside user-defined media_dir.
|
| services.bluemap.maps.<name>.world | Path to world folder containing the dimension to render
|
| services.bind.zones.<name>.masters | List of servers for inclusion in stub and secondary zones.
|
| services.redis.servers.<name>.bind | The IP interface to bind to.
null means "all interfaces".
|
| security.pam.services.<name>.zfs | Enable unlocking and mounting of encrypted ZFS home dataset at login.
|
| services.misskey.settings.meilisearch.apiKey | The Meilisearch API key.
|
| services.watchdogd.settings.filenr.critical | The critical watermark level
|
| services.i2pd.inTunnels.<name>.inbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| services.grafana-image-renderer.settings.service.port | The TCP port to use for the rendering server.
|
| services.postfix.settings.main.mynetworks | List of trusted remote SMTP clients, that are allowed to relay mail
|
| services.waagent.settings.ResourceDisk.EnableSwap | If enabled, the agent creates a swap file (/swapfile) on the resource disk
and adds it to the system swap space
|
| services.geoipupdate.settings.AccountID | Your MaxMind account ID.
|
| services.healthchecks.settings.DEBUG | Enable debug mode.
|
| services.lldap.settings.ldap_base_dn | Base DN for LDAP.
|
| services.waagent.settings.ResourceDisk.MountPoint | This option specifies the path at which the resource disk is mounted
|
| services.listmonk.database.settings.smtp.*.enabled | Whether to enable this SMTP server for listmonk.
|
| services.grafana.settings.database.ssl_mode | For Postgres, use either disable, require or verify-full
|
| services.wyoming.piper.servers.<name>.voice | Name of the voice model to use
|
| services.peering-manager.settings.ALLOWED_HOSTS | A list of valid fully-qualified domain names (FQDNs) and/or IP
addresses that can be used to reach the peering manager service.
|
| services.hostapd.radios.<name>.networks.<name>.macAllow | Specifies the MAC addresses to allow if macAcl is set to "allow" or "radius"
|
| services.biboumi.settings.identd_port | The TCP port on which to listen for identd queries.
|
| services.grafana.settings.smtp.skip_verify | Verify SSL for SMTP server.
|
| services.suwayomi-server.settings.server.localSourcePath | Path to the local source folder.
|
| users.extraUsers.<name>.group | The user's primary group.
|
| services.public-inbox.settings.publicinbox | public inboxes
|
| hardware.deviceTree.overlays.*.name | Name of this overlay
|
| boot.initrd.systemd.settings.Manager | Options for the global systemd service manager used in initrd
|
| services.firefly-iii-data-importer.settings | Options for firefly-iii data importer configuration
|
| services.sourcehut.settings."hg.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.routinator.settings.refresh | An integer value specifying the number of seconds Routinator should wait between consecutive validation runs in server mode
|
| services.udp-over-tcp.tcp2udp.<name>.bind | Which local IP to bind the UDP socket to.
|
| services.pid-fan-controller.settings.interval | Interval between controller cycles in milliseconds.
|
| services.tuned.settings.profile_dirs | Directories to search for profiles, separated by , or ;.
|
| services.tor.settings.ControlSocketsGroupWritable | See torrc manual.
|
| services.slskd.settings.shares.directories | Paths to shared directories
|
| <imports = [ pkgs.php.services.default ]>.php-fpm.settings.log_level | Error log level.
|
| services.ax25.axports.<name>.baud | The serial port speed of this interface.
|
| services.redis.servers.<name>.slaveOf.ip | IP of the Redis master
|
| i18n.inputMethod.fcitx5.settings.inputMethod | The input method configure in profile file in ini format.
|
| services.nsd.zones.<name>.maxRetrySecs | Limit retry time for secondary zones
|
| services.pretix.settings.memcached.location | The host:port combination or the path to the UNIX socket of a memcached instance
|
| services.crowdsec-firewall-bouncer.settings.mode | Firewall mode to use.
|
| services.hercules-ci-agent.settings.secretsJsonPath | Path to a JSON file containing secrets for effects
|
| services.litellm.settings.general_settings | LiteLLM Server settings
|
| services.litellm.settings.litellm_settings | LiteLLM Module settings
|
| services.firezone.server.settingsSecret | This is a convenience option which allows you to set secret values for
environment variables by specifying a file which will contain the value
at runtime
|
| services.suricata.settings.vars.address-groups.DC_SERVERS | DC_SERVERS variable.
|
| services.i2pd.outTunnels.<name>.inbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| services.sourcehut.settings."meta.sr.ht::billing".enabled | Whether to enable the billing system.
|
| services.omnom.settings.smtp.send_timeout | Send timeout duration in seconds.
|
| services.watchdogd.settings.loadavg.interval | Amount of seconds between every poll.
|
| services.watchdogd.settings.meminfo.interval | Amount of seconds between every poll.
|
| services.sourcehut.settings.mail.pgp-privkey | An absolute file path (which should be outside the Nix-store)
to an OpenPGP private key
|
| systemd.user.services.<name>.path | Packages added to the service's PATH
environment variable
|
| services.yggdrasil.settings.PrivateKeyPath | Path to the private key file on the host system
|
| systemd.services.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.reposilite.settings.database | Database connection string
|
| services.sourcehut.settings."git.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."man.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."hub.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.angrr.settings.temporary-root-policies | Policies for temporary GC roots(e.g. result and direnv).
|
| services.phpfpm.pools.<name>.listen | The address on which to accept FastCGI requests.
|
| services.nsd.zones.<name>.notifyRetry | Specifies the number of retries for failed notifies
|
| systemd.user.services.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.matrix-synapse.settings.listeners.*.tls | Whether to enable TLS on the listener socket.
This option will be ignored for UNIX domain sockets.
|
| services.tahoe.nodes.<name>.sftpd.enable | Whether to enable SFTP service.
|
| services.borgbackup.jobs.<name>.archiveBaseName | How to name the created archives
|
| services.tor.settings.DataDirectoryGroupReadable | See torrc manual.
|
| services.tor.settings.HiddenServiceNonAnonymousMode | See torrc manual.
|
| services.tor.settings.ConstrainedSockets | See torrc manual.
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.writefreely.database.name | The name of the database to store data in.
|
| security.loginDefs.settings.TTYPERM | The terminal permissions: the login tty will be owned by the TTYGROUP group,
and the permissions will be set to TTYPERM
|
| services.sourcehut.settings."lists.sr.ht".oauth-client-secret | lists.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."paste.sr.ht".oauth-client-secret | paste.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.sourcehut.settings."pages.sr.ht".oauth-client-secret | pages.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.nginx.virtualHosts.<name>.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| systemd.services.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.swapspace.settings.cooldown | Duration (roughly in seconds) of the moratorium on swap allocation that is instated if disk space runs out, or the cooldown time after a new swapfile is successfully allocated before swapspace will consider deallocating swap space again
|
| systemd.services.<name>.path | Packages added to the service's PATH
environment variable
|
| services.szurubooru.server.settings.secretFile | File containing a secret used to salt the users' password hashes and generate filenames for static content.
|
| nix.settings.auto-optimise-store | If set to true, Nix automatically detects files in the store that have
identical contents, and replaces them with hard links to a single copy
|
| services.ocsinventory-agent.settings.tag | Tag for the generated inventory.
|
| services.misskey.settings.meilisearch.scope | The search scope.
|
| services.pds.settings.PDS_BLOBSTORE_DISK_LOCATION | Store blobs at this location, set to null to use e.g
|
| services.umurmur.settings.certificate | Path to your SSL certificate
|
| services.umurmur.settings.private_key | Path to your SSL key
|
| services.saunafs.chunkserver.settings | Contents of chunkserver config file (see sfschunkserver.cfg(5)).
|
| services.libeufin.nexus.settings.nexus-ebics.BANK_PUBLIC_KEYS_FILE | Filesystem location where Nexus should store the bank public keys.
|
| services.suricata.settings.vars.address-groups.AIM_SERVERS | AIM_SERVERS variable.
|
| services.suricata.settings.vars.address-groups.DNS_SERVERS | DNS_SERVERS variable.
|
| services.suricata.settings.vars.address-groups.SQL_SERVERS | SQL_SERVERS variable.
|
| services.hickory-dns.settings.listen_port | Port to listen on (applies to all listen addresses).
|
| services.transmission.settings.peer-port | The peer port to listen for incoming connections.
|
| services.opensnitch.settings.Server.Address | Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
mandatory) or TCP socket (192.168.1.100:50051).
|
| services.lldap.settings.ldap_user_pass | Password for default admin password
|
| services.kimai.sites.<name>.package | The kimai package to use.
|
| services.tahoe.nodes.<name>.package | The tahoelafs package to use.
|
| services.homebridge.settings.platforms | Homebridge Platforms
|
| services.hercules-ci-agent.settings.baseDirectory | State directory (secrets, work directory, etc) for agent
|
| services.drupal.sites.<name>.enable | Whether to enable Drupal web application.
|
| services.tts.servers.<name>.extraArgs | Extra arguments to pass to the server commandline.
|
| services.tts.servers.<name>.enable | Whether to enable Coqui TTS server.
|
| services.canaille.settings.CANAILLE.SMTP.PASSWORD | SMTP Password
|
| services.bitcoind.<name>.rpc.port | Override the default port on which to listen for JSON-RPC connections.
|
| systemd.user.services.<name>.postStop | Shell commands executed after the service's main process
has exited.
|
| services.httpd.virtualHosts.<name>.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.bitcoind.<name>.user | The user as which to run bitcoind.
|
| services.geth.<name>.syncmode | Blockchain sync mode.
|
| services.geth.<name>.maxpeers | Maximum peers to connect to.
|
| services.postfix.settings.main.smtp_tls_CAfile | File containing CA certificates of root CAs trusted to sign either remote SMTP server certificates or intermediate CA certificates
|
| services.waagent.settings.ResourceDisk.FileSystem | The file system type for the resource disk
|
| services.misskey.settings.meilisearch.index | Meilisearch index to use.
|
| services.tor.settings.ExtendAllowPrivateAddresses | See torrc manual.
|
| services.kanidm.server.settings.bindaddress | Address/port combination the webserver binds to.
|
| services.stash.settings.stash_boxes.*.apikey | Stash Box API key
|
| systemd.services.<name>.postStop | Shell commands executed after the service's main process
has exited.
|
| security.loginDefs.settings.DEFAULT_HOME | Indicate if login is allowed if we can't cd to the home directory.
|
| services.canaille.settings.CANAILLE_OIDC.JWT.PRIVATE_KEY | JWT private key
|
| services.wastebin.settings.WASTEBIN_ADDRESS_PORT | Address and port to bind to
|
| services.wgautomesh.settings.peers.*.address | Wireguard address of this peer (a single IP address, multiple
addresses or address ranges are not supported).
|
| services.yggdrasil.settings.AllowedPublicKeys | List of peer public keys to allow incoming peering connections from
|
| services.borgbackup.jobs.<name>.startAt | When or how often the backup should run
|
| services.nextcloud-whiteboard-server.settings | Settings to configure backend server
|
| services.suwayomi-server.settings.server.downloadAsCbz | Download chapters as .cbz files.
|
| services.prowlarr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.whisparr.settings.log.analyticsEnabled | Send Anonymous Usage Data
|
| services.bind.zones.<name>.allowQuery | List of address ranges allowed to query this zone
|
| services.asusd.auraConfigs.<name>.text | Text of the file.
|
| services.h2o.hosts.<name>.acme.useHost | An existing Let’s Encrypt certificate to use for this virtual
host
|
| systemd.user.units.<name>.text | Text of this systemd unit.
|
| services.schleuder.settings.keyserver | Key server from which to fetch and update keys
|
| services.nbd.server.exports.<name>.path | File or block device to export.
|
| services.reposilite.settings.ioThreadPool | The IO thread pool handles all tasks that may benefit from non-blocking IO. (min: 2)
Because most tasks are redirected to IO thread pool, it might be a good idea to keep it at least equal to web thread pool.
|
| services.sourcehut.settings.objects.s3-upstream | Configure the S3-compatible object storage service.
|
| services.sourcehut.settings."meta.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."todo.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.pocket-id.settings.ANALYTICS_DISABLED | Whether to disable analytics
|
| services.bitmagnet.settings.dht_server.port | DHT listen port
|
| services.tlsrpt.collectd.settings.socketmode | Permissions on the UNIX socket.
|
| services.szurubooru.server.settings.data_dir | Path to the static files.
|
| services.parsedmarc.settings.imap.password | The IMAP server password
|
| services.parsedmarc.settings.smtp.password | The SMTP server password
|
| services.headscale.settings.server_url | The url clients will connect to.
|
| services.tor.settings.HiddenServiceStatistics | See torrc manual.
|
| services.tor.settings.PublishServerDescriptor | See torrc manual.
|
| services.tor.settings.FetchServerDescriptors | See torrc manual.
|
| services.suricata.settings.reference-config-file | Suricata reference configuration file.
|
| services.gitwatch.<name>.path | The path to repo in local machine
|
| services.epgstation.settings.socketioPort | Socket.io port for EPGStation to listen on
|
| services.sourcehut.settings."builds.sr.ht::worker".timeout | Max build duration
|
| power.ups.users.<name>.upsmon | Add the necessary actions for a upsmon process to work
|
| services.reposilite.settings.webThreadPool | Maximum amount of threads used by the core thread pool. (min: 5)
The web thread pool handles the first few steps of incoming HTTP connections, tasks are redirected as soon as possible to the IO thread pool.
|
| services.autorandr.profiles.<name>.config.<name>.enable | Whether to enable the output.
|
| services.autorandr.profiles.<name>.config.<name>.rotate | Output rotate configuration.
|
| services.transmission.settings.watch-dir | Watch a directory for torrent files and add them to transmission.
|
| security.acme.certs.<name>.domain | Domain to fetch certificate for (defaults to the entry name).
|
| services.k3s.autoDeployCharts.<name>.package | The packaged Helm chart
|
| services.dendrite.settings.sync_api.search.enabled | Whether to enable Dendrite's full-text search engine.
|
| services.anubis.defaultOptions.settings.BIND_NETWORK | The network family that Anubis should bind to
|
| services.suricata.settings.vars.address-groups.SMTP_SERVERS | SMTP_SERVERS variable.
|
| services.suricata.settings.vars.address-groups.HTTP_SERVERS | HTTP_SERVERS variable.
|
| services.languagetool.settings.cacheSize | Number of sentences cached.
|
| services.maubot.settings.api_features | API feature switches.
|
| services.maubot.settings.homeservers | Known homeservers
|
| services.opensnitch.settings.DefaultAction | Default action whether to block or allow application internet
access.
|
| services.szurubooru.server.settings.data_url | Full URL to the data endpoint.
|
| services.warpgate.settings.recordings.enable | Whether to enable session recording.
|
| services.hercules-ci-agent.settings.binaryCachesPath | Path to a JSON file containing binary cache secret keys
|
| services.h2o.hosts.<name>.tls.identity | Key / certificate pairs for the virtual host.
|
| services.nsd.zones.<name>.dnssecPolicy.zsk | Key policy for zone signing keys
|
| services.nsd.zones.<name>.dnssecPolicy.ksk | Key policy for key signing keys
|
| services.restic.backups.<name>.user | As which user the backup should run.
|
| services.canaille.settings.PREFERRED_URL_SCHEME | The url scheme by which canaille will be served.
|
| services.gitlab.pages.settings.internal-gitlab-server | Internal GitLab server used for API requests, useful
if you want to send that traffic over an internal load
balancer
|
| services.hercules-ci-agent.settings.workDirectory | The directory in which temporary subdirectories are created for task state
|
| services.oncall.settings.db.conn.require_auth | Whether authentication is required to access the web app.
|
| services.omnom.settings.activitypub.privkey | ActivityPub private key
|
| services.nginx.virtualHosts.<name>.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.nginx.virtualHosts.<name>.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.filesender.settings.site_url | Site URL
|
| services.bind.zones.<name>.extraConfig | Extra zone config to be appended at the end of the zone section.
|
| systemd.user.services.<name>.preStart | Shell commands executed before the service's main process
is started.
|
| services.suricata.settings.logging.outputs.syslog.format | Logformat for logs send to syslog.
|
| services.suricata.settings.logging.outputs.syslog.enable | Whether to enable logging to syslog.
|
| services.kanidm.unix.settings.hsm_pin_path | Path to a HSM pin.
|
| services.tor.settings.CacheDirectoryGroupReadable | See torrc manual.
|
| services.suricata.settings.stats.decoder-events-prefix | Decoder event prefix in stats
|
| services.watchdogd.settings.loadavg.critical | The critical watermark level
|
| services.watchdogd.settings.meminfo.critical | The critical watermark level
|
| services.szurubooru.server.settings.show_sql | Whether to show SQL in server logs.
|
| services.bitcoind.<name>.port | Override the default port on which to listen for connections.
|
| services.mackerel-agent.settings.diagnostic | Whether to enable collecting memory usage for the agent itself.
|
| systemd.services.<name>.preStart | Shell commands executed before the service's main process
is started.
|
| services.matrix-appservice-irc.settings.ircService | IRC bridge configuration
|
| services.privoxy.settings.actionsfile | List of paths to Privoxy action files
|
| services.spiped.config.<name>.keyfile | Name of a file containing the spiped key
|
| services.sourcehut.settings."git.sr.ht::api".internal-ipnet | Set of IP subnets which are permitted to utilize internal API
authentication
|
| services.prosody.virtualHosts.<name>.domain | Domain name
|
| services.saunafs.chunkserver.settings.DATA_PATH | Directory for chunck meta data
|
| services.redis.servers.<name>.port | The TCP port to accept connections
|
| services.nginx.proxyCachePath.<name>.maxSize | Set maximum cache size
|
| services.suricata.settings.dpdk.interfaces | See upstream docs: docs/capture-hardware/dpdk and docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk.
|
| services.waagent.settings.ResourceDisk.Format | If set to true, waagent formats and mounts the resource disk that the platform provides,
unless the file system type in `ResourceDisk
|
| services.ocsinventory-agent.settings.ca | Path to CA certificates file in PEM format, for server
SSL certificate validation.
|
| services.taler.exchange.settings.exchange.CURRENCY | The currency which the exchange will operate with
|
| security.pam.services.<name>.rootOK | If set, root doesn't need to authenticate (e.g. for the
useradd service).
|
| services.prometheus.exporters.ping.settings | Configuration for ping_exporter, see
https://github.com/czerwonk/ping_exporter
for supported values.
|
| services.waagent.settings.AutoUpdate.UpdateToLatestVersion | Whether or not to enable auto-update of the Extension Handler.
|
| services.suricata.settings.af-packet.*.interface | af-packet capture interface, see upstream docs reagrding tuning.
|
| programs.neovim.runtime.<name>.target | Name of symlink
|
| networking.ifstate.settings | Content of IfState's configuration file
|
| services.filebrowser.settings.database | The path to FileBrowser's Bolt database.
|
| services.opensnitch.settings.ProcMonitorMethod | Which process monitoring method to use.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.module | Optional PKCS#11 module name.
|
| services.sourcehut.settings."builds.sr.ht".oauth-client-secret | builds.sr.ht's OAuth client secret for meta.sr.ht.
|
| services.moosefs.chunkserver.settings.DATA_PATH | Directory for lock files and other runtime data.
|
| services.snapserver.settings.tcp-control.enabled | Whether to enable the TCP JSON-RPC.
|
| services.suricata.settings.logging.default-log-level | The default log level: can be overridden in an output section
|
| users.users.<name>.shell | The path to the user's shell
|
| services.suricata.settings.vars.address-groups.MODBUS_CLIENT | MODBUS_CLIENT variable
|
| services.suricata.settings.vars.address-groups.MODBUS_SERVER | MODBUS_SERVER variable.
|
| services.listmonk.database.settings.smtp.*.tls_type | Type of TLS authentication with the SMTP server
|
| services.sabnzbd.settings.misc.cache_limit | Size of the RAM cache, in bytes (prefixes supported)
|
| services.redis.servers.<name>.slaveOf.port | port of the Redis master
|
| services.healthchecks.settingsFile | Environment variables which are read by healthchecks (local)_settings.py
|
| services.nebula-lighthouse-service.settings | Configuration for nebula-lighthouse-service.
|
| services.slskd.settings.global.upload.speed_limit | Total upload speed limit.
|
| services.matrix-synapse.settings.presence.enabled | Whether to enable presence tracking
|
| services.waagent.settings.ResourceDisk.MountOptions | This option specifies disk mount options to be passed to the mount -o command
|
| services.firewalld.settings.CleanupModulesOnExit | Whether to unload all firewall-related kernel modules when firewalld stops.
|
| services.snapserver.settings.tcp-streaming.port | Port to listen on for snapclient connections.
|
| services.warpgate.settings.http.certificate | Path to HTTPS listener certificate.
|
| services.nginx.virtualHosts.<name>.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| systemd.user.services.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.geth.<name>.authrpc.vhosts | List of virtual hostnames from which to accept requests.
|
| services.hans.clients.<name>.server | IP address of server running hans
|
| services.drupal.sites.<name>.themesDir | The location for users to install Drupal themes.
|
| services.nsd.zones.<name>.minRefreshSecs | Limit refresh time for secondary zones.
|
| services.spiped.config.<name>.maxConns | Limit on the number of simultaneous connections allowed.
|
| services.amule.settings.ExternalConnect.ECPassword | MD5 hash of the password, obtainaible with echo "<password>" | md5sum | cut -d ' ' -f 1
|
| services.tinyproxy.settings.Anonymous | If an Anonymous keyword is present, then anonymous proxying is enabled
|
| services.sourcehut.settings."pages.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."lists.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."paste.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| systemd.automounts.*.name | The name of this systemd unit, including its extension
|
| services.opensnitch.settings.Audit.AudispSocketPath | Configure audit socket path
|
| services.bitmagnet.settings.postgres.password | Password for database user
|
| services.bitcoind.<name>.dataDir | The data directory for bitcoind.
|
| services.hostapd.radios.<name>.networks.<name>.bssid | Specifies the BSSID for this BSS
|
| services.fedimintd.<name>.nginx.config.locations.<name>.root | Root directory for requests.
|
| services.autorandr.profiles.<name>.config.<name>.scale.method | Output scaling method.
|
| boot.initrd.systemd.tmpfiles.settings | Similar to systemd.tmpfiles.settings but the rules are
only applied by systemd-tmpfiles before initrd-switch-root.target
|
| services.tor.settings.AuthDirHasIPv6Connectivity | See torrc manual.
|
| services.opengfw.settings.workers.tcpMaxBufferedPagesTotal | TCP max total buffered pages.
|
| services.quickwit.settings.rest.listen_port | The port to listen on for HTTP REST traffic.
|
| services.wastebin.settings.WASTEBIN_HTTP_TIMEOUT | Maximum number of seconds a request can be processed until wastebin responds with 408
|
| services.keycloak.settings.http-relative-path | The path relative to / for serving
resources.
In versions of Keycloak using Wildfly (<17),
this defaulted to /auth
|
| services.znapzend.zetup.<name>.destinations.<name>.label | Label for this destination
|
| users.extraGroups.<name>.gid | The group GID
|
| services.headscale.settings.database.postgres.user | Database user.
|
| services.opengfw.settings.workers.tcpMaxBufferedPagesPerConn | TCP max total bufferd pages per connection.
|
| services.immichframe.settings.Accounts | Accounts configuration, multiple are permitted
|
| boot.initrd.luks.devices.<name>.keyFile | The name of the file (can be a raw device or a partition) that
should be used as the decryption key for the encrypted device
|
| services.draupnir.settings.homeserverUrl | Base URL of the Matrix homeserver that provides the Client-Server API.
|
| boot.initrd.luks.devices.<name>.header | The name of the file or block device that
should be used as header for the encrypted device.
|
| services.rsync.jobs.<name>.inhibit | Run the rsync process with an inhibition lock taken;
see systemd-inhibit(1) for a list of possible operations.
|
| services.epgstation.settings.mirakurunPath | URL to connect to Mirakurun.
|
| services.opensearch.settings."discovery.type" | The type of discovery to use.
|
| services.sourcehut.settings."meta.sr.ht::api".internal-ipnet | Set of IP subnets which are permitted to utilize internal API
authentication
|
| security.pam.services.<name>.showMotd | Whether to show the message of the day.
|
| services.garage.settings.metadata_dir | The metadata directory, put this on a fast disk (e.g
|
| systemd.services.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.scrutiny.collector.settings.api.endpoint | Scrutiny app API endpoint for sending metrics to.
|
| services.geth.<name>.metrics.enable | Whether to enable Go Ethereum prometheus metrics.
|
| services.bitcoind.<name>.rpc.users | RPC user information for JSON-RPC connections.
|
| services.redis.servers.<name>.slaveOf | IP and port to which this redis instance acts as a slave.
|
| systemd.user.services.<name>.script | Shell commands executed as the service's main process.
|
| services.epgstation.settings.encodeProcessNum | The maximum number of processes that EPGStation would allow to run
at the same time for encoding or streaming videos.
|
| services.sourcehut.settings."sr.ht".service-key | An absolute file path (which should be outside the Nix-store)
to a key used for encrypting session cookies
|
| services.suricata.settings.dpdk | Data Plane Development Kit is a framework for fast packet processing in data plane applications running on a wide variety of CPU architectures
|
| services.bacula-sd.director.<name>.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.bacula-fd.director.<name>.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.headscale.settings.database.postgres.host | Database host address.
|
| services.headscale.settings.database.postgres.port | Database host port.
|
| security.agnos.settings.accounts.*.email | Email associated with this account.
|
| services.matrix-synapse.settings.listeners | List of ports that Synapse should listen on, their purpose and their configuration
|
| services.glitchtip.settings.GLITCHTIP_DOMAIN | The URL under which GlitchTip is externally reachable.
|
| services.tor.settings.PublishHidServDescriptors | See torrc manual.
|
| services.tor.settings.MaxAdvertisedBandwidth | See torrc manual.
|
| services.opensearch.settings."transport.port" | The port to listen on for transport traffic.
|
| services.ocsinventory-agent.settings.debug | Whether to enable debug mode.
|
| services.dependency-track.settings."alpine.oidc.client.id" | Defines the client ID to be used for OpenID Connect
|
| services.hickory-dns.settings.zones.*.zone_type | One of:
- "Primary" (the master, authority for the zone).
- "Secondary" (the slave, replicated from the primary).
- "External" (a cached zone that queries other nameservers)
|
| services.bitcoind.<name>.pidFile | Location of bitcoind pid file.
|
| services.netbird.server.dashboard.settings | An attribute set that will be used to substitute variables when building the dashboard
|
| services.suricata.settings.vars.address-groups.EXTERNAL_NET | EXTERNAL_NET variable.
|
| services.etebase-server.settings.global.media_root | The media directory.
|
| services.fastnetmon-advanced.settings | Extra configuration options to declaratively load into FastNetMon Advanced
|
| services.mautrix-discord.settings.homeserver | fullDataDiration
|
| systemd.services.<name>.script | Shell commands executed as the service's main process.
|
| services.swapspace.settings.freetarget | Percentage of free space swapspace should aim for when adding swapspace
|
| services.wgautomesh.settings.interface | Wireguard interface to manage (it is NOT created by wgautomesh, you
should use another NixOS option to create it such as
networking.wireguard.interfaces.wg0 = {...};).
|
| services.wgautomesh.settings.peers.*.endpoint | Bootstrap endpoint for connecting to this Wireguard peer if no
other address is known or none are working.
|
| services.cgit.<name>.nginx.location | Location to serve cgit under.
|
| services.rspamd.locals.<name>.source | Path of the source file.
|
| services.spiped.config.<name>.target | Address to which spiped should connect.
|
| nix.registry.<name>.to | The flake reference from is rewritten to
|
| users.users.<name>.enable | If set to false, the user account will not be created
|
| security.pam.services.<name>.oathAuth | If set, the OATH Toolkit will be used.
|
| services.kimai.sites.<name>.poolConfig | Options for the Kimai PHP pool
|
| services.anuko-time-tracker.settings.defaultCurrency | Defines a default currency symbol for new groups
|
| services.minidlna.settings.enable_tivo | Support for streaming .jpg and .mp3 files to a TiVo supporting HMO.
|
| services.geth.<name>.authrpc.enable | Whether to enable Go Ethereum Auth RPC API.
|
| systemd.user.services.<name>.postStart | Shell commands executed after the service's main process
is started.
|
| systemd.user.services.<name>.reload | Shell commands executed when the service's main process
is reloaded.
|
| services.i2pd.inTunnels.<name>.outbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| services.reposilite.settings.keyPassword | Plaintext password used to unlock the Java KeyStore set in services.reposilite.settings.keyPath
|
| services.sftpgo.settings.webdavd.bindings.*.address | Network listen address
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.module | Optional PKCS#11 module name.
|
| services.grafana.settings.security.admin_user | Default admin username.
|
| services.matrix-appservice-irc.settings.database | Configuration for the database
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.keySize | Key size in bits
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.keySize | Key size in bits
|
| services.mautrix-discord.settings.appservice | Appservice configuration
|
| services.fastnetmon-advanced.traffic_db.settings | Additional settings for /etc/fastnetmon/traffic_db.conf
|
| services.awstats.configs.<name>.extraConfig | Extra configuration to be appended to awstats.${name}.conf.
|
| services.suricata.settings.logging.default-log-format | The default output format
|
| services.tahoe.nodes.<name>.helper.enable | Whether to enable helper service.
|
| services.bitcoind.<name>.group | The group as which to run bitcoind.
|
| services.grafana.settings.database.password | The database user's password (not applicable for sqlite3)
|
| services.tor.settings.FetchUselessDescriptors | See torrc manual.
|
| users.users.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| services.geoipupdate.settings.EditionIDs | List of database edition IDs
|
| hardware.bluetooth.settings | Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf)
|
| services.syncthing.settings.options.relaysEnabled | When true, relays will be connected to and potentially used for device to device connections.
|
| services.phpfpm.pools.<name>.socket | Path to the unix socket file on which to accept FastCGI requests.
This option is read-only and managed by NixOS.
|
| systemd.services.<name>.postStart | Shell commands executed after the service's main process
is started.
|
| systemd.services.<name>.reload | Shell commands executed when the service's main process
is reloaded.
|
| services.slskd.settings.soulseek.description | The user description for the Soulseek network.
|
| services.slskd.settings.soulseek.listen_port | The port on which to listen for incoming connections.
|
| services.warpgate.settings.mysql.certificate | Path to MySQL listener certificate.
|
| systemd.user.services.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.suricata.settings.logging.outputs.console.enable | Whether to enable logging to console.
|
| services.hddfancontrol.settings | Parameter-sets for each instance of hddfancontrol.
|
| networking.wireguard.interfaces.<name>.peers.*.name | Name used to derive peer unit name.
|
| services.sourcehut.settings."builds.sr.ht::worker".bind-address | HTTP bind address for serving local build information/monitoring.
|
| services.matrix-synapse.settings.listeners.*.path | Unix domain socket path to bind this listener to.
|
| services.httpd.virtualHosts.<name>.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.nginx.virtualHosts.<name>.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.geoipupdate.settings.LicenseKey | A file containing the MaxMind license key
|
| services.grafana.provision.alerting.rules.settings | Grafana rules configuration in Nix
|
| services.bacula-sd.director.<name>.tls.enable | Specifies if TLS should be enabled
|
| services.bacula-fd.director.<name>.tls.enable | Specifies if TLS should be enabled
|
| services.adguardhome.settings | AdGuard Home configuration
|
| services.i2pd.outTunnels.<name>.outbound.length | Guaranteed minimum hops for ‹name› tunnels.
|
| services.taler.exchange.settings.exchange.MASTER_PUBLIC_KEY | Used by the exchange to verify information signed by the offline system.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.P | K_p of PID controller.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.D | K_d of PID controller.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.I | K_i of PID controller.
|
| services.nsd.zones.<name>.provideXFR | Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
address range 192.0.2.0/24, 1.2.3.4&255.255.0.0, 3.0.2.20-3.0.2.40
|
| services.fedimintd.<name>.nginx.config.locations.<name>.alias | Alias directory for requests.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.index | Adds index directive.
|
| services.tor.settings.ExitPolicyRejectLocalInterfaces | See torrc manual.
|
| services.tor.settings.ConnDirectionStatistics | See torrc manual.
|
| services.rosenpass.settings.public_key | Path to a file containing the public key of the local Rosenpass peer
|
| services.rosenpass.settings.secret_key | Path to a file containing the secret key of the local Rosenpass peer
|
| services.nix-store-gcs-proxy.<name>.enable | Whether to enable proxy for this bucket
|
| services.jupyter.kernels.<name>.displayName | Name that will be shown to the user.
|
| systemd.paths.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.drupal.sites.<name>.package | The drupal package to use.
|
| services.autorandr.profiles.<name>.config.<name>.primary | Whether output should be marked as primary
|
| services.openvpn.servers.<name>.up | Shell commands executed when the instance is starting.
|
| services.tlsrpt.reportd.settings.http_script | Call to an HTTPS client, that accepts the URL on the commandline and the request body from stdin.
|
| services.grafana.settings.smtp.from_address | Address used when sending out emails.
|
| services.crowdsec.settings.lapi.credentialsFile | The LAPI credential file to use.
|
| services.crowdsec.settings.capi.credentialsFile | The CAPI credential file to use.
|
| services.sourcehut.settings."pages.sr.ht::api".internal-ipnet | Set of IP subnets which are permitted to utilize internal API
authentication
|
| security.loginDefs.settings.TTYGROUP | The terminal permissions: the login tty will be owned by the TTYGROUP group,
and the permissions will be set to TTYPERM
|
| services.nginx.virtualHosts.<name>.http3 | Whether to enable the HTTP/3 protocol
|
| services.suricata.settings.pcap-file.checksum-checks | Possible values are:
- yes: checksum validation is forced
- no: checksum validation is disabled
- auto: Suricata uses a statistical approach to detect when
checksum off-loading is used. (default)
Warning: 'checksum-validation' must be set to yes to have checksum tested.
|
| systemd.services.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.paths.<name>.wants | Start the specified units when this unit is started.
|
| services.stash.settings.stash.*.excludevideo | Whether to exclude video files from being scanned into Stash
|
| services.stash.settings.stash.*.excludeimage | Whether to exclude image files from being scanned into Stash
|
| services.sourcehut.settings."builds.sr.ht".migrate-on-upgrade | Whether to enable automatic migrations on package upgrade.
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-public-key | Public key for Stripe
|
| services.suwayomi-server.settings.server.systemTrayEnabled | Whether to enable a system tray icon, if possible.
|
| services.xserver.displayManager.lightdm.greeter.name | The name of a .desktop file in the directory specified
in the 'package' option.
|
| services.autosuspend.checks.<name>.class | Name of the class implementing the check
|
| services.filebeat.modules.<name>.module | The name of the module
|
| services.syncoid.commands.<name>.source | Source ZFS dataset
|
| nix.settings.sandbox | If set, Nix will perform builds in a sandboxed environment that it
will set up automatically for each build
|
| services.stash.settings.scrapers_path | Path to scrapers
|
| services.stash.settings.blobs_storage | Where to store blobs
|
| programs.openvpn3.netcfg.settings | Options stored in /etc/openvpn3/netcfg.json configuration file
|
| services.globalprotect.settings | GlobalProtect-openconnect configuration
|
| services.sabnzbd.settings.misc.enable_https | Whether to enable HTTPS for the web UI
|
| services.sabnzbd.settings.misc.email_server | SMTP server for email alerts (server:host)
|
| services.suricata.settings.vars.address-groups.TELNET_SERVERS | TELNET_SERVERS variable.
|
| services.tor.settings.GuardfractionFile | See torrc manual.
|
| services.draupnir.settings.rawHomeserverUrl | Public base URL of the Matrix homeserver that provides the Client-Server API when using the Draupnir's
Report forwarding feature.
When using Pantalaimon, do not set this to the Pantalaimon URL!
|
| services.nezha-agent.settings.report_delay | The interval between system status reportings
|
| services.suwayomi-server.settings.server.basicAuthEnabled | Whether to enable basic access authentication for Suwayomi-Server
|
| services.fedimintd.<name>.ui.bind | Address to bind on for UI connections
|
| services.jupyter.kernels.<name>.env | Environment variables to set for the kernel.
|
| services.redis.servers.<name>.syslog | Enable logging to the system logger.
|
| services.redis.servers.<name>.enable | Whether to enable Redis server.
|
| services.rspamd.workers.<name>.count | Number of worker instances to run
|
| services.nginx.virtualHosts.<name>.root | The path of the web root directory.
|
| services.nebula.networks.<name>.ca | Path to the certificate authority certificate.
|
| services.ocsinventory-agent.settings | Configuration for /etc/ocsinventory-agent/ocsinventory-agent.cfg
|
| services.redis.servers.<name>.slowLogMaxLen | Maximum number of items to keep in slow log.
|
| services.rspamd.workers.<name>.type | The type of this worker
|
| security.pam.services.<name>.otpwAuth | If set, the OTPW system will be used (if
~/.otpw exists).
|
| services.quicktun.<name>.tunMode | Whether to operate in tun (IP) or tap (Ethernet) mode.
|
| services.journald.remote.settings.Remote.ServerKeyFile | A path to a SSL secret key file in PEM format
|
| nix.registry.<name>.flake | The flake input from is rewritten to.
|
| services.tinc.networks.<name>.hostSettings.<name>.rsaPublicKey | Legacy RSA public key of the host in PEM format, including start and
end markers
|
| services.librespeed.frontend.servers.*.name | Name shown in the server list.
|
| services.slskd.settings.retention.files.incomplete | Lifespan of incomplete downloading files in minutes.
|
| services.grafana.settings.database.cache_mode | For sqlite3 only.
Shared cache setting used for connecting to the database.
|
| services.nextcloud-spreed-signaling.settings.mcu.type | The type of MCU to use
|
| services.maubot.settings.server.ui_base_path | The base path for the UI.
|
| services.hostapd.radios.<name>.networks.<name>.macDenyFile | Specifies a file containing the MAC addresses to deny if macAcl is set to "deny" or "radius"
|
| services.crab-hole.settings.blocklist.allow_list | List of allowlists
|
| services.namecoind.rpc.user | User name for RPC connections.
|
| services.grafana.settings.server.socket_gid | GID where the socket should be set when protocol=socket
|
| services.neo4j.ssl.policies.<name>.privateKey | The name of private PKCS #8 key file for this policy to be found
in the baseDirectory, or the absolute path to
the key file
|
| services.hostapd.radios.<name>.networks.<name>.macAcl | Station MAC address -based authentication
|
| services.stash.settings.preview_audio | Include audio stream in previews
|
| services.nsd.keys.<name>.algorithm | Authentication algorithm for this key.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.tryFiles | Adds try_files directive.
|
| services.fedimintd.<name>.ui.port | TCP Port to bind on for UI connections
|
| services.fedimintd.<name>.p2p.url | Public address for p2p connections from peers (if TCP is used)
|
| security.pam.services.<name>.unixAuth | Whether users can log in with passwords defined in
/etc/shadow.
|
| services.redis.servers.<name>.logLevel | Specify the server verbosity level, options: debug, verbose, notice, warning.
|
| services.moosefs.cgiserver.settings.GUISERV_LISTEN_PORT | Port for GUI server to listen on.
|
| services.firewalld.settings.NftablesCounters | Whether to add a counter to every nftables rule.
|
| security.wrappers.<name>.program | The name of the wrapper program
|
| services.libeufin.bank.settings.libeufin-bank.CURRENCY | The currency under which the libeufin-bank should operate
|
| i18n.inputMethod.fcitx5.settings.globalOptions | The global options in config file in ini format.
|
| users.users.<name>.extraGroups | The user's auxiliary groups.
|
| services.wastebin.settings.WASTEBIN_DATABASE_PATH | Path to the sqlite3 database file
|
| services.grafana.settings.server.socket_mode | Mode where the socket should be set when protocol=socket
|
| services.waagent.settings.Provisioning.Agent | Which provisioning agent to use.
|
| services.bacula-sd.device.<name>.mediaType | The specified name-string names the type of media supported by this
device, for example, DLT7000
|
| services.transmission.settings.umask | Sets transmission's file mode creation mask
|
| services.dependency-track.settings."alpine.ldap.enabled" | Defines if LDAP will be used for user authentication
|
| services.grafana-image-renderer.settings.rendering.args | List of CLI flags passed to chromium.
|
| services.matrix-continuwuity.settings | Generates the continuwuity.toml configuration file
|
| services.sympa.domains.<name>.webHost | Domain part of the web interface URL (no web interface for this domain if null)
|
| services.acpid.handlers.<name>.event | Event type.
|
| systemd.user.services.<name>.aliases | Aliases of that unit.
|
| security.pam.services.<name>.enable | Whether to enable this PAM service.
|
| services.nebula.networks.<name>.key | Path or reference to the host key.
|
| services.tor.settings.ClientRejectInternalAddresses | See torrc manual.
|
| services.ndppd.proxies.<name>.router | Turns on or off the router flag for Neighbor Advertisement Messages.
|
| users.users.<name>.cryptHomeLuks | Path to encrypted luks device that contains
the user's home directory.
|
| services.bitmagnet.settings.http_server.port | HTTP server listen port
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| environment.etc.<name>.target | Name of symlink (relative to
/etc)
|
| services.tahoe.nodes.<name>.client.helper | The furl for a Tahoe helper node
|
| services.bird-lg.frontend.nameFilter | Protocol names to hide in summary tables (RE2 syntax),
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.module | Optional PKCS#11 module name.
|
| services.dependency-track.settings."alpine.oidc.enabled" | Defines if OpenID Connect will be used for user authentication
|
| services.moosefs.cgiserver.settings.GUISERV_LISTEN_HOST | IP address to bind GUI server to (* means any).
|
| services.pretix.settings.pretix.registration | Whether to allow registration of new admin users.
|
| services.syncthing.settings.options.localAnnouncePort | The port on which to listen and send IPv4 broadcast announcements to.
|
| services.crowdsec-firewall-bouncer.settings.api_url | URL of the local API.
|
| services.dependency-track.settings."alpine.oidc.issuer" | Defines the issuer URL to be used for OpenID Connect
|
| services.grafana.provision.alerting.rules.settings.groups | List of rule groups to import or update.
|
| services.r53-ddns.hostname | Manually specify the hostname
|
| services.listmonk.database.settings.smtp.*.max_conns | Maximum number of simultaneous connections, defaults to 1
|
| services.nextcloud-spreed-signaling.settings | Declarative configuration
|
| services.libeufin.nexus.settings.nexus-ebics.CLIENT_PRIVATE_KEYS_FILE | Filesystem location where Nexus should store the subscriber private keys.
|
| services.healthchecks.settings.SECRET_KEY_FILE | Path to a file containing the secret key.
|
| services.suricata.settings.logging.default-output-filter | A regex to filter output
|
| security.loginDefs.settings.ENCRYPT_METHOD | This defines the system default encryption algorithm for encrypting passwords.
|
| services.dependency-track.settings."alpine.database.url" | Specifies the JDBC URL to use when connecting to the database.
|
| services.pretalx.settings.files.upload_limit | Maximum file upload size in MiB.
|
| services.suricata.settings.logging.outputs.syslog.facility | Facility to log to.
|
| services.jupyter.kernels.<name>.language | Language of the environment
|
| services.logind.settings.Login.KillUserProcesses | Specifies whether the processes of a user should be killed
when the user logs out
|
| services.ferretdb.settings.FERRETDB_TELEMETRY | Enable or disable basic telemetry
|
| services.transmission.settings.utp-enabled | Whether to enable Micro Transport Protocol (µTP).
|
| services.stash.settings.calculate_md5 | Whether to calculate MD5 checksums for scene video files
|
| services.awstats.configs.<name>.type | The type of log being collected.
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-secret-key | An absolute file path (which should be outside the Nix-store)
to a secret key for Stripe
|
| systemd.services.<name>.aliases | Aliases of that unit.
|
| services.librenms.distributedPoller.name | Custom name of this poller.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.slot | Optional slot number of the token that stores the certificate.
|
| services.dokuwiki.sites.<name>.acl.*.page | Page or namespace to restrict
|
| services.drupal.sites.<name>.configSyncDir | The location of the Drupal config sync directory.
|
| services.tor.settings.DoSRefuseSingleHopClientRendezvous | See torrc manual.
|
| systemd.user.services.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.iodine.clients.<name>.relay | DNS server to use as an intermediate relay to the iodined server
|
| security.pam.services.<name>.pamMount | Enable PAM mount (pam_mount) system to mount filesystems on user login.
|
| services.kanidm.provision.systems.oauth2.<name>.claimMaps.<name>.joinType | Determines how multiple values are joined to create the claim value
|
| services.kimai.sites.<name>.database.user | Database user.
|
| services.sourcehut.settings."hg.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.dendrite.settings.media_api.base_path | Storage path for uploaded media.
|
| services.firewalld.settings.NftablesTableOwner | If enabled, the generated nftables rule set will be owned exclusively by firewalld
|
| services.reposilite.settings.defaultFrontend | Whether to enable the default included frontend with a dashboard.
|
| services.bitcoind.<name>.dbCache | Override the default database cache size in MiB.
|
| services.pgbackrest.stanzas.<name>.jobs.<name>.schedule | When or how often the backup should run
|
| services.authelia.instances.<name>.user | The name of the user for this authelia instance.
|
| services.v4l2-relayd.instances.<name>.cardLabel | The name the camera will show up as.
|
| services.nextcloud-spreed-signaling.settings.nats.url | URL of one or more NATS backends to use
|
| services.i2pd.inTunnels.<name>.inbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.hercules-ci-agent.settings.clusterJoinTokenPath | Location of the cluster-join-token.key file
|
| services.ocsinventory-agent.settings.local | If specified, the OCS Inventory Agent will run in offline mode
and the resulting inventory file will be stored in the specified path.
|
| services.routinator.settings.repository-dir | The path where the collected RPKI data is stored.
|
| services.rosenpass.settings.peers.*.public_key | Path to a file containing the public key of the remote Rosenpass peer.
|
| systemd.user.paths.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| security.pam.services.<name>.p11Auth | If set, keys listed in
~/.ssh/authorized_keys and
~/.eid/authorized_certificates
can be used to log in with the associated PKCS#11 tokens.
|
| services.ndppd.proxies.<name>.rules | This is a rule that the target address is to match against
|
| services.suwayomi-server.settings.server.extensionRepos | URL of repositories from which the extensions can be installed.
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets | The subnets which this tinc daemon will serve
|
| services.nextcloud.settings.loglevel | Log level value between 0 (DEBUG) and 4 (FATAL).
-
0 (debug): Log all activity.
-
1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
-
2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
-
3 (error): Log failed operations and fatal errors.
-
4 (fatal): Log only fatal errors that cause the server to stop.
|
| services.anuko-time-tracker.settings.defaultLanguage | Defines Anuko Time Tracker default language
|
| services.jupyter.kernels.<name>.argv | Command and arguments to start the kernel.
|
| services.bacula-sd.director.<name>.tls | TLS Options for the Director in this Configuration.
|
| services.bepasty.servers.<name>.bind | Bind address to be used for this server.
|
| services.bacula-fd.director.<name>.tls | TLS Options for the Director in this Configuration.
|
| services.netbird.tunnels.<name>.port | Port the NetBird client listens on.
|
| services.netbird.clients.<name>.port | Port the NetBird client listens on.
|
| services.pid-fan-controller.settings.fans.*.heatPressureSrcs | Heat pressure sources affected by the fan.
|
| services.stash.settings.stash_boxes.*.endpoint | URL to the Stash Box graphql api
|
| security.agnos.settings.accounts | A list of ACME accounts
|
| services.znapzend.zetup.<name>.destinations.<name>.dataset | Dataset name to send snapshots to.
|
| services.kerberos_server.settings | Settings for the kerberos server of choice
|
| services.keyd.keyboards.<name>.ids | Device identifiers, as shown by keyd(1).
|
| services.udp-over-tcp.udp2tcp.<name>.fwmark | If given, sets the SO_MARK option on the TCP socket.
|
| services.udp-over-tcp.tcp2udp.<name>.fwmark | If given, sets the SO_MARK option on the TCP socket.
|
| services.nginx.virtualHosts.<name>.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.rspamd.locals.<name>.enable | Whether this file locals should be generated
|
| services.kimai.sites.<name>.database.host | Database host address.
|
| services.kimai.sites.<name>.database.port | Database host port.
|
| services.errbot.instances.<name>.backend | Errbot backend name.
|
| services.tor.settings.ClientDNSRejectInternalAddresses | See torrc manual.
|
| services.tor.settings.DisableDebuggerAttachment | See torrc manual.
|
| services.tor.settings.DormantTimeoutDisabledByIdleStreams | See torrc manual.
|
| services.hostapd.radios.<name>.networks.<name>.macAllowFile | Specifies a file containing the MAC addresses to allow if macAcl is set to "allow" or "radius"
|
| services.sourcehut.settings."hub.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."git.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."man.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.bacula-sd.autochanger.<name>.changerDevice | The specified name-string must be the generic SCSI device name of the
autochanger that corresponds to the normal read/write Archive Device
specified in the Device resource
|
| services.openvpn.servers.<name>.authUserPass.username | The username to store inside the credentials file.
|
| systemd.user.paths.<name>.wants | Start the specified units when this unit is started.
|
| services.syncthing.settings.options.urAccepted | Whether the user has accepted to submit anonymous usage data
|
| services.fedimintd.<name>.nginx.config.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.ax25.axports.<name>.window | Default window size for this interface.
|
| services.uhub.<name>.plugins.*.plugin | Path to plugin file.
|
| services.autorandr.profiles.<name>.config.<name>.position | Output position
|
| services.xserver.xkb.extraLayouts.<name>.typesFile | The path to the xkb types file
|
| ec2.zfs.datasets.<name>.mount | Where to mount this dataset.
|
| services.canaille.settings.CANAILLE_SQL.DATABASE_URI | The SQL server URI
|
| nix.registry.<name>.from | The flake reference to be rewritten
|
| systemd.services.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| security.acme.certs.<name>.s3Bucket | S3 bucket name to use for HTTP-01 based challenges
|
| networking.wireless.iwd.settings | Options passed to iwd
|
| services.listmonk.database.settings.messengers | List of messengers, see: https://github.com/knadh/listmonk/blob/master/models/settings.go#L64-L74 for options.
|
| services.dendrite.settings.sync_api.search.language | The language most likely to be used on the server - used when indexing, to
ensure the returned results match expectations
|
| services.geth.<name>.websocket.apis | APIs to enable over WebSocket
|
| services.nebula.networks.<name>.cert | Path to the host certificate.
|
| services.redis.servers.<name>.user | User account under which this instance of redis-server runs.
If left as the default value this user will automatically be
created on system activation, otherwise you are responsible for
ensuring the user exists before the redis service starts.
|
| services.bonsaid.settings.*.transitions | List of transitions out of this state
|
| services.drupal.sites.<name>.modulesDir | The location for users to install Drupal modules.
|
| services.i2pd.inTunnels.<name>.accessList | I2P nodes that are allowed to connect to this service.
|
| services.openvpn.servers.<name>.down | Shell commands executed when the instance is shutting down.
|
| services.public-inbox.inboxes.<name>.url | URL where this inbox can be accessed over HTTP.
|
| services.hostapd.radios.<name>.noScan | Disables scan for overlapping BSSs in HT40+/- mode
|
| services.i2pd.outTunnels.<name>.inbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.fedimintd.<name>.p2p.port | Port to bind on for p2p connections from peers (both TCP and UDP)
|
| services.fedimintd.<name>.p2p.bind | Address to bind on for p2p connections from peers (both TCP and UDP)
|
| services.fedimintd.<name>.api.url | Public URL of the API address of the reverse proxy/tls terminator
|
| services.drupal.sites.<name>.poolConfig | Options for the Drupal PHP pool
|
| services.tor.relay.onionServices.<name>.map | See torrc manual.
|
| systemd.user.services.<name>.startAt | Automatically start this unit at the given date/time, which
must be in the format described in
systemd.time(7)
|
| systemd.paths.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.sourcehut.settings."builds.sr.ht::worker".buildlogs | Path to write build logs.
|
| services.slskd.settings.directories.downloads | Directory where downloaded files are stored.
|
| services.rke2.autoDeployCharts.<name>.package | The packaged Helm chart
|
| services.sourcehut.settings."sr.ht".environment | Values other than "production" adds a banner to each page.
|
| services.grafana-image-renderer.settings.rendering.width | Width of the PNG used to display the alerting graph.
|
| services.suwayomi-server.settings.server.basicAuthPasswordFile | The password file containing the value that you have to provide when authenticating.
|
| power.ups.users.<name>.actions | Allow the user to do certain things with upsd
|
| services.openssh.knownHosts.<name>.hostNames | A list of host names and/or IP numbers used for accessing
the host's ssh service
|
| services.ax25.axports.<name>.enable | Whether to enable Enables the axport interface.
|
| services.ax25.axports.<name>.paclen | Default maximum packet size for this interface.
|
| services.grafana-image-renderer.settings.service.logging.level | The log-level of the grafana-image-renderer.service-unit.
|
| services.matrix-appservice-irc.settings.database.engine | Which database engine to use
|
| services.sabnzbd.settings.misc.email_endjob | Whether to send emails on job completion
|
| services.slskd.settings.global.download.speed_limit | Total upload download limit
|
| services.maubot.settings.database_opts | Additional arguments for asyncpg.create_pool() or sqlite3.connect()
|
| services.ndppd.proxies.<name>.interface | Listen for any Neighbor Solicitation messages on this interface,
and respond to them according to a set of rules
|
| services.autosuspend.wakeups.<name>.class | Name of the class implementing the check
|
| users.users.<name>.createHome | Whether to create the home directory and ensure ownership as well as
permissions to match the user.
|
| services.h2o.hosts.<name>.tls.identity.*.key-file | Path to key file
|
| services.nextcloud-spreed-signaling.settings.https.key | Path to the private key used for the HTTPS listener
|
| services.geth.<name>.metrics.address | Listen address of Go Ethereum metrics service.
|
| services.drupal.sites.<name>.phpOptions | Options for PHP's php.ini file for this Drupal site.
|
| services.nginx.proxyCachePath.<name>.enable | Whether to enable this proxy cache path entry.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.slot | Optional slot number of the token that stores the certificate.
|
| services.grafana.settings.server.enable_gzip | Set this option to true to enable HTTP compression, this can improve transfer speed and bandwidth utilization
|
| services.autorandr.profiles.<name>.config.<name>.scale | Output scale configuration
|
| services.transmission.settings.message-level | Set verbosity of transmission messages.
|
| services.tahoe.nodes.<name>.client.shares.total | The number of shares required to store a file.
|
| services.sourcehut.settings."meta.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."todo.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.tlsrpt.reportd.settings.contact_info | Contact information embedded into the reports.
|
| services.quicktun.<name>.localPort | Local UDP port.
|
| services.github-runners.<name>.runnerGroup | Name of the runner group to add this runner to (defaults to the default runner group)
|
| services.firewalld.settings.FirewallBackend | The firewall backend implementation
|
| services.transmission.settings.download-dir | Directory where to download torrents.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.etebase-server.settings.global.static_root | The directory for static files.
|
| services.listmonk.database.settings."bounce.mailboxes" | List of bounce mailboxes
|
| services.matrix-appservice-irc.settings.ircService.servers | IRC servers to connect to
|
| services.netbird.server.management.settings | Configuration of the netbird management server
|
| services.ocsinventory-agent.settings.server | The URI of the OCS Inventory server where to send the inventory file
|
| services.sslh.settings.verbose-connections | Where to log connections information
|
| services.fedimintd.<name>.nginx.config.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.quicktun.<name>.privateKeyFile | Path to file containing local secret key in binary or hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| services.bacula-sd.director.<name>.tls.key | The path of a PEM encoded TLS private key
|
| services.bacula-fd.director.<name>.tls.key | The path of a PEM encoded TLS private key
|
| services.httpd.virtualHosts.<name>.hostName | Canonical hostname for the server.
|
| services.asusd.auraConfigs.<name>.source | Path of the source file.
|
| services.caddy.virtualHosts.<name>.hostName | Canonical hostname for the server.
|
| services.rss2email.feeds.<name>.url | The URL at which to fetch the feed.
|
| services.redis.servers.<name>.unixSocket | The path to the socket to bind to.
|
| services.k3s.autoDeployCharts.<name>.repo | The repo of the Helm chart
|
| services.tahoe.nodes.<name>.storage.enable | Whether to enable storage service.
|
| services.wyoming.piper.servers.<name>.uri | URI to bind the wyoming server to.
|
| services.openafsServer.cellServDB.<name>.*.ip | IP Address of a database server
|
| services.openafsClient.cellServDB.<name>.*.ip | IP Address of a database server
|
| services.nginx.proxyCachePath.<name>.keysZoneSize | Set size to shared memory zone.
|
| services.geth.<name>.authrpc.address | Listen address of Go Ethereum Auth RPC API.
|
| services.restic.backups.<name>.runCheck | Whether to run the check command with the provided checkOpts options.
|
| services.phpfpm.pools.<name>.phpPackage | The PHP package to use for running this PHP-FPM pool.
|
| services.sourcehut.settings.webhooks.private-key | An absolute file path (which should be outside the Nix-store)
to a base64-encoded Ed25519 key for signing webhook payloads
|
| services.fedimintd.<name>.api.bind | Address to bind on for API connections relied by the reverse proxy/tls terminator.
|
| services.fedimintd.<name>.api.port | Port to bind on for API connections relied by the reverse proxy/tls terminator.
|
| services.cjdns.UDPInterface.connectTo.<name>.login | (optional) name your peer has for you
|
| services.cjdns.ETHInterface.connectTo.<name>.login | (optional) name your peer has for you
|
| services.transmission.settings.rpc-bind-address | Where to listen for RPC connections
|
| services.mchprs.settings.auto_redpiler | Use redpiler automatically
|
| services.warpgate.settings.database_url | Database connection string
|
| services.nix-store-gcs-proxy.<name>.address | The address of the proxy.
|
| hardware.tuxedo-drivers.settings.fn-lock | Enables or disables the laptop keyboard's Function (Fn) lock at boot
|
| services.redis.servers.<name>.save | The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes
|
| services.gitwatch.<name>.enable | Whether to enable watching for repo.
|
| services.gitwatch.<name>.remote | Optional url of remote repository
|
| services.gitwatch.<name>.branch | Optional branch in remote repository
|
| services.bitcoind.<name>.enable | Whether to enable Bitcoin daemon.
|
| services.pid-fan-controller.settings.heatSources.*.pidParams.setPoint | Set point of the controller in °C.
|
| systemd.services.<name>.startAt | Automatically start this unit at the given date/time, which
must be in the format described in
systemd.time(7)
|
| services.grafana.settings.users.hidden_users | This is a comma-separated list of usernames
|
| services.httpd.virtualHosts.<name>.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.nginx.virtualHosts.<name>.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.hostapd.radios.<name>.band | Specifies the frequency band to use, possible values are 2g for 2.4 GHz,
5g for 5 GHz, 6g for 6 GHz and 60g for 60 GHz.
|
| services.engelsystem.settings | Options to be added to config.php, as a nix attribute set
|
| services.i2pd.ifname | Network interface to bind to.
|
| security.pam.services.<name>.rssh | If set, the calling user's SSH agent is used to authenticate
against the configured keys
|
| services.nextcloud.settings.mail_domain | The return address that you want to appear on emails sent by the Nextcloud server, for example nc-admin@example.com, substituting your own domain, of course.
|
| services.bluesky-pds.settings.PDS_BLOBSTORE_DISK_LOCATION | Store blobs at this location, set to null to use e.g
|
| services.nsd.zones.<name>.dnssecPolicy.keyttl | TTL for dnssec records
|
| services.k3s.autoDeployCharts.<name>.hash | The hash of the packaged Helm chart
|
| services.i2pd.inTunnels.<name>.crypto.tagsToSend | Number of ElGamal/AES tags to send.
|
| services.hans.clients.<name>.extraConfig | Additional command line parameters
|
| services.dokuwiki.sites.<name>.stateDir | Location of the DokuWiki state directory.
|
| services.iodine.clients.<name>.server | Hostname of server running iodined
|
| services.restic.backups.<name>.checkOpts | A list of options for 'restic check'.
|
| services.rspamd.workers.<name>.enable | Whether to run the rspamd worker.
|
| services.snapserver.settings.tcp-streaming.enabled | Whether to enable streaming via TCP.
|
| services.tahoe.nodes.<name>.client.shares.happy | The number of distinct storage nodes required to store
a file.
|
| services.geth.<name>.websocket.port | Port number of Go Ethereum WebSocket API.
|
| services.epgstation.settings.clientSocketioPort | Socket.io port that the web client is going to connect to
|
| services.reposilite.settings.bypassExternalCache | Add cache bypass headers to responses from /api/* to avoid issues with proxies such as Cloudflare.
|
| services.h2o.hosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host
configuration.
|
| systemd.user.services.<name>.upholds | Keeps the specified running while this unit is running
|
| security.pam.services.<name>.mysqlAuth | If set, the pam_mysql module will be used to
authenticate users against a MySQL/MariaDB database.
|
| services.pgbackrest.stanzas.<name>.instances.<name>.host | PostgreSQL host for operating remotely.
|
| services.anubis.defaultOptions.settings.DIFFICULTY | The difficulty required for clients to solve the challenge
|
| services.tahoe.nodes.<name>.sftpd.accounts.url | URL of the accounts server.
|
| services.authelia.instances.<name>.group | The name of the group for this authelia instance.
|
| services.grafana.provision.alerting.rules.settings.apiVersion | Config file version.
|
| hardware.alsa.controls.<name>.card | Name of the PCM card to control (slave).
|
| services.tarsnap.archives.<name>.printStats | Print global archive statistics upon completion
|
| services.grafana.settings.security.admin_email | The email of the default Grafana Admin, created on startup.
|
| services.nsd.zones.<name>.maxRefreshSecs | Limit refresh time for secondary zones
|
| services.fedimintd.<name>.nginx.config.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.healthchecks.settings.ALLOWED_HOSTS | The host/domain names that this site can serve.
|
| services.slskd.settings.retention.transfers.upload.errored | Lifespan of errored upload tasks.
|
| services.firewalld.settings.StrictForwardPorts | If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker
|
| services.h2o.hosts.<name>.tls.extraSettings | Additional TLS/SSL-related configuration options
|
| security.pam.services.<name>.failDelay.delay | The delay time (in microseconds) on failure.
|
| services.bacula-sd.director.<name>.tls.require | Require TLS or TLS-PSK encryption
|
| services.bacula-fd.director.<name>.tls.require | Require TLS or TLS-PSK encryption
|
| services.dokuwiki.sites.<name>.acl.*.actor | User or group to restrict
|
| services.bepasty.servers.<name>.dataDir | Path to the directory where the pastes will be saved to
|
| services.omnom.settings.server.secure_cookie | Whether to limit cookies to a secure channel.
|
| security.pam.services.<name>.makeHomeDir | Whether to try to create home directories for users
with $HOMEs pointing to nonexistent
locations on session login.
|
| services.transmission.settings.watch-dir-enabled | Whether to enable the
services.transmission.settings.watch-dir.
|
| services.mchprs.settings.view_distance | Maximal distance (in chunks) between players and loaded chunks
|
| services.etebase-server.settings.global.secret_file | The path to a file containing the secret
used as django's SECRET_KEY.
|
| services.grafana.settings.database.log_queries | Set to true to log the sql calls and execution times
|
| programs.tsmClient.servers.<name>.nodename | Target node name on the IBM TSM server.
|
| services.homebridge.settings.accessories | Homebridge Accessories
|
| services.grafana.provision.alerting.rules.settings.deleteRules | List of alert rule UIDs that should be deleted.
|
| services.xserver.displayManager.lightdm.greeters.gtk.theme.name | Name of the theme to use for the lightdm-gtk-greeter.
|
| services.transmission.settings.peer-port-random-low | The minimal peer port to listen to for incoming connections
when services.transmission.settings.peer-port-random-on-start is enabled.
|
| services.sourcehut.settings."pages.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."paste.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.sourcehut.settings."lists.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.prometheus.exporters.fritz.settings.devices | Fritz!-devices to monitor using the exporter.
|
| services.opensnitch.settings.InterceptUnknown | Whether to intercept spare connections.
|
| services.tor.settings.BridgeAuthoritativeDir | See torrc manual.
|
| services.borgbackup.jobs.<name>.dateFormat | Arguments passed to date
to create a timestamp suffix for the archive name.
|
| services.anuko-time-tracker.settings.exportDecimalDuration | Defines whether time duration values are decimal in CSV and XML data
exports (1.25 vs 1:15).
|
| security.krb5.settings.includedir | Directories containing files to include in the Kerberos configuration.
|
| nix.settings.substituters | List of binary cache URLs used to obtain pre-built binaries
of Nix packages
|
| services.grafana-image-renderer.settings.rendering.height | Height of the PNG used to display the alerting graph.
|
| systemd.user.paths.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.xserver.displayManager.lightdm.greeters.slick.font.name | Name of the font to use.
|
| services.prosody.virtualHosts.<name>.ssl.key | Path to the key file.
|
| services.i2pd.outTunnels.<name>.crypto.tagsToSend | Number of ElGamal/AES tags to send.
|
| services.tahoe.nodes.<name>.sftpd.hostPublicKeyFile | Path to the SSH host public key.
|
| services.veilid.settings.core.capabilities.disable | A list of capabilities to disable (for example, DHTV to say you cannot store DHT information).
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.file | Absolute path to the certificate to load
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.bindPort | Port that the media proxy binds to.
|
| services.homebridge.settings.description | Description of the homebridge instance.
|
| services.transmission.settings.peer-port-random-on-start | Randomize the peer port.
|
| services.umurmur.settings.channel_links | Channel tree definitions.
|
| security.pam.services.<name>.limits.*.type | Type of this limit
|
| services.nginx.virtualHosts.<name>.quic | Whether to enable the QUIC transport protocol
|
| services.grafana.settings.paths.provisioning | Folder that contains provisioning config files that grafana will apply on startup and while running
|
| systemd.user.services.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.user.services.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.services.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.services.<name>.upholds | Keeps the specified running while this unit is running
|
| services.grafana.provision.dashboards.settings | Grafana dashboard configuration in Nix
|
| services.nextcloud-spreed-signaling.settings.app.debug | Set to "true" to install pprof debug handlers
|
| services.znapzend.zetup.<name>.plan | The znapzend backup plan to use for the source
|
| services.immichframe.settings.Accounts.*.ApiKeyFile | File containing an API key to talk to the Immich server
|
| services.tinc.networks.<name>.hostSettings.<name>.addresses | The external address where the host can be reached
|
| services.cjdns.ETHInterface.connectTo.<name>.peerName | (optional) human-readable name for peer
|
| services.cjdns.UDPInterface.connectTo.<name>.peerName | (optional) human-readable name for peer
|
| services.evdevremapkeys.settings | config.yaml for evdevremapkeys
|
| services.nextcloud-spreed-signaling.settings.grpc.listen | IP and port to listen on for GRPC requests
|
| services.syncthing.settings.options.limitBandwidthInLan | Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
|
| services.anubis.defaultOptions.settings.WEBMASTER_EMAIL | If set, shows a contact email address when rendering error pages
|
| services.taler.exchange.settings.exchange.CURRENCY_ROUND_UNIT | Smallest amount in this currency that can be transferred using the underlying RTGS
|
| services.yandex-disk.username | Your yandex.com login name.
|
| services.httpd.virtualHosts.<name>.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.prometheus.exporters.rtl_433.ids.*.name | Name to match.
|
| services.drupal.sites.<name>.database.user | Database user.
|
| services.system76-scheduler.settings.cfsProfiles.enable | Tweak CFS latency parameters when going on/off battery
|
| services.kanidm.provision.systems.oauth2.<name>.claimMaps.<name>.valuesByGroup | Maps kanidm groups to values for the claim.
|
| security.acme.certs.<name>.csr | Path to a certificate signing request to apply when fetching the certificate.
|
| services.drupal.sites.<name>.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.logcheck.ignore.<name>.level | Set the logcheck level.
|
| services.sanoid.datasets.<name>.daily | Number of daily snapshots.
|
| services.znapzend.zetup.<name>.enable | Whether to enable this source.
|
| services.netbird.clients.<name>.suffixedName | A systemd service name to use (without .service suffix).
|
| services.netbird.tunnels.<name>.suffixedName | A systemd service name to use (without .service suffix).
|
| services.anubis.defaultOptions.settings.METRICS_BIND_NETWORK | The network family that the metrics server should bind to
|
| security.pam.services.<name>.limits.*.item | Item this limit applies to
|
| services.pid-fan-controller.settings.fans.*.wildcardPath | Wildcard path of the hwmon pwm file
|
| services.firezone.server.provision.accounts.<name>.actors.<name>.type | The account type
|
| services.veilid.settings.core.table_store.directory | The filesystem directory to store your table store within.
|
| services.veilid.settings.core.block_store.directory | The filesystem directory to store blocks for the block store.
|
| services.redis.servers.<name>.group | Group account under which this instance of redis-server runs.
If left as the default value this group will automatically be
created on system activation, otherwise you are responsible for
ensuring the group exists before the redis service starts.
|
| services.drupal.sites.<name>.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.
|
| services.pinnwand.settings.database_uri | Database URI compatible with SQLAlchemy
|
| services.drupal.sites.<name>.extraConfig | Extra configuration values that you want to insert into settings.php
|
| services.phpfpm.pools.<name>.phpOptions | "Options appended to the PHP configuration file php.ini used for this PHP-FPM pool."
|
| services.borgbackup.jobs.<name>.wrapper | Name of the wrapper that is installed into PATH
|
| services.xserver.xkb.extraLayouts.<name>.compatFile | The path to the xkb compat file
|
| services.dendrite.settings.global.private_key | The path to the signing private key file, used to sign
requests and events.
nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
|
| services.archisteamfarm.bots.<name>.username | Name of the user to log in
|
| services.borgbackup.jobs.<name>.postCreate | Shell commands to run after borg create
|
| programs.openvpn3.log-service.settings | Options stored in /etc/openvpn3/log-service.json configuration file
|
| users.mysql.pam | Settings for pam_mysql
|
| services.immichframe.settings.Accounts.*.ApiKey | API key to talk to the Immich server
|
| services.dependency-track.settings."alpine.database.driver" | Specifies the JDBC driver class to use.
|
| services.transmission.settings.peer-port-random-high | The maximum peer port to listen to for incoming connections
when services.transmission.settings.peer-port-random-on-start is enabled.
|
| systemd.slices.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.timers.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.drupal.sites.<name>.database.host | Database host address.
|
| services.drupal.sites.<name>.database.port | Database host port.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.slot | Optional slot number of the token that stores the certificate.
|
| services.tinc.networks.<name>.hostSettings.<name>.addresses.*.port | The port where the host can be reached
|
| security.pam.services.<name>.gnupg.storeOnly | Don't send the password immediately after login, but store for PAM
session.
|
| services.tahoe.nodes.<name>.sftpd.accounts.file | Path to the accounts file.
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".url.host | Your instance's hostname for generating URLs throughout the app
|
| services.awstats.configs.<name>.webService.hostname | The hostname the web service appears under.
|
| services.reposilite.settings.databaseThreadPool | Maximum amount of concurrent connections to the database. (one per thread)
Embedded databases (sqlite, h2) do not support truly concurrent connections, so the value will always be 1 if they are used.
|
| systemd.timers.<name>.wants | Start the specified units when this unit is started.
|
| systemd.slices.<name>.wants | Start the specified units when this unit is started.
|
| services.grafana.provision.alerting.rules.settings.deleteRules.*.uid | Unique identifier for the rule
|
| services.ax25.axports.<name>.kissParams | Kissattach parameters for this interface.
|
| services.matrix-synapse.settings.report_stats | Whether or not to report anonymized homeserver usage statistics.
|
| services.udp-over-tcp.udp2tcp.<name>.nodelay | Enables TCP_NODELAY on the TCP socket.
|
| services.nsd.zones.<name>.rrlWhitelist | Whitelists the given rrl-types.
|
| services.udp-over-tcp.tcp2udp.<name>.forward | The IP and port to forward all traffic to.
|
| services.udp-over-tcp.udp2tcp.<name>.forward | The IP and port to forward all traffic to.
|
| services.udp-over-tcp.tcp2udp.<name>.nodelay | Enables TCP_NODELAY on the TCP socket.
|
| services.firewalld.settings.IndividualCalls | Whether to use individual -restore calls to apply changes to the firewall
|
| services.fedimintd.<name>.nginx.config.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.dokuwiki.sites.<name>.aclFile | Location of the dokuwiki acl rules
|
| security.pam.services.<name>.updateWtmp | Whether to update /var/log/wtmp.
|
| services.phpfpm.pools.<name>.extraConfig | Extra lines that go into the pool configuration
|
| services.xserver.displayManager.lightdm.greeters.enso.theme.name | Name of the theme to use for the lightdm-enso-os-greeter
|
| services.grafana.provision.alerting.muteTimings.settings | Grafana mute timings configuration in Nix
|
| services.filebeat.inputs.<name>.type | The input type
|
| services.omnom.settings.app.disable_signup | Whether to enable restricting user creation.
|
| services.tahoe.nodes.<name>.tub.location | The external location that the node should listen on
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| systemd.services.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.services.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| services.postfix.settings.main.relay_domains | List of domains delivered via the relay transport.
https://www.postfix.org/postconf.5.html#relay_domains
|
| services.i2pd.inTunnels.<name>.outbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.dendrite.settings.sync_api.search.index_path | The path the search index will be created in.
|
| systemd.services.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.lidarr.settings.update.automatically | Automatically download and install updates.
|
| services.radarr.settings.update.automatically | Automatically download and install updates.
|
| services.sonarr.settings.update.automatically | Automatically download and install updates.
|
| services.headscale.settings.dns.base_domain | Defines the base domain to create the hostnames for MagicDNS
|
| services.ferretdb.settings.FERRETDB_POSTGRESQL_URL | PostgreSQL URL for 'pg' handler
|
| hardware.nvidia.datacenter.settings | Additional configuration options for fabricmanager.
|
| services.grafana.provision.alerting.rules.settings.deleteRules.*.orgId | Organization ID, default = 1
|
| services.grafana.settings.security.secret_key | Secret key used for signing
|
| services.keepalived.vrrpScripts.<name>.user | Name of user to run the script under.
|
| services.httpd.virtualHosts.<name>.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.nginx.virtualHosts.<name>.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.nextcloud-spreed-signaling.settings.http.listen | IP and port to listen on for HTTP requests, in the format of ip:port
|
| services.logcheck.ignoreCron.<name>.user | User that runs the cronjob.
|
| services.prosody.virtualHosts.<name>.ssl | Paths to SSL files
|
| services.nebula.networks.<name>.isRelay | Whether this node is a relay.
|
| services.kanidm.server.settings.online_backup.path | Path to the output directory for backups.
|
| services.tor.settings.ServerTransportPlugin.transports | List of pluggable transports.
|
| security.pam.services.<name>.limits | Attribute set describing resource limits
|
| systemd.user.services.<name>.scriptArgs | Arguments passed to the main process script
|
| security.pam.services.<name>.enableUMask | If enabled, the pam_umask module will be loaded.
|
| services.acpid.handlers.<name>.action | Shell commands to execute when the event is triggered.
|
| services.logcheck.ignore.<name>.regex | Regex specifying which log lines to ignore.
|
| services.sharkey.settings.fulltextSearch.provider | Which provider to use for full text search
|
| services.libeufin.bank.settings.libeufin-bankdb-postgres.CONFIG | The database connection string for the libeufin-bank database.
|
| services.netbird.clients | Attribute set of NetBird client daemons, by default each one will:
- be manageable using dedicated tooling:
netbird-<name> script,
NetBird - netbird-<name> graphical interface when appropriate (see ui.enable),
- run as a
netbird-<name>.service,
- listen for incoming remote connections on the port
51820 (openFirewall by default),
- manage the
netbird-<name> wireguard interface,
- use the /var/lib/netbird-/config.json configuration file,
- override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json,
- (
hardened) be locally manageable by netbird-<name> system group,
With following caveats:
- multiple daemons will interfere with each other's DNS resolution of
netbird.cloud, but
should remain fully operational otherwise
|
| services.your_spotify.settings.MONGO_ENDPOINT | The endpoint of the Mongo database.
|
| boot.initrd.systemd.users.<name>.uid | ID of the user in initrd.
|
| services.wgautomesh.settings.gossip_port | wgautomesh gossip port, this MUST be the same number on all nodes in
the wgautomesh network.
|
| services.quicktun.<name>.upScript | Run specified command or script after the tunnel device has been opened.
|
| services.draupnir.settings.managementRoom | The room ID or alias where moderators can use the bot's functionality
|
| services.tahoe.nodes.<name>.client.shares.needed | The number of shares required to reconstitute a file.
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.rollPeriod | How frequently to change keys
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.rollPeriod | How frequently to change keys
|
| services.headscale.settings.tls_key_path | Path to key for already created certificate.
|
| services.swapspace.settings.max_swapsize | Greatest allowed size for individual swapfiles
|
| services.swapspace.settings.min_swapsize | Smallest allowed size for individual swapfiles
|
| services.prosody.virtualHosts.<name>.ssl.cert | Path to the certificate file.
|
| services.akkoma.initDb.username | Name of the database user to initialise the database with
|
| services.blockbook-frontend.<name>.user | The user as which to run blockbook-frontend-‹name›.
|
| services.sourcehut.settings."builds.sr.ht".connection-string | SQLAlchemy connection string for the database.
|
| services.buffyboard.settings.input.touchscreen | Enable or disable the use of the touchscreen.
|
| services.warpgate.settings.postgres.certificate | Path to PostgreSQL listener certificate.
|
| services.matrix-appservice-irc.settings.homeserver | Homeserver configuration
|
| security.pam.services.<name>.u2fAuth | If set, users listed in
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set) are able to log in with the associated U2F key
|
| users.users.<name>.subGidRanges | Subordinate group ids that user is allowed to use
|
| users.users.<name>.subUidRanges | Subordinate user ids that user is allowed to use
|
| services.dependency-track.settings."alpine.oidc.teams.default" | Defines one or more team names that auto-provisioned OIDC users shall be added to
|
| services.netbird.clients.<name>.interface | Name of the network interface managed by this client.
|
| services.netbird.tunnels.<name>.interface | Name of the network interface managed by this client.
|
| services.postfix.masterConfig.<name>.type | The type of the service
|
| services.nsd.zones.<name>.multiMasterCheck | If enabled, checks all masters for the last zone version
|
| services.tuned.settings.dynamic_tuning | Whether to enable dynamic tuning.
|
| services.i2pd.outTunnels.<name>.outbound.quantity | Number of simultaneous ‹name› tunnels.
|
| services.kubernetes.kubelet.taints.<name>.key | Key of taint.
|
| services.umurmur.settings.max_bandwidth | Maximum bandwidth (in bits per second) that clients may send
speech at.
|
| services.netbird.clients.<name>.logLevel | Log level of the NetBird daemon.
|
| services.netbird.tunnels.<name>.logLevel | Log level of the NetBird daemon.
|
| security.pam.services.<name>.nodelay | Whether the delay after typing a wrong password should be disabled.
|
| security.pam.services.<name>.fprintAuth | If set, fingerprint reader will be used (if exists and
your fingerprints are enrolled).
|
| services.grafana.provision.alerting.policies.settings | Grafana notification policies configuration in Nix
|
| services.dokuwiki.sites.<name>.acl.*.level | Permission level to restrict the actor(s) to
|
| services.bepasty.servers.<name>.workDir | Path to the working directory (used for config and pidfile)
|
| services.spiped.config.<name>.encrypt | Take unencrypted connections from the
source socket and send encrypted
connections to the target socket.
|
| services.spiped.config.<name>.decrypt | Take encrypted connections from the
source socket and send unencrypted
connections to the target socket.
|
| services.slskd.settings.directories.incomplete | Directory where incomplete downloading files are stored.
|
| services.xserver.displayManager.lightdm.greeters.gtk.iconTheme.name | Name of the icon theme to use for the lightdm-gtk-greeter.
|
| services.beesd.filesystems.<name>.workDir | Name (relative to the root of the filesystem) of the subvolume where
the hash table will be stored.
|
| services.netbird.clients.<name>.dir.state | A state directory used by NetBird client to store config.json, state.json & resolv.conf.
|
| services.netbird.tunnels.<name>.dir.state | A state directory used by NetBird client to store config.json, state.json & resolv.conf.
|
| systemd.paths.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.headscale.settings.oidc.extra_params | Custom query parameters to send with the Authorize Endpoint request.
|
| services.matrix-appservice-irc.settings.homeserver.url | The URL to the home server for client-server API calls
|
| security.pam.services.<name>.ttyAudit.enable | Enable or disable TTY auditing for specified users
|
| services.olivetin.settings.ListenAddressSingleHTTPFrontend | The address to listen on for the internal "microproxy" frontend.
|
| services.kanidm.provision.persons.<name>.legalName | Full legal name
|
| services.mackerel-agent.settings.host_status.on_stop | Host status after agent shutdown.
|
| services.ghostunnel.servers.<name>.allowCN | Allow client if common name appears in the list.
|
| services.xserver.displayManager.lightdm.greeters.slick.theme.name | Name of the theme to use for the lightdm-slick-greeter.
|
| services.nginx.virtualHosts.<name>.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.matrix-synapse.settings.listeners.*.resources | List of HTTP resources to serve on this listener.
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.frp.instances.<name>.enable | Whether to enable frp.
|
| services.akkoma.frontends.<name>.ref | Akkoma frontend reference.
|
| services.tinc.networks.<name>.package | The tinc_pre package to use.
|
| services.redis.servers.<name>.unixSocketPerm | Change permissions for the socket
|
| services.httpd.virtualHosts.<name>.adminAddr | E-mail address of the server administrator.
|
| services.httpd.virtualHosts.<name>.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.nginx.virtualHosts.<name>.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.quicktun.<name>.remotePort | Remote UDP port
|
| services.journald.upload.settings.Upload.NetworkTimeoutSec | When network connectivity to the server is lost, this option
configures the time to wait for the connectivity to get restored
|
| services.fedimintd.<name>.nginx.path | Path to host the API on and forward to the daemon's api port
|
| services.pppd.peers.<name>.autostart | Whether the PPP session is automatically started at boot time.
|
| services.maubot.settings.plugin_databases | Plugin database settings
|
| services.ndppd.proxies.<name>.timeout | Controls how long to wait for a Neighbor Advertisement Message before
invalidating the entry, in milliseconds.
|
| services.httpd.virtualHosts.<name>.acmeRoot | Directory for the acme challenge which is PUBLIC, don't put certs or keys in here
|
| services.nginx.virtualHosts.<name>.acmeRoot | Directory for the ACME challenge, which is public
|
| services.stash.settings.parallel_tasks | Number of parallel tasks to start during scan/generate
|
| systemd.user.paths.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.units.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.ax25.axports.<name>.package | The ax25-tools package to use.
|
| services.nylon.<name>.verbosity | Enable verbose output, default is to not be verbose.
|
| services.drupal.sites.<name>.virtualHost.hostName | Canonical hostname for the server.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.file | Absolute path to the certificate to load
|
| services.netbird.tunnels.<name>.ui.enable | Controls presence of netbird-ui wrapper for this NetBird client.
|
| services.netbird.clients.<name>.ui.enable | Controls presence of netbird-ui wrapper for this NetBird client.
|
| boot.initrd.luks.devices.<name>.preLVM | Whether the luksOpen will be attempted before LVM scan or after it.
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.publicUrl | URL under which the media proxy is publicly acccessible.
|
| systemd.user.timers.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.user.slices.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.znapzend.zetup.<name>.destinations.<name>.host | Host to use for the destination dataset
|
| services.ghostunnel.servers.<name>.allowOU | Allow client if organizational unit name appears in the list.
|
| services.nextcloud-spreed-signaling.settings.grpc.targets | For target type static: List of GRPC targets to connect to for clustering mode.
|
| services.your_spotify.settings.SPOTIFY_PUBLIC | The public client ID of your Spotify application
|
| services.drupal.sites.<name>.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.grafana.provision.alerting.muteTimings.settings.muteTimes | List of mute time intervals to import or update.
|
| services.dokuwiki.sites.<name>.acl | Access Control Lists: see https://www.dokuwiki.org/acl
Mutually exclusive with services.dokuwiki.aclFile
Set this to a value other than null to take precedence over aclFile option
|
| services.nylon.<name>.deniedIPRanges | Denied client IP ranges, these gets evaluated after the allowed IP ranges, defaults to all IPv4 addresses:
[ "0.0.0.0/0" ]
To block all other access than the allowed.
|
| systemd.services.<name>.scriptArgs | Arguments passed to the main process script
|
| services.tuned.settings.sleep_interval | Interval in which the TuneD daemon is waken up and checks for events (in seconds).
|
| services.warpgate.settings.ssh.external_port | The SSH listener is reachable via this port externally.
|
| services.autorandr.profiles.<name>.config.<name>.transform | Refer to
xrandr(1)
for the documentation of the transform matrix.
|
| security.pam.services.<name>.limits.*.value | Value of this limit
|
| services.k3s.manifests.<name>.source | Path of the source .yaml file.
|
| services.k3s.manifests.<name>.enable | Whether this manifest file should be generated.
|
| services.firezone.server.provision.accounts.<name>.actors.<name>.email | The email address used to authenticate as this account
|
| services.public-inbox.inboxes.<name>.newsgroup | NNTP group name for the inbox.
|
| systemd.user.timers.<name>.wants | Start the specified units when this unit is started.
|
| systemd.user.slices.<name>.wants | Start the specified units when this unit is started.
|
| services.homebridge.settings.platforms.*.platform | Platform type
|
| services.redis.servers.<name>.extraParams | Extra parameters to append to redis-server invocation
|
| services.grafana.settings.users.password_hint | Text used as placeholder text on login page for password input.
|
| services.postsrsd.settings.unprivileged-user | Unprivileged user to drop privileges to.
Our systemd unit never runs postsrsd as a privileged process, so this option is read-only.
|
| services.fedimintd.<name>.nginx.fqdn | Public domain of the API address of the reverse proxy/tls terminator.
|
| services.redis.servers.<name>.appendOnly | By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.
|
| services.spiped.config.<name>.timeout | Timeout, in seconds, after which an attempt to connect to
the target or a protocol handshake will be aborted (and the
connection dropped) if not completed
|
| services.nextcloud-spreed-signaling.settings.turn.servers | A list of TURN servers to use
|
| services.xserver.xkb.extraLayouts.<name>.symbolsFile | The path to the xkb symbols file
|
| services.wyoming.piper.servers.<name>.piper | The piper-tts package to use.
|
| services.neo4j.ssl.policies.<name>.clientAuth | The client authentication stance for this policy.
|
| services.wyoming.piper.servers.<name>.useCUDA | Whether to accelerate the underlying onnxruntime library with CUDA.
|
| services.nginx.virtualHosts.<name>.kTLS | Whether to enable kTLS support
|
| services.tuned.settings.reapply_sysctl | Whether to enable the reapplying of global sysctls after TuneD sysctls are applied.
|
| power.ups.upsmon.monitor.<name>.type | The relationship with upsd
|
| services.grafana.settings.server.read_timeout | Sets the maximum time using a duration format (5s/5m/5ms)
before timing out read of an incoming request and closing idle connections.
0 means there is no timeout for reading the request.
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets.*.weight | Indicates the priority over identical Subnets owned by different nodes
|
| services.grafana.settings.users.default_theme | Sets the default UI theme. system matches the user's system theme.
|
| security.acme.certs.<name>.csrKey | Path to the private key to the matching certificate signing request.
|
| services.frp.instances.<name>.role | The frp consists of client and server
|
| services.openvpn.servers | Each attribute of this option defines a systemd service that
runs an OpenVPN instance
|
| services.sourcehut.settings."hg.sr.ht".changegroup-script | A changegroup script which is installed in every mercurial repo
|
| services.firewalld.zones.<name>.short | Short description for the zone.
|
| services.firewalld.zones.<name>.rules | Rich rules for the zone.
|
| services.firewalld.zones.<name>.ports | Ports to allow in the zone.
|
| services.restic.backups.<name>.package | The restic package to use.
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.adapter | The auth adapter type
|
| services.epgstation.settings.concurrentEncodeNum | The maximum number of encoding jobs that EPGStation would run at the
same time.
|
| services.xserver.displayManager.lightdm.greeters.enso.iconTheme.name | Name of the icon theme to use for the lightdm-enso-os-greeter
|
| services.rss2email.feeds.<name>.to | Email address to which to send feed items
|
| systemd.paths.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.units.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.redis.servers.<name>.appendFsync | How often to fsync the append-only log, options: no, always, everysec.
|
| services.borgmatic.settings.repositories.*.path | Path to the repository
|
| security.pam.services.<name>.yubicoAuth | If set, users listed in
~/.yubico/authorized_yubikeys
are able to log in with the associated Yubikey tokens.
|
| services.filesender.settings.admin_email | Email address of FileSender administrator(s)
|
| services.bitcoind.<name>.package | The bitcoind package to use.
|
| services.davis.nginx.locations.<name>.root | Root directory for requests.
|
| services.movim.nginx.locations.<name>.root | Root directory for requests.
|
| services.slskd.nginx.locations.<name>.root | Root directory for requests.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.syncthing.settings.options.localAnnounceEnabled | Whether to send announcements to the local LAN, also use such announcements to find other devices.
|
| services.bitcoind.<name>.configFile | The configuration file path to supply bitcoind.
|
| systemd.user.services.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.restic.backups.<name>.paths | Which paths to backup, in addition to ones specified via
dynamicFilesFrom
|
| services.nextcloud-spreed-signaling.settings.turn.apikeyFile | The path to the file containing the value for turn.apikey
|
| services.nextcloud-spreed-signaling.settings.turn.secretFile | The path to the file containing the value for turn.secret
|
| services.neo4j.ssl.policies.<name>.trustAll | Makes this policy trust all remote parties
|
| services.h2o.hosts.<name>.tls.redirectCode | HTTP status used by globalRedirect & forceSSL
|
| services.grafana.settings.database.ca_cert_path | The path to the CA certificate to use.
|
| services.readarr.settings.update.automatically | Automatically download and install updates.
|
| services.warpgate.settings.sso_providers | Configure OIDC single sign-on providers.
|
| services.rspamd.overrides.<name>.text | Text of the file.
|
| services.sabnzbd.settings.misc.bandwidth_max | Maximum bandwidth in bytes(!)/sec (supports prefixes)
|
| security.pam.services.<name>.usshAuth | If set, users with an SSH certificate containing an authorized principal
in their SSH agent are able to log in
|
| users.extraUsers.<name>.shell | The path to the user's shell
|
| systemd.user.paths.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.matrix-continuwuity.settings.global.port | The port(s) continuwuity will be running on
|
| services.blockbook-frontend.<name>.dataDir | Location of blockbook-frontend-‹name› data directory.
|
| services.warpgate.settings.http.external_port | The HTTP listener is reachable via this port externally.
|
| services.jupyter.kernels.<name>.logo64 | Path to 64x64 logo png.
|
| services.jupyter.kernels.<name>.logo32 | Path to 32x32 logo png.
|
| services.nginx.virtualHosts.<name>.listen.*.ssl | Enable SSL.
|
| systemd.timers.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.paths.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| users.groups.<name>.members | The user names of the group members, added to the
/etc/group file.
|
| systemd.slices.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.httpd.virtualHosts.<name>.listen.*.ip | IP to listen on. 0.0.0.0 for IPv4 only, * for all.
|
| services.ghostunnel.servers.<name>.allowURI | Allow client if URI subject alternative name appears in the list.
|
| services.ghostunnel.servers.<name>.allowDNS | Allow client if DNS subject alternative name appears in the list.
|
| services.honk.servername | The server name.
|
| services.nextcloud.settings.enabledPreviewProviders | The preview providers that should be explicitly enabled.
|
| users.users.<name>.autoSubUidGidRange | Automatically allocate subordinate user and group ids for this user
|
| services.taler.exchange.settings.exchangedb-postgres.CONFIG | Database connection URI.
|
| services.taler.merchant.settings.merchantdb-postgres.CONFIG | Database connection URI.
|
| services.suricata.settings.logging.stacktrace-on-signal | Requires libunwind to be available when Suricata is configured and built
|
| services.fedimintd.<name>.nginx.config.http3 | Whether to enable the HTTP/3 protocol
|
| services.blockbook-frontend.<name>.group | The group as which to run blockbook-frontend-‹name›.
|
| services.prometheus.exporters.script.settings | Free-form configuration for script_exporter, expressed as a Nix attrset and rendered to YAML.
Migration note:
The previous format using script = "sleep 5" is no longer supported
|
| services.dependency-track.settings."alpine.data.directory" | Defines the path to the data directory
|
| services.sanoid.datasets.<name>.yearly | Number of yearly snapshots.
|
| services.sanoid.datasets.<name>.hourly | Number of hourly snapshots.
|
| services.nebula.networks.<name>.enable | Enable or disable this network.
|
| services.waagent.settings.Provisioning.Enable | Whether to enable provisioning functionality in the agent
|
| services.firewalld.settings.NftablesFlowtable | This may improve forwarded traffic throughput by enabling nftables flowtable
|
| services.postfix.settings.main.mydestination | List of domain names intended for local delivery using /etc/passwd and /etc/aliases.
Do not include virtual domains in this list.
https://www.postfix.org/postconf.5.html#mydestination
|
| services.drupal.sites.<name>.privateFilesDir | The location of the Drupal private files directory.
|
| services.openvpn.servers.<name>.autoStart | Whether this OpenVPN instance should be started automatically.
|
| services.nebula.networks.<name>.listen.port | Port number to listen on.
|
| services.snipe-it.nginx.locations.<name>.root | Root directory for requests.
|
| services.nebula.networks.<name>.listen.host | IP address to listen on.
|
| services.znc.confOptions.networks.<name>.port | IRC server port.
|
| services.public-inbox.inboxes.<name>.watch | Paths for public-inbox-watch(1) to monitor for new mail.
|
| services.grafana.provision.alerting.contactPoints.settings | Grafana contact points configuration in Nix
|
| services.tahoe.nodes.<name>.sftpd.hostPrivateKeyFile | Path to the SSH host private key.
|
| services.udp-over-tcp.tcp2udp.<name>.threads | Sets the number of worker threads to use
|
| hardware.alsa.cardAliases.<name>.driver | Name of the kernel module that provides the card.
|
| services.grafana.provision.dashboards.settings.apiVersion | Config file version.
|
| services.grafana-image-renderer.settings.rendering.mode | Rendering mode of grafana-image-renderer:
default: Creates on browser-instance
per rendering request.
reusable: One browser instance
will be started and reused for each rendering request.
clustered: allows to precisely
configure how many browser-instances are supposed to be used
|
| security.pam.u2f.settings.authfile | By default pam-u2f module reads the keys from
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set)
|
| services.slskd.settings.retention.transfers.download.errored | Lifespan of errored download tasks.
|
| users.extraUsers.<name>.enable | If set to false, the user account will not be created
|
| services.grafana.provision.datasources.settings | Grafana datasource configuration in Nix
|
| services.xserver.displayManager.lightdm.greeters.slick.iconTheme.name | Name of the icon theme to use for the lightdm-slick-greeter.
|
| security.pam.services.<name>.ttyAudit.openOnly | Set the TTY audit flag when opening the session,
but do not restore it when closing the session
|
| services.bitcoind.<name>.testnet | Whether to use the testnet instead of mainnet.
|
| power.ups.upsmon.monitor.<name>.user | Username from upsd.users for accessing this UPS
|
| security.acme.certs.<name>.group | Group running the ACME client.
|
| services.synapse-auto-compressor.settings.levels | Sizes of each new level in the compression algorithm, as a comma-separated list
|
| services.kimai.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| security.pam.services.<name>.howdy.control | This option sets the PAM "control" used for this module.
|
| services.znapzend.zetup.<name>.sendDelay | Specify delay (in seconds) before sending snaps to the destination
|
| services.veilid.settings.client_api.ipc_enabled | veilid-server will respond to Python and other JSON client requests.
|
| users.users.<name>.subUidRanges.*.count | Count of subordinate user ids
|
| users.users.<name>.subGidRanges.*.count | Count of subordinate group ids
|
| services.keepalived.vrrpScripts.<name>.group | Name of group to run the script under
|
| services.grafana.settings.users.allow_sign_up | Set to false to prohibit users from being able to sign up / create user accounts
|
| services.borgmatic.settings.repositories.*.label | Label to the repository
|
| services.tor.settings.CookieAuthentication | See torrc manual.
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.prePublish | How long in advance to publish new keys
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.prePublish | How long in advance to publish new keys
|
| services.grafana.provision.alerting.templates.settings | Grafana templates configuration in Nix
|
| services.drupal.sites.<name>.virtualHost.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| security.pam.services.<name>.howdy.enable | Whether to enable the Howdy PAM module
|
| users.extraUsers.<name>.pamMount | Attributes for user's entry in
pam_mount.conf.xml
|
| services.fedimintd.<name>.nginx.config.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.your_spotify.settings.CLIENT_ENDPOINT | The endpoint of your web application
|
| services.mackerel-agent.settings.host_status.on_start | Host status after agent startup.
|
| services.grafana.provision.alerting.muteTimings.settings.apiVersion | Config file version.
|
| services.dokuwiki.sites.<name>.package | The dokuwiki package to use.
|
| services.znapzend.zetup.<name>.dataset | The dataset to use for this source.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.nginx.virtualHosts.<name>.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.immichframe.settings.Accounts.*.ImmichServerUrl | The URL of your Immich server.
|
| services.warpgate.settings.mysql.external_port | The MySQL listener is reachable via this port externally.
|
| services.httpd.virtualHosts.<name>.listen.*.ssl | Whether to enable SSL (https) support.
|
| services.restic.backups.<name>.exclude | Patterns to exclude when backing up
|
| services.libeufin.nexus.settings.libeufin-nexusdb-postgres.CONFIG | The database connection string for the libeufin-nexus database.
|
| services.nsd.zones.<name>.allowAXFRFallback | If NSD as secondary server should be allowed to AXFR if the primary
server does not allow IXFR.
|
| services.nvme-rs.settings.thresholds.wear_warning | Wear warning threshold (%)
|
| systemd.units.<name>.aliases | Aliases of that unit.
|
| systemd.paths.<name>.aliases | Aliases of that unit.
|
| services.your_spotify.settings.API_ENDPOINT | The endpoint of your server
This api has to be reachable from the device you use the website from not from the server
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets.*.prefixLength | The prefix length of the subnet
|
| security.pam.services.<name>.setLoginUid | Set the login uid of the process
(/proc/self/loginuid) for auditing
purposes
|
| security.pam.u2f.settings.interactive | Set to prompt a message and wait before testing the presence of a U2F device
|
| systemd.services.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.slskd.settings.retention.transfers.upload.cancelled | Lifespan of cancelled upload tasks.
|
| services.slskd.settings.retention.transfers.upload.succeeded | Lifespan of succeeded upload tasks.
|
| services.grafana.provision.datasources.settings.prune | When true, provisioned datasources from this file will be deleted
automatically when removed from
services.grafana.provision.datasources.settings.datasources.
|
| systemd.user.paths.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.slices.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.user.timers.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| services.livekit.settings.rtc.port_range_end | End of UDP port range for WebRTC
|
| services.suricata.settings.exception-policy | Define a common behavior for all exception policies
|
| services.fedimintd.<name>.enable | Whether to enable fedimintd.
|
| services.nginx.proxyCachePath.<name>.levels | The levels parameter defines structure of subdirectories in cache: from
1 to 3, each level accepts values 1 or 2
|
| services.nsd.zones.<name>.children | Children zones inherit all options of their parents
|
| services.xserver.displayManager.lightdm.greeters.gtk.cursorTheme.name | Name of the cursor theme to use for the lightdm-gtk-greeter.
|
| services.agate.hostnames | Domain name of this Gemini server, enables checking hostname and port
in requests. (multiple occurrences means basic vhosts)
|
| services.tahoe.introducers.<name>.nickname | The nickname of this Tahoe introducer.
|
| power.ups.ups.<name>.maxStartDelay | This can be set as a global variable above your first UPS
definition and it can also be set in a UPS section
|
| security.pam.services.<name>.sshAgentAuth | If set, the calling user's SSH agent is used to authenticate
against the keys in the calling user's
~/.ssh/authorized_keys
|
| boot.initrd.extraFiles.<name>.source | The object to make available inside the initrd.
|
| services.nvme-rs.settings.thresholds.temp_warning | Temperature warning threshold (°C)
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.navidrome.settings.EnableInsightsCollector | Enable anonymous usage data collection, see https://www.navidrome.org/docs/getting-started/insights/ for details.
|
| services.prometheus.exporters.fritz.settings.log_level | Log level to use for the exporter.
|
| services.dependency-track.settings."alpine.database.mode" | Defines the database mode of operation
|
| services.awstats.configs.<name>.logFile | The log file to be scanned
|
| services.nextcloud-spreed-signaling.settings.https.listen | IP and port to listen on for HTTPS requests, in the format of ip:port
|
| services.borgbackup.jobs.<name>.repo | Remote or local repository to back up to.
|
| services.httpd.virtualHosts.<name>.listen.*.port | Port to listen on
|
| services.iodine.clients.<name>.extraConfig | Additional command line parameters
|
| services.nginx.virtualHosts.<name>.listen.*.addr | Listen address.
|
| services.anubis.defaultOptions.settings.OG_PASSTHROUGH | Whether to enable Open Graph tag passthrough
|
| services.znc.confOptions.networks.<name>.useSSL | Whether to use SSL to connect to the IRC server.
|
| services.geth.<name>.websocket.enable | Whether to enable Go Ethereum WebSocket API.
|
| services.udp-over-tcp.tcp2udp.<name>.recvTimeout | An application timeout on receiving data from the TCP socket.
|
| services.udp-over-tcp.udp2tcp.<name>.recvTimeout | An application timeout on receiving data from the TCP socket.
|
| services.nebula.networks.<name>.relays | List of IPs of relays that this node should allow traffic from.
|
| services.snapper.configs.<name>.FSTYPE | Filesystem type
|
| services.nginx.virtualHosts.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.wstunnel.clients.<name>.tlsSNI | Use this as the SNI while connecting via TLS
|
| services.hercules-ci-agent.settings.staticSecretsDirectory | This is the default directory to look for statically configured secrets like cluster-join-token.key
|
| services.cjdns.ETHInterface.connectTo.<name>.hostname | Optional hostname to add to /etc/hosts; prevents reverse lookup failures.
|
| services.cjdns.UDPInterface.connectTo.<name>.hostname | Optional hostname to add to /etc/hosts; prevents reverse lookup failures.
|
| services.prometheus.exporters.nginxlog.settings.consul | Consul integration options
|
| services.headscale.settings.dns.extra_records | Extra DNS records to expose to clients.
|
| services.drupal.sites.<name>.virtualHost.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.listmonk.database.settings."privacy.exportable" | List of fields which can be exported through an automatic export request
|
| services.znapzend.zetup.<name>.destinations.<name>.plan | The znapzend backup plan to use for the source
|
| services.grafana.provision.alerting.policies.settings.apiVersion | Config file version.
|
| services.davis.nginx.locations.<name>.index | Adds index directive.
|
| services.davis.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.movim.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.slskd.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.slskd.nginx.locations.<name>.index | Adds index directive.
|
| services.movim.nginx.locations.<name>.index | Adds index directive.
|
| services.drupal.sites.<name>.virtualHost.acmeRoot | Directory for the acme challenge which is PUBLIC, don't put certs or keys in here
|
| security.pam.services.<name>.failDelay.enable | If enabled, this will replace the FAIL_DELAY setting from login.defs
|
| services.hans.clients.<name>.passwordFile | File that contains password
|
| services.nginx.virtualHosts.<name>.default | Makes this vhost the default.
|
| services.drupal.sites.<name>.virtualHost.adminAddr | E-mail address of the server administrator.
|
| services.neo4j.ssl.policies.<name>.ciphers | Restrict the allowed ciphers of this policy to those defined
here
|
| virtualisation.interfaces.<name>.name | Interface name
|
| services.graylog.rootUsername | Name of the default administrator user
|
| services.metricbeat.modules.<name>.module | The name of the module
|
| services.httpd.virtualHosts.<name>.sslServerKey | Path to server SSL certificate key.
|
| services.tinc.networks.<name>.debugLevel | The amount of debugging information to add to the log. 0 means little
logging while 5 is the most logging. man tincd for
more details.
|
| systemd.user.timers.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.slices.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.nginx.proxyCachePath.<name>.useTempPath | Nginx first writes files that are destined for the cache to a temporary
storage area, and the use_temp_path=off directive instructs Nginx to
write them to the same directories where they will be cached
|
| services.tor.relay.onionServices.<name>.path | Path where to store the data files of the hidden service
|
| services.wstunnel.servers.<name>.tlsKey | TLS key to use instead of the hardcoded on in case of HTTPS connections
|
| services.fedimintd.<name>.api_ws.url | Public URL of the API address of the reverse proxy/tls terminator
|
| systemd.user.services.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| users.extraUsers.<name>.extraGroups | The user's auxiliary groups.
|
| services.pid-fan-controller.settings.heatSources.*.wildcardPath | Path of the heat source's hwmon temp_input file
|
| services.spiped.config.<name>.waitForDNS | Wait for DNS
|
| services.rke2.autoDeployCharts.<name>.repo | The repo of the Helm chart
|
| hardware.alsa.controls.<name>.device | Name of the PCM device to control (slave).
|
| services.httpd.virtualHosts.<name>.http2 | Whether to enable HTTP 2
|
| services.firezone.server.provision.accounts.<name>.groups.<name>.members | The members of this group
|
| services.prometheus.alertmanager-ntfy.settings.http.addr | The address to listen on.
|
| services.firewalld.zones.<name>.ports.*.port | |
| services.mpd.settings.bind_to_address | The address for the daemon to listen on
|
| services.errbot.instances.<name>.dataDir | Data directory for errbot instance.
|
| services.prowlarr.settings.update.automatically | Automatically download and install updates.
|
| services.whisparr.settings.update.automatically | Automatically download and install updates.
|
| services.bitcoind.<name>.extraConfig | Additional configurations to be appended to bitcoin.conf.
|
| services.sourcehut.settings."lists.sr.ht::worker".reject-mimetypes | Comma-delimited list of Content-Types to reject
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.postPublish | How long after deactivation to keep a key in the zone
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.postPublish | How long after deactivation to keep a key in the zone
|
| services.kanata.keyboards.<name>.port | Port to run the TCP server on. null will not run the server.
|
| services.tinc.networks.<name>.hostSettings.<name>.addresses.*.address | The external IP address or hostname where the host can be reached.
|
| services.postfix.masterConfig.<name>.args | Arguments to pass to the command
|
| services.syncoid.commands.<name>.sshKey | SSH private key file to use to login to the remote system
|
| boot.initrd.systemd.groups.<name>.gid | ID of the group in initrd.
|
| users.extraUsers.<name>.cryptHomeLuks | Path to encrypted luks device that contains
the user's home directory.
|
| services.xserver.displayManager.lightdm.greeters.enso.cursorTheme.name | Name of the cursor theme to use for the lightdm-enso-os-greeter
|
| services.i2pd.ifname4 | IPv4 interface to bind to.
|
| services.i2pd.ifname6 | IPv6 interface to bind to.
|
| services.opensearch.settings."plugins.security.disabled" | Whether to enable the security plugin,
plugins.security.ssl.transport.keystore_filepath or
plugins.security.ssl.transport.server.pemcert_filepath and
plugins.security.ssl.transport.client.pemcert_filepath
must be set for this plugin to be enabled.
|
| services.headscale.settings.oidc.allowed_users | Users allowed to authenticate even if not in allowedDomains.
|
| services.kanidm.provision.systems.oauth2.<name>.preferShortUsername | Use 'name' instead of 'spn' in the preferred_username claim
|
| services.rke2.autoDeployCharts.<name>.hash | The hash of the packaged Helm chart
|
| services.headscale.settings.tls_cert_path | Path to already created certificate.
|
| services.fluidd.nginx.locations.<name>.root | Root directory for requests.
|
| services.akkoma.nginx.locations.<name>.root | Root directory for requests.
|
| services.gancio.nginx.locations.<name>.root | Root directory for requests.
|
| services.fedimintd.<name>.bitcoin.rpc.kind | Kind of a bitcoin node.
|
| services.monica.nginx.locations.<name>.root | Root directory for requests.
|
| services.matomo.nginx.locations.<name>.root | Root directory for requests.
|
| services.snipe-it.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.snipe-it.nginx.locations.<name>.index | Adds index directive.
|
| services.netbird.tunnels.<name>.dir.runtime | A runtime directory used by NetBird client.
|
| services.netbird.clients.<name>.dir.runtime | A runtime directory used by NetBird client.
|
| services.wyoming.piper.servers.<name>.extraArgs | Extra arguments to pass to the server commandline.
|
| services.wyoming.piper.servers.<name>.enable | Whether to enable Wyoming Piper server.
|
| services.fedimintd.<name>.bitcoin.rpc.url | Bitcoin node (bitcoind/electrum/esplora) address to connect to
|
| services.ddclient.username | User name.
|
| services.dokuwiki.sites.<name>.phpPackage | The php package to use.
|
| services.sanoid.templates.<name>.daily | Number of daily snapshots.
|
| services.redis.servers.<name>.requirePassFile | File with password for the database.
|
| services.vault-agent.instances.<name>.user | User under which this instance runs.
|
| services.nextcloud-spreed-signaling.settings.backend.timeout | Timeout in seconds for requests to the backend
|
| services.jupyter.kernels.<name>.extraPaths | Extra paths to link in kernel directory
|
| services.ytdl-sub.instances.<name>.enable | Whether to enable ytdl-sub instance.
|
| systemd.user.units.<name>.aliases | Aliases of that unit.
|
| systemd.user.paths.<name>.aliases | Aliases of that unit.
|
| services.grafana.provision.alerting.rules.settings.groups.*.interval | Interval that the rule group should be evaluated at
|
| services.sabnzbd.settings.ntfosd.ntfosd_enable | Whether to enable NotifyOSD alerts
|
| services.httpd.virtualHosts.<name>.servedDirs | This option provides a simple way to serve static directories.
|
| services.hostapd.radios.<name>.wifi6.enable | Enables support for IEEE 802.11ax (WiFi 6, HE)
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.signingKeyPath | Path to the signing key file for authenticated media.
|
| systemd.user.services.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.system76-scheduler.settings.cfsProfiles.default.latency | sched_latency_ns.
|
| services.fedimintd.<name>.api_ws.bind | Address to bind on for API connections relied by the reverse proxy/tls terminator.
|
| services.matrix-appservice-irc.settings.ircService.mediaProxy.ttlSeconds | Lifetime in seconds, that generated URLs stay valid
|
| services.httpd.virtualHosts.<name>.logFormat | Log format for Apache's log files
|
| services.caddy.virtualHosts.<name>.logFormat | Configuration for HTTP request logging (also known as access logs)
|
| services.headscale.settings.prefixes.allocation | Strategy used for allocation of IPs to nodes, available options:
- sequential (default): assigns the next free IP from the previous given IP.
- random: assigns the next free IP from a pseudo-random IP generator (crypto/rand).
|
| virtualisation.allInterfaces.<name>.name | Interface name
|
| services.suricata.settings.dpdk.interfaces.*.interface | See upstream docs: docs/capture-hardware/dpdk and docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk.
|
| services.sabnzbd.settings.misc.bandwidth_perc | Percentage of bandwidth_max that sabnzbd is allowed to use.
0 means no limit.
|
| systemd.slices.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.timers.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.chhoto-url.settings.hash_algorithm | The hash algorithm to use for passwords and API keys
|
| services.kimai.sites.<name>.database.charset | Database charset.
|
| services.public-inbox.settings.publicinbox.nntpserver | NNTP URLs to this public-inbox instance
|
| services.public-inbox.settings.publicinbox.pop3server | POP3 URLs to this public-inbox instance
|
| services.public-inbox.settings.publicinbox.imapserver | IMAP URLs to this public-inbox instance
|
| services.restic.backups.<name>.pruneOpts | A list of options (--keep-* et al.) for 'restic forget
--prune', to automatically prune old snapshots
|
| services.quicktun.<name>.timeWindow | Allowed time window for first received packet in seconds (positive number allows packets from history)
|
| services.fedimintd.<name>.nginx.config.root | The path of the web root directory.
|
| services.prometheus.exporters.script.settings.scripts.*.script | Shell script to execute when metrics are requested.
|
| services.drupal.sites.<name>.virtualHost.listen.*.ip | IP to listen on. 0.0.0.0 for IPv4 only, * for all.
|
| services.netbird.tunnels.<name>.login.enable | Whether to enable automated login for NetBird client.
|
| services.netbird.clients.<name>.login.enable | Whether to enable automated login for NetBird client.
|
| services.system76-scheduler.settings.cfsProfiles.default.preempt | Preemption mode.
|
| nix.registry.<name>.exact | Whether the from reference needs to match exactly
|
| services.grafana.provision.alerting.muteTimings.settings.deleteMuteTimes | List of mute time intervals that should be deleted.
|
| services.fedimintd.<name>.nginx.enable | Whether to configure nginx for fedimintd
|
| services.firewalld.zones.<name>.target | Action for packets that doesn't match any rules.
|
| services.httpd.virtualHosts.<name>.sslServerCert | Path to server SSL certificate.
|
| services.xserver.xkb.extraLayouts.<name>.keycodesFile | The path to the xkb keycodes file
|
| services.nextcloud.settings.mail_smtpport | This depends on mail_smtpmode
|
| services.ytdl-sub.instances.<name>.config | Configuration for ytdl-sub
|
| services.gitlab-runner.services.<name>.tagList | Tag list
|
| services.postfix-tlspol.settings.server.socket-permissions | Permissions to the UNIX socket, if configured.
Due to hardening on the systemd unit the socket can never be created world readable/writable.
|
| services.hostapd.radios.<name>.wifi5.enable | Enables support for IEEE 802.11ac (WiFi 5, VHT)
|
| services.tarsnap.archives.<name>.maxbw | Abort archival if upstream bandwidth usage in bytes
exceeds this threshold.
|
| services.vdirsyncer.jobs.<name>.user | User account to run vdirsyncer as, otherwise as a systemd
dynamic user
|
| services.system76-scheduler.settings.cfsProfiles.default.nr-latency | sched_nr_latency.
|
| services.fedimintd.<name>.api_ws.port | TCP Port to bind on for API connections relayed by the reverse proxy/tls terminator.
|
| hardware.sane.brscan4.netDevices.<name>.nodename | The node name of the device
|
| hardware.sane.brscan5.netDevices.<name>.nodename | The node name of the device
|
| services.nylon.<name>.bindInterface | Tell nylon which interface to use as an uplink, default is "enp3s0f0".
|
| services.wstunnel.servers.<name>.listen.host | The hostname.
|
| services.wstunnel.servers.<name>.listen.port | The port.
|
| services.lldap.settings.ldap_user_email | Admin email.
|
| services.davis.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.slskd.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.movim.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.headscale.settings.dns.extra_records.*.type | DNS record type.
|
| services.nextcloud-spreed-signaling.settings.etcd.endpoints | List of static etcd endpoints to connect to.
|
| services.lasuite-docs.collaborationServer.settings.PORT | Port used by collaboration server to listen to
|
| services.znapzend.zetup.<name>.mbuffer.size | The size for mbuffer
|
| systemd.services.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.tor.settings.AuthoritativeDirectory | See torrc manual.
|
| services.vdirsyncer.jobs.<name>.group | group to run vdirsyncer as
|
| services.kanidm.provision.persons.<name>.displayName | Display name
|
| services.fedimintd.<name>.nginx.config | Overrides to the nginx vhost section for api
|
| services.sympa.domains.<name>.webLocation | URL path part of the web interface.
|
| services.xserver.displayManager.lightdm.greeters.slick.cursorTheme.name | Name of the cursor theme to use for the lightdm-slick-greeter.
|
| services.prometheus.alertmanager-ntfy.settings | Configuration of alertmanager-ntfy
|
| security.pam.services.<name>.limits.*.domain | Username, groupname, or wildcard this limit applies to
|
| services.k3s.autoDeployCharts.<name>.extraDeploy | List of extra Kubernetes manifests to deploy with this Helm chart.
|
| services.rspamd.workers.<name>.extraConfig | Additional entries to put verbatim into worker section of rspamd config file.
|
| systemd.timers.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.slices.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.units.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.paths.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.dokuwiki.sites.<name>.poolConfig | Options for the DokuWiki PHP pool
|
| services.nntp-proxy.users.<name>.passwordHash | SHA-512 password hash (can be generated by
mkpasswd -m sha-512 <password>)
|
| services.nextcloud.settings.mail_smtpauth | This depends on mail_smtpmode
|
| documentation.man.mandoc.settings | Configuration for man.conf(5)
|
| services.icecast.hostname | DNS name or IP address that will be used for the stream directory lookups or possibly the playlist generation if a Host header is not provided.
|
| services.fedimintd.<name>.nginx.config.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| systemd.sockets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.targets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| services.firezone.server.provision.accounts.<name>.policies.<name>.group | The group which should be allowed access to the given resource.
|
| services.autosuspend.settings.suspend_cmd | The command to execute in case the host shall be suspended
|
| services.drupal.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| systemd.targets.<name>.wants | Start the specified units when this unit is started.
|
| systemd.sockets.<name>.wants | Start the specified units when this unit is started.
|
| services.grafana.provision.alerting.contactPoints.settings.apiVersion | Config file version.
|
| services.openafsServer.roles.backup.cellServDB.<name>.*.ip | IP Address of a database server
|
| services.autosuspend.settings.wakeup_cmd | The command to execute for scheduling a wake up of the system
|
| services.grafana.provision.alerting.policies.settings.policies | List of contact points to import or update.
|
| services.gitwatch.<name>.message | Optional text to use in as commit message; all occurrences of %d will be replaced by formatted date/time
|
| services.pgbackrest.repos.<name>.host | Repository host when operating remotely
|
| services.fedimintd.<name>.dataDir | Path to the data dir fedimintd will use to store its data
|
| services.dokuwiki.sites.<name>.phpOptions | Options for PHP's php.ini file for this dokuwiki site.
|
| services.httpd.virtualHosts.<name>.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.tinc.networks.<name>.bindToAddress | The ip address to bind to (both listen on and send packets from).
|
| services.rspamd.workers.<name>.bindSockets | List of sockets to listen, in format acceptable by rspamd
|
| services.matrix-continuwuity.settings.global.address | Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator
|
| services.public-inbox.settings.publicinbox.wwwlisting | Controls which lists (if any) are listed for when the root
public-inbox URL is accessed over HTTP.
|
| services.redis.servers.<name>.slowLogLogSlowerThan | Log queries whose execution take longer than X in milliseconds.
|
| services.lasuite-docs.collaborationServer.settings | Configuration options of collaboration server
|
| services.pgbouncer.settings.pgbouncer.pool_mode | Specifies when a server connection can be reused by other clients.
session
Server is released back to pool after client disconnects
|
| services.xserver.xkb.extraLayouts.<name>.geometryFile | The path to the xkb geometry file
|
| services.grafana.provision.datasources.settings.apiVersion | Config file version.
|
| services.ax25.axports.<name>.callsign | The callsign of the physical interface to bind to.
|
| users.extraUsers.<name>.createHome | Whether to create the home directory and ensure ownership as well as
permissions to match the user.
|
| services.snipe-it.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.wyoming.piper.servers.<name>.noiseScale | Generator noise value.
|
| services.factorio.mods-dat | Mods settings can be changed by specifying a dat file, in the mod
settings file
format.
|
| services.drupal.sites.<name>.virtualHost.listen.*.ssl | Whether to enable SSL (https) support.
|
| services.tuned.settings.update_interval | Update interval for dynamic tuning (in seconds).
|
| services.lldap.settings.jwt_secret_file | Path to a file containing the JWT secret.
|
| services.k3s.autoDeployCharts.<name>.values | Override default chart values via Nix expressions
|
| boot.initrd.systemd.users.<name>.shell | The path to the user's shell in initrd.
|
| boot.initrd.systemd.users.<name>.group | Group the user belongs to in initrd.
|
| services.dokuwiki.sites.<name>.usersFile | Location of the dokuwiki users file
|
| services.gitlab-runner.services.<name>.limit | Limit how many jobs can be handled concurrently by this service.
0 (default) simply means don't limit.
|
| services.errbot.instances.<name>.logLevel | Errbot log level
|
| services.nebula.networks.<name>.package | The nebula package to use.
|
| services.sanoid.datasets.<name>.monthly | Number of monthly snapshots.
|
| services.httpd.virtualHosts.<name>.listen | Listen addresses and ports for this virtual host.
This option overrides addSSL, forceSSL and onlySSL
|
| services.tor.settings.V3AuthoritativeDirectory | See torrc manual.
|
| services.nginx.virtualHosts.<name>.extraConfig | These lines go to the end of the vhost verbatim.
|
| services.buildkite-agents.<name>.tags | Tags for the agent.
|
| services.quicktun.<name>.protocol | Which protocol to use.
|
| services.nylon.<name>.allowedIPRanges | Allowed client IP ranges are evaluated first, defaults to ARIN IPv4 private ranges:
[ "192.168.0.0/16" "127.0.0.0/8" "172.16.0.0/12" "10.0.0.0/8" ]
|
| systemd.services.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.openssh.settings.AuthorizedPrincipalsFile | Specifies a file that lists principal names that are accepted for certificate authentication
|
| security.pam.services.<name>.requireWheel | Whether to permit root access only to members of group wheel.
|
| services.crowdsec.settings.console.configuration | Attributes inside the console.yaml file.
|
| services.warpgate.settings.http.cookie_max_age | How long until logged in cookie expires.
|
| services.restic.backups.<name>.command | Command to pass to --stdin-from-command
|
| services.wordpress.sites.<name>.fontsDir | This directory is used to download fonts from a remote location, e.g.
to host google fonts locally.
|
| services.github-runners.<name>.package | The github-runner package to use.
|
| services.grafana.provision.alerting.muteTimings.settings.deleteMuteTimes.*.orgId | Organization ID, default = 1.
|
| services.veilid.settings.core.network.dht.min_peer_count | Minimum number of nodes to keep in the peer table.
|
| services.pgbouncer.settings.pgbouncer.listen_port | Which port to listen on
|
| services.blockbook-frontend.<name>.certFile | To enable SSL, specify path to the name of certificate files without extension
|
| services.quickwit.settings.listen_address | Listen address of Quickwit.
|
| services.drupal.sites.<name>.virtualHost.listen.*.port | Port to listen on
|
| services.wyoming.piper.servers.<name>.noiseWidth | Phoneme width noise value.
|
| services.nginx.virtualHosts.<name>.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.grafana.provision.alerting.templates.settings.apiVersion | Config file version.
|
| services.nginx.virtualHosts.<name>.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| systemd.user.units.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.paths.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.timers.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.user.slices.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.grafana.settings.database.max_open_conn | The maximum number of open connections to the database.
|
| services.netbird.clients.<name>.config | Additional configuration that exists before the first start and
later overrides the existing values in config.json
|
| services.netbird.tunnels.<name>.config | Additional configuration that exists before the first start and
later overrides the existing values in config.json
|
| services.spiped.config.<name>.source | Address on which spiped should listen for incoming
connections
|
| services.mailpit.instances.<name>.smtp | SMTP bind interface and port.
|
| services.tarsnap.archives.<name>.nodump | Exclude files with the nodump flag.
|
| services.rspamd.workers.<name>.includes | List of files to include in configuration
|
| services.syncoid.commands.<name>.extraArgs | Extra syncoid arguments for this command.
|
| services.wstunnel.clients.<name>.enable | Whether to enable this wstunnel instance.
|
| services.wstunnel.servers.<name>.enable | Whether to enable this wstunnel instance.
|
| services.quicktun.<name>.remoteFloat | Whether to allow the remote address and port to change when properly encrypted packets are received.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.type | The resource type
|
| services.prometheus.exporters.script.settings.scripts.*.timeout | Optional timeout for the script in seconds.
|
| systemd.user.services.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.biboumi.settings.xmpp_server_ip | The IP address to connect to the XMPP server on
|
| services.hostapd.radios.<name>.driver | The driver hostapd will use.
nl80211 is used with all Linux mac80211 drivers.
none is used if building a standalone RADIUS server that does
not control any wireless/wired driver
|
| services.redis.servers.<name>.masterAuth | If the master is password protected (using the requirePass configuration)
it is possible to tell the slave to authenticate before starting the replication synchronization
process, otherwise the master will refuse the slave request.
(STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
|
| services.tlsrpt.reportd.settings.sender_address | Sender address used for reports.
|
| security.pam.services.<name>.forwardXAuth | Whether X authentication keys should be passed from the
calling user to the target user (e.g. for
su)
|
| services.borgbackup.jobs.<name>.user | The user borg is run as
|
| services.nginx.virtualHosts.<name>.listen.*.port | Port number to listen on
|
| systemd.user.targets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| systemd.user.sockets.<name>.partOf | If the specified units are stopped or restarted, then this
unit is stopped or restarted as well.
|
| hardware.printers.ensurePrinters.*.name | Name of the printer / printer queue
|
| services.kea.dhcp-ddns.configFile | Kea DHCP-DDNS configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html
|
| services.fluidd.nginx.locations.<name>.index | Adds index directive.
|
| services.gancio.nginx.locations.<name>.index | Adds index directive.
|
| services.fluidd.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.akkoma.nginx.locations.<name>.index | Adds index directive.
|
| services.akkoma.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.gancio.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.monica.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.monica.nginx.locations.<name>.index | Adds index directive.
|
| services.matomo.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.matomo.nginx.locations.<name>.index | Adds index directive.
|
| users.users.<name>.packages | The set of packages that should be made available to the user
|
| services.grafana.settings.security.cookie_secure | Set to true if you host Grafana behind HTTPS.
|
| services.grafana.settings.database.max_idle_conn | The maximum number of connections in the idle connection pool.
|
| services.drupal.sites.<name>.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.firefox-syncserver.database.name | Database to use for storage
|
| services.drupal.sites.<name>.virtualHost.http2 | Whether to enable HTTP 2
|
| services.wordpress.sites.<name>.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| systemd.user.sockets.<name>.wants | Start the specified units when this unit is started.
|
| systemd.user.targets.<name>.wants | Start the specified units when this unit is started.
|
| systemd.timers.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.slices.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.automysqlbackup.settings | automysqlbackup configuration
|
| services.vault-agent.instances.<name>.group | Group under which this instance runs.
|
| services.grafana.provision.dashboards.settings.providers | List of dashboards to insert/update.
|
| services.kanidm.server.settings.online_backup.schedule | The schedule for backups in cron format.
|
| services.restic.backups.<name>.extraBackupArgs | Extra arguments passed to restic backup.
|
| services.redis.servers.<name>.openFirewall | Whether to open ports in the firewall for the server.
|
| services.headscale.settings.dns.extra_records.*.value | DNS record value (IP address).
|
| image.repart.partitions.<name>.contents.<name>.source | Path of the source file.
|
| services.wstunnel.clients.<name>.soMark | Mark network packets with the SO_MARK sockoption with the specified value
|
| services.udp-over-tcp.udp2tcp.<name>.recvBufferSize | If given, sets the SO_RCVBUF option on the TCP socket to the given number of bytes
|
| services.udp-over-tcp.tcp2udp.<name>.sendBufferSize | If given, sets the SO_SNDBUF option on the TCP socket to the given number of bytes
|
| services.udp-over-tcp.tcp2udp.<name>.recvBufferSize | If given, sets the SO_RCVBUF option on the TCP socket to the given number of bytes
|
| services.udp-over-tcp.udp2tcp.<name>.sendBufferSize | If given, sets the SO_SNDBUF option on the TCP socket to the given number of bytes
|
| services.redis.servers.<name>.requirePass | Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
|
| services.borgbackup.jobs.<name>.paths | Path(s) to back up
|
| services.anubis.instances.<name>.user | The user under which Anubis is run
|
| security.pam.services.<name>.enableAppArmor | Enable support for attaching AppArmor profiles at the
user/group level, e.g., as part of a role based access
control scheme.
|
| services.k3s.autoDeployCharts.<name>.version | The version of the Helm chart
|
| services.httpd.virtualHosts.<name>.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| services.nginx.virtualHosts.<name>.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| services.tor.relay.onionServices.<name>.version | See torrc manual.
|
| services.gitea.settings.service.DISABLE_REGISTRATION | By default any user can create an account on this gitea instance
|
| services.nbd.server.exports.<name>.extraOptions | Extra options for this export
|
| services.netbird.clients.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.netbird.tunnels.<name>.login.setupKeyFile | A Setup Key file path used for automated login of the machine.
|
| services.parsedmarc.settings.elasticsearch.ssl | Whether to use an encrypted SSL/TLS connection.
|
| services.jupyterhub.kernels.<name>.displayName | Name that will be shown to the user.
|
| services.nextcloud.config.dbname | Database name.
|
| services.github-runners.<name>.url | Repository to add the runner to
|
| services.kmonad.keyboards.<name>.config | Keyboard configuration.
|
| services.opkssh.providers.<name>.issuer | Issuer URI
|
| users.users.<name>.useDefaultShell | If true, the user's shell will be set to
users.defaultUserShell.
|
| security.pam.services.<name>.sssdStrictAccess | enforce sssd access control
|
| services.udp-over-tcp.tcp2udp.<name>.openFirewall | Open the appropriate ports in the firewall.
|
| services.udp-over-tcp.udp2tcp.<name>.openFirewall | Open the appropriate ports in the firewall.
|
| services.public-inbox.inboxes.<name>.address | The email addresses of the public-inbox.
|
| services.tinc.networks.<name>.rsaPrivateKeyFile | Path of the private RSA keyfile.
|
| services.geth.<name>.websocket.address | Listen address of Go Ethereum WebSocket API.
|
| services.borgbackup.jobs.<name>.postInit | Shell commands to run after borg init.
|
| services.geth.<name>.authrpc.jwtsecret | Path to a JWT secret for authenticated RPC endpoint.
|
| services.wstunnel.clients.<name>.autoStart | Whether to enable starting this wstunnel instance automatically.
|
| services.wstunnel.servers.<name>.autoStart | Whether to enable starting this wstunnel instance automatically.
|
| services.slskd.settings.retention.transfers.download.cancelled | Lifespan of cancelled download tasks.
|
| services.slskd.settings.retention.transfers.download.succeeded | Lifespan of succeeded download tasks.
|
| services.borgbackup.repos.<name>.path | Where to store the backups
|
| security.pam.services.<name>.logFailures | Whether to log authentication failures in /var/log/faillog.
|
| services.borgbackup.jobs.<name>.preHook | Shell commands to run before the backup
|
| services.awstats.configs.<name>.logFormat | The log format being used
|
| services.znapzend.zetup.<name>.presnap | Command to run before snapshots are taken on the source dataset,
e.g. for database locking/flushing
|
| services.znc.confOptions.networks.<name>.server | IRC server address.
|
| services.wstunnel.clients.<name>.addNetBind | Whether to enable Whether add CAP_NET_BIND_SERVICE to the tunnel service, this should be enabled if you want to bind port < 1024.
|
| services.kerberos_server.settings.module | Modules to obtain Kerberos configuration from.
|
| services.kerberos_server.settings.realms | The realm(s) to serve keys for.
|
| services.drupal.sites.<name>.virtualHost.logFormat | Log format for Apache's log files
|
| services.davis.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.movim.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.slskd.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.drupal.sites.<name>.virtualHost.servedDirs | This option provides a simple way to serve static directories.
|
| services.veilid.settings.core.network.routing_table.node_id | Base64-encoded public key for the node, used as the node's ID.
|
| services.fedimintd.<name>.package | The fedimint package to use.
|
| services.firewalld.services.<name>.ports | Ports of the service.
|
| services.nginx.virtualHosts.<name>.http2 | Whether to enable the HTTP/2 protocol
|
| services.system76-scheduler.settings.processScheduler.enable | Tweak scheduling of individual processes in real time.
|
| services.nextcloud-spreed-signaling.settings.backend.allowall | Allow any hostname as backend endpoint
|
| services.gitlab-runner.services.<name>.cloneUrl | Overwrite the URL for the GitLab instance
|
| services.nvme-rs.settings.thresholds.wear_critical | Wear critical threshold (%)
|
| services.rke2.manifests.<name>.source | Path of the source .yaml file.
|
| services.rke2.manifests.<name>.enable | Whether this manifest file should be generated.
|
| services.minidlna.settings.root_container | Use a different container as the root of the directory tree presented to clients.
|
| systemd.user.targets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.user.sockets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.firezone.server.settingsSecret.TOKENS_SALT | A file containing a unique base64 encoded secret for the
TOKENS_SALT
|
| services.rspamd.overrides.<name>.source | Path of the source file.
|
| services.sanoid.templates.<name>.hourly | Number of hourly snapshots.
|
| services.sanoid.templates.<name>.yearly | Number of yearly snapshots.
|
| services.parsedmarc.settings.elasticsearch.user | Username to use when connecting to Elasticsearch, if
required.
|
| services.httpd.virtualHosts.<name>.sslServerChain | Path to server SSL chain file.
|
| services.tarsnap.archives.<name>.maxbwRateUp | Upload bandwidth rate limit in bytes.
|
| services.netbird.clients.<name>.autoStart | Start the service with the system
|
| services.openvpn.servers.<name>.config | Configuration of this OpenVPN instance
|
| services.netbird.tunnels.<name>.autoStart | Start the service with the system
|
| systemd.user.services.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| boot.initrd.luks.devices.<name>.device | Path of the underlying encrypted block device.
|
| services.k3s.autoDeployCharts.<name>.enable | Whether to enable the installation of this Helm chart
|
| services.caddy.virtualHosts.<name>.extraConfig | Additional lines of configuration appended to this virtual host in the
automatically generated Caddyfile.
|
| services.drupal.sites.<name>.virtualHost.sslServerCert | Path to server SSL certificate.
|
| programs.openvpn3.log-service.settings.journald | Use systemd-journald
|
| services.nebula.networks.<name>.tun.disable | When tun is disabled, a lighthouse can be started without a local tun interface (and therefore without root).
|
| systemd.user.timers.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.slices.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| services.restic.backups.<name>.timerConfig | When to run the backup
|
| services.nginx.proxyCachePath.<name>.inactive | Cached data that has not been accessed for the time specified by
the inactive parameter is removed from the cache, regardless of
its freshness.
|
| services.nvme-rs.settings.thresholds.temp_critical | Temperature critical threshold (°C)
|
| services.nvme-rs.settings.thresholds.spare_warning | Available spare warning threshold (%)
|
| services.buildkite-agents.<name>.dataDir | The workdir for the agent
|
| services.firewalld.zones.<name>.services | Services to allow in the zone.
|
| services.firewalld.services.<name>.short | Short description for the service.
|
| services.grafana.settings.database.query_retries | This setting applies to sqlite3 only and controls the number of times the system retries a query when the database is locked.
|
| services.nginx.virtualHosts.<name>.listen | Listen addresses and ports for this virtual host
|
| services.chhoto-url.settings.redirect_method | The redirect method to use.
|
| services.firewalld.zones.<name>.version | Version of the zone.
|
| systemd.timers.<name>.aliases | Aliases of that unit.
|
| systemd.slices.<name>.aliases | Aliases of that unit.
|
| systemd.targets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.sockets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.paths.<name>.upholds | Keeps the specified running while this unit is running
|
| services.dokuwiki.sites.<name>.mergedConfig | Read only representation of the final configuration.
|
| services.anubis.instances.<name>.enable | Whether to enable this instance of Anubis.
|
| services.kmonad.keyboards.<name>.device | Path to the keyboard's device file.
|
| services.errbot.instances.<name>.admins | List of identifiers of errbot admins.
|
| services.firewalld.zones.<name>.icmpBlocks | ICMP types to block in the zone.
|
| services.restic.backups.<name>.progressFps | Controls the frequency of progress reporting.
|
| services.hostapd.radios.<name>.channel | The channel to operate on
|
| services.gancio.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.akkoma.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.fluidd.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.monica.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.matomo.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.tarsnap.archives.<name>.period | Create archive at this interval
|
| services.snipe-it.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.hostapd.radios.<name>.wifi7.enable | Enables support for IEEE 802.11be (WiFi 7, EHT)
|
| services.hostapd.radios.<name>.wifi4.enable | Enables support for IEEE 802.11n (WiFi 4, HT)
|
| services.dokuwiki.sites.<name>.plugins | List of path(s) to respective plugin(s) which are copied into the 'plugin' directory.
These plugins need to be packaged before use, see example.
|
| services.orangefs.server.fileSystems.<name>.id | File system ID (must be unique within configuration).
|
| systemd.user.services.<name>.serviceConfig | Each attribute in this set specifies an option in the
[Service] section of the unit
|
| services.suricata.settings.classification-file | Suricata classification configuration file.
|
| services.kanidm.server.settings.online_backup.versions | Number of backups to keep
|
| services.grafana.settings.server.enforce_domain | Redirect to correct domain if the host header does not match the domain
|
| services.firezone.server.provision.accounts.<name>.groups.<name>.forceMembers | Ensure that only the given members are part of this group at every server start.
|
| systemd.services.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.grafana.provision.alerting.policies.settings.resetPolicies | List of orgIds that should be reset to the default policy.
|
| services.transmission.settings.incomplete-dir | When enabled with
services.transmission.home
services.transmission.settings.incomplete-dir-enabled,
new torrents will download the files to this directory
|
| services.pingvin-share.hostname | The domain name of your instance
|
| services.journald.upload.settings.Upload.TrustedCertificateFile | SSL CA certificate
|
| services.opentelemetry-collector.settings | Specify the configuration for Opentelemetry Collector in Nix
|
| users.users.<name>.subUidRanges.*.startUid | Start of the range of subordinate user ids that user is
allowed to use.
|
| users.users.<name>.subGidRanges.*.startGid | Start of the range of subordinate group ids that user is
allowed to use.
|
| services.bluemap.storage.<name>.storage-type | Type of storage config
|
| services.awstats.configs.<name>.hostAliases | List of aliases the site has.
|
| services.opkssh.providers.<name>.clientId | OAuth client ID
|
| services.pgbackrest.repos.<name>.sftp-host | SFTP repository host
|
| services.redis.servers.<name>.databases | Set the number of databases.
|
| services.wordpress.sites.<name>.package | The wordpress package to use.
|
| services.httpd.virtualHosts.<name>.forceSSL | Whether to add a separate nginx server block that permanently redirects (301)
all plain HTTP traffic to HTTPS
|
| security.acme.certs.<name>.keyType | Key type to use for private keys
|
| services.quicktun.<name>.localAddress | IP address or hostname of the local end.
|
| services.postgresql.systemCallFilter.<name>.enable | Whether to enable ‹name› in postgresql's syscall filter.
|
| services.github-runners.<name>.workDir | Working directory, available as $GITHUB_WORKSPACE during workflow runs
and used as a default for repository checkouts
|
| services.headscale.settings.dns.search_domains | Search domains to inject to Tailscale clients.
|
| services.fedimintd.<name>.nginx.config.quic | Whether to enable the QUIC transport protocol
|
| security.pam.services.<name>.kwallet.package | The kwallet-pam package to use.
|
| services.znapzend.zetup.<name>.mbuffer.enable | Whether to use mbuffer.
|
| services.prometheus.exporters.rtl_433.channels.*.name | Name to match.
|
| services.restic.backups.<name>.extraOptions | Extra extended options to be passed to the restic --option flag.
|
| services.drupal.sites.<name>.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.neo4j.ssl.policies.<name>.tlsVersions | Restrict the TLS protocol versions of this policy to those
defined here.
|
| services.wyoming.piper.servers.<name>.speaker | ID of a specific speaker in a multi-speaker model.
|
| services.hostapd.radios.<name>.networks | This defines a BSS, colloquially known as a WiFi network
|
| services.borgbackup.jobs.<name>.group | The group borg is run as
|
| services.httpd.virtualHosts.<name>.extraConfig | These lines go to httpd.conf verbatim
|
| services.journald.remote.settings.Remote.ServerCertificateFile | A path to a SSL certificate file in PEM format
|
| services.wgautomesh.settings.lan_discovery | Enable discovery of peers on the same LAN using UDP broadcast.
|
| services.tinc.networks.<name>.hostSettings.<name>.subnets.*.address | The subnet of this host
|
| services.mpd.settings.music_directory | The directory or URI where MPD reads music from
|
| services.grafana.provision.dashboards.settings.providers.*.type | Dashboard provider type.
|
| services.transmission.settings.script-torrent-done-enabled | Whether to run
services.transmission.settings.script-torrent-done-filename
at torrent completion.
|
| services.jupyterhub.kernels.<name>.language | Language of the environment
|
| services.drupal.sites.<name>.virtualHost.listen | Listen addresses and ports for this virtual host.
This option overrides addSSL, forceSSL and onlySSL
|
| services.github-runners.<name>.enable | Whether to enable GitHub Actions runner
|
| services.restic.backups.<name>.rcloneConfig | Configuration for the rclone remote being used for backup
|
| systemd.targets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| systemd.sockets.<name>.wantedBy | Units that want (i.e. depend on) this unit
|
| services.vdirsyncer.jobs.<name>.enable | Whether to enable this vdirsyncer job.
|
| services.wyoming.piper.servers.<name>.lengthScale | Phoneme length value.
|
| services.kanata.keyboards.<name>.extraArgs | Extra command line arguments passed to kanata.
|
| services.caddy.virtualHosts.<name>.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.davis.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.davis.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.movim.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.slskd.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.movim.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.slskd.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.syncthing.settings.options.maxFolderConcurrency | This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning
|
| services.logcheck.ignoreCron.<name>.timeArgs | "min hr dom mon dow" crontab time args, to auto-create a cronjob too
|
| systemd.user.targets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.user.sockets.<name>.after | If the specified units are started at the same time as
this unit, delay this unit until they have started.
|
| systemd.user.paths.<name>.upholds | Keeps the specified running while this unit is running
|
| services.matrix-synapse.settings.enable_metrics | Enable collection and rendering of performance metrics
|
| services.hostapd.radios.<name>.wifi6.require | Require stations (clients) to support WiFi 6 (HE) and disassociate them if they don't.
|
| services.snapper.configs.<name>.ALLOW_USERS | List of users allowed to operate with the config. "root" is always
implicitly included
|
| virtualisation.cri-o.settings | Configuration for cri-o, see
https://github.com/cri-o/cri-o/blob/master/docs/crio.conf.5.md.
|
| users.extraUsers.<name>.subUidRanges | Subordinate user ids that user is allowed to use
|
| users.extraUsers.<name>.subGidRanges | Subordinate group ids that user is allowed to use
|
| services.grafana.settings.server.router_logging | Set to true for Grafana to log all HTTP requests (not just errors)
|
| services.matrix-synapse.settings.listeners.*.x_forwarded | Use the X-Forwarded-For (XFF) header as the client IP and not the
actual client IP.
|
| security.acme.certs.<name>.postRun | Commands to run after new certificates go live
|
| services.nghttpx.backends.*.params.dns | Name resolution of a backends host name is done at start up,
or configuration reload
|
| services.nginx.virtualHosts.<name>.forceSSL | Whether to add a separate nginx server block that redirects (defaults
to 301, configurable with redirectCode) all plain HTTP traffic to
HTTPS
|
| services.mediagoblin.settings.mediagoblin.plugins | Plugins to enable
|
| services.parsedmarc.settings.elasticsearch.hosts | A list of Elasticsearch hosts to push parsed reports
to.
|
| services.warpgate.settings.postgres.external_port | The PostgreSQL listener is reachable via this port externally.
|
| systemd.user.slices.<name>.aliases | Aliases of that unit.
|
| systemd.user.timers.<name>.aliases | Aliases of that unit.
|
| services.openssh.knownHosts.<name>.publicKey | The public key data for the host
|
| services.kanidm.provision.systems.oauth2.<name>.displayName | Display name
|
| services.maubot.settings.crypto_database | Separate database URL for the crypto database
|
| services.firezone.server.settingsSecret.TOKENS_KEY_BASE | A file containing a unique base64 encoded secret for the
TOKENS_KEY_BASE
|
| services.firezone.server.settingsSecret.SECRET_KEY_BASE | A file containing a unique base64 encoded secret for the
SECRET_KEY_BASE
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.baseurl | The base URL of the ntfy.sh instance.
|
| services.bacula-sd.device.<name>.extraDeviceConfig | Extra configuration to be passed in Device directive.
|
| services.znc.confOptions.networks.<name>.extraConf | Extra config for the network
|
| systemd.paths.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.paths.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.nginx.virtualHosts.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.firewalld.settings.IPv6_rpfilter | Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704
|
| services.anubis.instances.<name>.policy | Anubis policy configuration
|
| services.borgbackup.jobs.<name>.doInit | Run borg init if the
specified repo does not exist
|
| services.bepasty.servers.<name>.extraConfig | Extra configuration for bepasty server to be appended on the
configuration.
see https://bepasty-server.readthedocs.org/en/latest/quickstart.html#configuring-bepasty
for all options.
|
| services.hostapd.radios.<name>.wifi4.require | Require stations (clients) to support WiFi 4 (HT) and disassociate them if they don't.
|
| services.hostapd.radios.<name>.wifi5.require | Require stations (clients) to support WiFi 5 (VHT) and disassociate them if they don't.
|
| services.anubis.instances.<name>.group | The group under which Anubis is run
|
| services.wordpress.sites.<name>.themes | Path(s) to respective theme(s) which are copied from the 'theme' directory.
These themes need to be packaged before use, see example.
|
| services.postfix.masterConfig.<name>.wakeup | Automatically wake up the service after the specified number of
seconds
|
| systemd.user.services.<name>.requisite | Similar to requires
|
| services.borgbackup.repos.<name>.user | The user borg serve is run as
|
| services.hostapd.radios.<name>.networks.<name>.dynamicConfigScripts | All of these scripts will be executed in lexicographical order before hostapd
is started, right after the bss segment was generated and may dynamically
append bss options to the generated configuration file
|
| services.taler.merchant.settings.merchant.LEGAL_PRESERVATION | How long to keep data in the database for tax audits after the transaction has completed.
|
| systemd.services.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.listmonk.database.settings."app.notify_emails" | Administrator emails for system notifications
|
| services.mchprs.settings.block_in_hitbox | Allow placing blocks inside of players
(hitbox logic is simplified)
|
| services.grafana.provision.alerting.contactPoints.settings.contactPoints | List of contact points to import or update.
|
| services.kerberos_server.settings.include | Files to include in the Kerberos configuration.
|
| services.kea.ctrl-agent.configFile | Kea Control Agent configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html
|
| services.fedimintd.<name>.nginx.config.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.matrix-conduit.settings.global.database_path | Path to the conduit database, the directory where conduit will save its data
|
| services.borgbackup.jobs.<name>.prune.keep | Prune a repository by deleting all archives not matching any of the
specified retention options
|
| services.home-assistant.config.homeassistant.name | Name of the location where Home Assistant is running.
|
| security.acme.certs.<name>.email | Email address for account creation and correspondence from the CA
|
| services.drupal.sites.<name>.virtualHost.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| services.iodine.clients.<name>.passwordFile | Path to a file containing the password.
|
| services.restic.backups.<name>.passwordFile | Read the repository password from a file.
|
| services.snipe-it.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.snipe-it.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.borgbackup.jobs.<name>.postPrune | Shell commands to run after borg prune.
|
| services.matrix-synapse.settings.public_baseurl | The public-facing base URL for the client API (not including _matrix/...)
|
| services.transmission.settings.incomplete-dir-enabled | |
| services.mailpit.instances.<name>.max | Maximum number of emails to keep
|
| services.umurmur.settings.default_channel | The channel in which users will appear in when connecting.
|
| boot.initrd.luks.devices.<name>.gpgCard | The option to use this LUKS device with a GPG encrypted luks password by the GPG Smartcard
|
| hardware.alsa.cardAliases.<name>.id | The ID of the sound card
|
| programs.tsmClient.servers.<name>.servername | Local name of the IBM TSM server,
must not contain space or more than 64 chars.
|
| services.archisteamfarm.settings | The ASF.json file, all the options are documented here
|
| services.geoipupdate.settings.DatabaseDirectory | The directory to store the database files in
|
| systemd.paths.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.paths.<name>.pathConfig | Each attribute in this set specifies an option in the
[Path] section of the unit
|
| services.nsd.zones.<name>.dnssecPolicy.coverage | The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time.
|
| services.v4l2-relayd.instances.<name>.input.width | The width to read from input-stream.
|
| services.wstunnel.servers.<name>.package | The wstunnel package to use.
|
| services.wstunnel.clients.<name>.package | The wstunnel package to use.
|
| services.davis.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.slskd.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.movim.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| systemd.services.<name>.serviceConfig | Each attribute in this set specifies an option in the
[Service] section of the unit
|
| services.nextcloud.settings.mail_smtphost | This depends on mail_smtpmode
|
| services.fedimintd.<name>.nginx.config.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".http.ip | The IP address to listen on
|
| services.geoclue2.appConfig.<name>.users | List of UIDs of all users for which this application is allowed location
info access, Defaults to an empty string to allow it for all users.
|
| security.pam.services.<name>.gnupg.enable | If enabled, pam_gnupg will attempt to automatically unlock the
user's GPG keys with the login password via
gpg-agent
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".http.port | The port to run the server
|
| services.tarsnap.archives.<name>.maxbwRateDown | Download bandwidth rate limit in bytes.
|
| services.tinc.networks.<name>.listenAddress | The ip address to listen on for incoming connections.
|
| systemd.user.paths.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.paths.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.fedimintd.<name>.nginx.path_ws | Path to host the API on and forward to the daemon's api port
|
| services.tinc.networks.<name>.chroot | Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security
|
| services.postfix.masterConfig.<name>.chroot | Whether the service is chrooted to have only access to the
services.postfix.queueDir and the closure of
store paths specified by the program option.
|
| services.syncoid.commands.<name>.target | Target ZFS dataset
|
| services.geoclue2.appConfig.<name>.isSystem | Whether the application is a system component or not.
|
| security.acme.certs.<name>.validMinDays | Minimum remaining validity before renewal in days.
|
| fileSystems.<name>.encrypted.label | Label of the unlocked encrypted device
|
| services.nginx.virtualHosts.<name>.rejectSSL | Whether to listen for and reject all HTTPS connections to this vhost
|
| services.omnom.settings.app.results_per_page | Number of results per page.
|
| services.transmission.settings.trash-original-torrent-files | Whether to delete torrents added from the
services.transmission.settings.watch-dir.
|
| services.fedimintd.<name>.nginx.config.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| services.vdirsyncer.jobs.<name>.config.pairs | vdirsyncer pair configurations
|
| services.drupal.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.akkoma.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.gancio.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fluidd.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.monica.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.matomo.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.hercules-ci-agent.settings.concurrentTasks | Number of tasks to perform simultaneously
|
| services.tor.settings.UseMicrodescriptors | See torrc manual.
|
| services.znapzend.zetup.<name>.destinations.<name>.presend | Command to run before sending the snapshot to the destination
|
| services.fedimintd.<name>.nginx.config.acmeRoot | Directory for the ACME challenge, which is public
|
| services.firewalld.services.<name>.ports.*.port | |
| services.bepasty.servers.<name>.secretKey | server secret for safe session cookies, must be set
|
| services.firewalld.zones.<name>.sources.*.mac | A MAC address.
|
| services.firewalld.zones.<name>.sourcePorts | Source ports to allow in the zone.
|
| systemd.slices.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.timers.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.gitlab-runner.services.<name>.buildsDir | Absolute path to a directory where builds will be stored
in context of selected executor (Locally, Docker, SSH).
|
| services.ytdl-sub.instances.<name>.readWritePaths | List of paths that ytdl-sub can write to.
|
| services.radicle.httpd.nginx.locations.<name>.root | Root directory for requests.
|
| networking.vlans.<name>.id | The vlan identifier
|
| services.dokuwiki.sites.<name>.extraConfigs | Path(s) to additional configuration files that are then linked to the 'conf' directory.
|
| services.borgbackup.jobs.<name>.extraArgs | Additional arguments for all borg calls the
service has
|
| services.firewalld.zones.<name>.sources | Source addresses, address ranges, MAC addresses or ipsets to bind.
|
| services.fedimintd.<name>.nginx.path_ui | Path to host the built-in UI on and forward to the daemon's api port
|
| services.firefox-syncserver.settings.tokenserver.enabled | Whether to enable the token service as well.
|
| services.veilid.settings.client_api.ipc_directory | IPC directory where file sockets are stored.
|
| users.extraGroups.<name>.members | The user names of the group members, added to the
/etc/group file.
|
| services.snapper.configs.<name>.ALLOW_GROUPS | List of groups allowed to operate with the config
|
| services.rspamd.overrides.<name>.enable | Whether this file overrides should be generated
|
| services.openssh.knownHosts.<name>.extraHostNames | A list of additional host names and/or IP numbers used for
accessing the host's ssh service
|
| services.wstunnel.servers.<name>.useACMEHost | Use a certificate generated by the NixOS ACME module for the given host
|
| services.wstunnel.servers.<name>.listen | Address and port to listen on
|
| networking.sits.<name>.dev | The underlying network device on which the tunnel resides.
|
| services.auto-epp.settings.Settings.epp_state_for_AC | energy_performance_preference when on plugged in
See available epp states by running:
cat /sys/devices/system/cpu/cpu0/cpufreq/energy_performance_available_preferences
|
| systemd.user.paths.<name>.pathConfig | Each attribute in this set specifies an option in the
[Path] section of the unit
|
| systemd.user.paths.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.reposilite.settings.compressionStrategy | Compression algorithm used by this instance of Reposilite.
none reduces usage of CPU & memory, but requires transfering more data.
|
| users.users.<name>.expires | Set the date on which the user's account will no longer be
accessible
|
| services.borgbackup.jobs.<name>.appendFailedSuffix | Append a .failed suffix
to the archive name, which is only removed if
borg create has a zero exit status.
|
| nix.settings.trusted-substituters | List of binary cache URLs that non-root users can use (in
addition to those specified using
nix.settings.substituters) by passing
--option binary-caches to Nix commands.
|
| programs.ssh.knownHosts.<name>.hostNames | A list of host names and/or IP numbers used for accessing
the host's ssh service
|
| services.tahoe.introducers.<name>.tub.port | The port on which the introducer will listen.
|
| services.snipe-it.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| users.extraUsers.<name>.autoSubUidGidRange | Automatically allocate subordinate user and group ids for this user
|
| services.gitlab-runner.services.<name>.dockerImage | Docker image to be used.
|
| services.grafana.provision.alerting.templates.settings.templates | List of templates to import or update.
|
| services.fedimintd.<name>.nginx.config.kTLS | Whether to enable kTLS support
|
| services.drupal.sites.<name>.virtualHost.forceSSL | Whether to add a separate nginx server block that permanently redirects (301)
all plain HTTP traffic to HTTPS
|
| services.anubis.instances.<name>.extraFlags | A list of extra flags to be passed to Anubis.
|
| services.syncoid.commands.<name>.service | Systemd configuration specific to this syncoid service.
|
| services.nginx.upstreams.<name>.extraConfig | These lines go to the end of the upstream verbatim.
|
| services.tarsnap.archives.<name>.verbose | Whether to produce verbose logging output.
|
| services.vault-agent.instances.<name>.enable | Whether to enable this vault-agent instance.
|
| services.borgmatic.settings.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| environment.etc.<name>.user | User name of file owner
|
| services.httpd.virtualHosts.<name>.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.nginx.virtualHosts.<name>.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.kanata.keyboards.<name>.config | Configuration other than defcfg
|
| services.wordpress.sites.<name>.poolConfig | Options for the WordPress PHP pool
|
| services.auto-epp.settings.Settings.epp_state_for_BAT | energy_performance_preference when on battery
See available epp states by running:
cat /sys/devices/system/cpu/cpu0/cpufreq/energy_performance_available_preferences
|
| services.anki-sync-server.users.*.username | User name accepted by anki-sync-server.
|
| services.bcg.mqtt.username | MQTT server access username.
|
| systemd.user.timers.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.slices.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.warpgate.settings.sso_providers.*.provider | SSO provider configurations.
|
| services.znapzend.zetup.<name>.mbuffer.port | Port to use for mbuffer
|
| services.nsd.zones.<name>.dnssecPolicy.algorithm | Which algorithm to use for DNSSEC
|
| systemd.user.services.<name>.stopIfChanged | If set, a changed unit is restarted by calling
systemctl stop in the old configuration,
then systemctl start in the new one
|
| services.tahoe.nodes.<name>.storage.reservedSpace | The amount of filesystem space to not use for storage.
|
| services.drupal.sites.<name>.virtualHost.extraConfig | These lines go to httpd.conf verbatim
|
| services.buildkite-agents.<name>.hooks | "Agent" hooks to install
|
| services.sabnzbd.settings.misc.inet_exposure | Restrictions for access from non-local IP addresses
|
| services.fedimintd.<name>.nginx.config.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.blockbook-frontend.<name>.rpc.url | URL for JSON-RPC connections.
|
| services.jupyterhub.kernels.<name>.env | Environment variables to set for the kernel.
|
| services.prosody.virtualHosts.<name>.enabled | Whether to enable the virtual host
|
| services.sanoid.datasets.<name>.autosnap | Whether to automatically take snapshots.
|
| services.webhook.hooks.<name>.execute-command | The command that should be executed when the hook is triggered.
|
| services.wstunnel.clients.<name>.connectTo | Server address and port to connect to.
|
| services.homebridge.settings.accessories.*.accessory | Accessory type
|
| services.hylafax.modems.<name>.config | Attribute set of values for the given modem
|
| services.spiped.config.<name>.resolveRefresh | Resolution refresh time for the target socket, in seconds.
|
| power.ups.users.<name>.passwordFile | The full path to a file that contains the user's (clear text)
password
|
| systemd.services.<name>.requisite | Similar to requires
|
| services.firezone.server.provision.accounts.<name>.policies.<name>.resource | The resource to which access should be allowed.
|
| systemd.user.services.<name>.restartIfChanged | Whether the service should be restarted during a NixOS
configuration switch if its definition has changed.
|
| services.system76-scheduler.settings.cfsProfiles.default.bandwidth-size | sched_cfs_bandwidth_slice_us.
|
| services.kanidm.server.settings.ldapbindaddress | Address and port the LDAP server is bound to
|
| programs.openvpn3.log-service.settings.log_level | How verbose should the logging be
|
| networking.sits.<name>.ttl | The time-to-live of the connection to the remote tunnel endpoint.
|
| users.extraUsers.<name>.subGidRanges.*.count | Count of subordinate group ids
|
| users.extraUsers.<name>.subUidRanges.*.count | Count of subordinate user ids
|
| services.fedimintd.<name>.nginx.config.listen.*.ssl | Enable SSL.
|
| services.znc.confOptions.networks.<name>.modules | ZNC network modules to load.
|
| services.wordpress.sites.<name>.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.bonsaid.settings.*.delay_duration | Nanoseconds to wait after the previous state change before performing this transition
|
| services.warpgate.settings.http.session_max_age | How long until a logged in session expires.
|
| services.akkoma.frontends.<name>.package | Akkoma frontend package.
|
| services.sanoid.templates.<name>.monthly | Number of monthly snapshots.
|
| services.vdirsyncer.jobs.<name>.configFile | existing configuration file
|
| services.tor.relay.onionServices.<name>.secretKey | Secret key of the onion service
|
| services.buildkite-agents.<name>.shell | Command that buildkite-agent 3 will execute when it spawns a shell.
|
| services.nylon.<name>.acceptInterface | Tell nylon which interface to listen for client requests on, default is "lo".
|
| services.nextcloud.settings.mail_smtpdebug | Enable SMTP class debugging.
loglevel will likely need to be adjusted too.
See docs.
|
| services.v4l2-relayd.instances.<name>.enable | Whether to enable this v4l2-relayd instance.
|
| services.stash.settings.preview_segments | Number of segments in a preview file
|
| services.stash.settings.sound_on_preview | Enable sound on mouseover previews
|
| systemd.sockets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.targets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| services.wstunnel.clients.<name>.extraArgs | Extra command line arguments to pass to wstunnel
|
| services.wstunnel.servers.<name>.extraArgs | Extra command line arguments to pass to wstunnel
|
| services.borgbackup.jobs.<name>.postHook | Shell commands to run just before exit
|
| services.prometheus.exporters.fritz.settings.devices.*.host_info | Enable extended host info for this device. Warning: This will heavily increase scrape time.
|
| services.borgbackup.repos.<name>.group | The group borg serve is run as
|
| systemd.user.services.<name>.enableDefaultPath | Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
|
| services.znapzend.zetup.<name>.postsnap | Command to run after snapshots are taken on the source dataset,
e.g. for database unlocking
|
| power.ups.ups.<name>.directives | List of configuration directives for this UPS.
|
| services.synapse-auto-compressor.settings.chunk_size | The number of state groups to work on at once
|
| power.ups.users.<name>.instcmds | Let the user initiate specific instant commands
|
| services.fluidd.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fluidd.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.akkoma.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.akkoma.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.gancio.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.gancio.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.matomo.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.matomo.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.monica.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.monica.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.rsync.jobs.<name>.destination | Destination directory.
|
| services.jibri.xmppEnvironments.<name>.call.login.username | User part of the JID for the recorder.
|
| services.wstunnel.servers.<name>.enableHTTPS | Use HTTPS for the tunnel server.
|
| services.errbot.instances.<name>.plugins | List of errbot plugin derivations.
|
| services.restic.backups.<name>.inhibitsSleep | Prevents the system from sleeping while backing up.
|
| services.filebeat.settings.output.elasticsearch.hosts | The list of Elasticsearch nodes to connect to
|
| services.fedimintd.<name>.api_iroh.bind | Address to bind on for Iroh endpoint for API connections
|
| services.syncoid.commands.<name>.useCommonArgs | Whether to add the configured common arguments to this command.
|
| services.matrix-appservice-irc.settings.database.connectionString | The database connection string
|
| power.ups.upsmon.monitor.<name>.system | Identifier of the UPS to monitor, in this form: <upsname>[@<hostname>[:<port>]]
See upsmon.conf for details.
|
| services.livekit.settings.rtc.use_external_ip | When set to true, attempts to discover the host's public IP via STUN
|
| services.journald.remote.settings.Remote.TrustedCertificateFile | A path to a SSL CA certificate file in PEM format, or all
|
| services.logcheck.ignoreCron.<name>.cmdline | Command line for the cron job
|
| services.borgbackup.repos.<name>.quota | Storage quota for the repository
|
| services.wordpress.sites.<name>.database.user | Database user.
|
| services.honk.username | The admin account username.
|
| services.mollysocket.settings.allowed_uuids | UUIDs of Signal accounts that may use this server
|
| services.openldap.configDir | Use this config directory instead of generating one from the
settings option
|
| services.wyoming.faster-whisper.servers.<name>.uri | URI to bind the wyoming server to.
|
| systemd.user.sockets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| systemd.user.targets.<name>.bindsTo | Like ‘requires’, but in addition, if the specified units
unexpectedly disappear, this unit will be stopped as well.
|
| virtualisation.podman.defaultNetwork.settings | Settings for podman's default network.
|
| programs.openvpn3.log-service.settings.timestamp | Add timestamp log file
|
| services.gitlab-runner.services.<name>.description | Name/description of the runner.
|
| services.glitchtip.settings.ENABLE_USER_REGISTRATION | When true, any user will be able to register
|
| services.snapserver.streams.<name>.type | The type of input stream.
|
| services.k3s.manifests.<name>.content | Content of the manifest file
|
| services.tlsrpt.reportd.settings.sendmail_script | Path to a sendmail-compatible executable for delivery reports.
|
| services.dokuwiki.sites.<name>.pluginsConfig | List of the dokuwiki (un)loaded plugins.
|
| services.public-inbox.inboxes.<name>.coderepo | Nicknames of a 'coderepo' section associated with the inbox.
|
| services.mailpit.instances.<name>.listen | HTTP bind interface and port for UI.
|
| services.rke2.autoDeployCharts.<name>.extraDeploy | List of extra Kubernetes manifests to deploy with this Helm chart.
|
| services.fedimintd.<name>.api_iroh.port | UDP Port to bind Iroh endpoint for API connections
|
| services.firezone.server.provision.accounts.<name>.auth | All authentication providers to provision
|
| services.nginx.upstreams.<name>.servers | Defines the address and other parameters of the upstream servers
|
| services.kanboard.nginx.locations.<name>.root | Root directory for requests.
|
| services.dolibarr.nginx.locations.<name>.root | Root directory for requests.
|
| services.fediwall.nginx.locations.<name>.root | Root directory for requests.
|
| services.librenms.nginx.locations.<name>.root | Root directory for requests.
|
| services.agorakit.nginx.locations.<name>.root | Root directory for requests.
|
| services.mainsail.nginx.locations.<name>.root | Root directory for requests.
|
| services.pixelfed.nginx.locations.<name>.root | Root directory for requests.
|
| services.wordpress.sites.<name>.database.port | Database host port.
|
| services.wordpress.sites.<name>.database.host | Database host address.
|
| services.slskd.settings.flags.force_share_scan | Force a rescan of shares on every startup.
|
| security.pam.services.<name>.kwallet.enable | If enabled, pam_wallet will attempt to automatically unlock the
user's default KDE wallet upon login
|
| services.awstats.configs.<name>.webService.enable | Whether to enable awstats web service.
|
| services.davis.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.slskd.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.movim.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.radicle.httpd.nginx.locations.<name>.index | Adds index directive.
|
| services.radicle.httpd.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.netbird.tunnels.<name>.dns-resolver.port | A port to serve DNS entries on when dns-resolver.address is enabled.
|
| services.netbird.clients.<name>.dns-resolver.port | A port to serve DNS entries on when dns-resolver.address is enabled.
|
| users.users.<name>.isNormalUser | Indicates whether this is an account for a “real” user
|
| services.github-runners.<name>.extraLabels | Extra labels in addition to the default (unless disabled through the noDefaultLabels option)
|
| virtualisation.xen.store.settings.pidFile | Path to the Xen Store Daemon PID file.
|
| services.strongswan-swanctl.swanctl.secrets.rsa.<name>.file | File name in the rsa folder for which this passphrase
should be used.
|
| services.firewalld.zones.<name>.sourcePorts.*.port | |
| services.blockbook-frontend.<name>.rpc.port | Port for JSON-RPC connections.
|
| services.blockbook-frontend.<name>.rpc.user | Username for JSON-RPC connections.
|
| services.jupyterhub.kernels.<name>.argv | Command and arguments to start the kernel.
|
| services.sanoid.datasets.<name>.useTemplate | Names of the templates to use for this dataset.
|
| services.ttyd.username | Username for basic http authentication.
|
| services.parsedmarc.settings.general.save_forensic | Save forensic report data to Elasticsearch and/or Splunk.
|
| services.prometheus.alertmanagerIrcRelay.settings | Configuration for Alertmanager IRC Relay as a Nix attribute set
|
| services.fedimintd.<name>.ui.openFirewall | Opens TCP port in firewall for built-in UI
|
| services.klipper.firmwares.<name>.enable | Whether to enable building of firmware for manual flashing
.
|
| services.public-inbox.inboxes.<name>.inboxdir | The absolute path to the directory which hosts the public-inbox.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters | A list of filter to restrict traffic
|
| services.system76-scheduler.settings.cfsProfiles.responsive.latency | sched_latency_ns.
|
| programs.dms-shell.plugins.<name>.src | Source of the plugin package or path
|
| power.ups.ups.<name>.shutdownOrder | When you have multiple UPSes on your system, you usually need to
turn them off in a certain order. upsdrvctl shuts down all the
0s, then the 1s, 2s, and so on
|
| services.fedimintd.<name>.nginx.config.listen.*.addr | Listen address.
|
| services.v4l2-relayd.instances.<name>.input.height | The height to read from input-stream.
|
| virtualisation.xen.store.settings | The OCaml-based Xen Store Daemon configuration
|
| services.gancio.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.fedimintd.<name>.nginx.config.basicAuth | Basic Auth protection for a vhost
|
| services.fluidd.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.akkoma.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.matomo.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.monica.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| systemd.timers.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.slices.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.sockets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.targets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| boot.initrd.luks.devices.<name>.gpgCard.publicKey | Path to the Public Key.
|
| services.znapzend.zetup.<name>.destinations.<name>.postsend | Command to run after sending the snapshot to the destination
|
| services.buildkite-agents.<name>.enable | Whether to enable this buildkite agent
|
| services.warpgate.settings.config_provider | Source of truth of users
|
| services.system76-scheduler.settings.cfsProfiles.responsive.preempt | Preemption mode.
|
| systemd.services.<name>.confinement.mode | The value full-apivfs (the default) sets up
private /dev, /proc,
/sys, /tmp and /var/tmp file systems
in a separate user name space
|
| services.autorandr.profiles.<name>.hooks | Profile hook scripts.
|
| services.znapzend.zetup.<name>.recursive | Whether to do recursive snapshots.
|
| services.drupal.sites.<name>.virtualHost.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.keepalived.vrrpInstances.<name>.vmacInterface | Name of the vmac interface to use. keepalived will come up with a name
if you don't specify one.
|
| services.tarsnap.archives.<name>.keyfile | Set a specific keyfile for this archive
|
| services.wstunnel.clients.<name>.localToRemote | Listen on local and forwards traffic from remote.
|
| services.prosody.virtualHosts.<name>.extraConfig | Additional virtual host specific configuration
|
| services.nextcloud-spreed-signaling.settings.sessions.hashkeyFile | The path to the file containing the value for sessions.hashkey
|
| services.matrix-synapse.settings.listeners.*.resources.*.compress | Whether synapse should compress HTTP responses to clients that support it
|
| services.fedimintd.<name>.nginx.config.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.tarsnap.archives.<name>.lowmem | Reduce memory consumption by not caching small files
|
| services.grafana.provision.alerting.contactPoints.settings.deleteContactPoints | List of receivers that should be deleted.
|
| services.wordpress.sites.<name>.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.
|
| users.users.<name>.isSystemUser | Indicates if the user is a system user or not
|
| services.fedimintd.<name>.nginx.config.default | Makes this vhost the default.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.nr-latency | sched_nr_latency.
|
| systemd.services.<name>.restartIfChanged | Whether the service should be restarted during a NixOS
configuration switch if its definition has changed.
|
| services.snipe-it.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.v4l2-relayd.instances.<name>.input.format | The video-format to read from input-stream.
|
| services.wordpress.sites.<name>.uploadsDir | This directory is used for uploads of pictures
|
| services.wordpress.sites.<name>.plugins | Path(s) to respective plugin(s) which are copied from the 'plugins' directory.
These plugins need to be packaged before use, see example.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.address | The address of this resource
|
| services.jibri.xmppEnvironments.<name>.control.muc.roomName | The room name of the MUC to connect to for control.
|
| services.rke2.autoDeployCharts.<name>.values | Override default chart values via Nix expressions
|
| systemd.user.slices.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.user.targets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.sockets.<name>.before | If the specified units are started at the same time as
this unit, delay them until this unit has started.
|
| systemd.user.timers.<name>.upholds | Keeps the specified running while this unit is running
|
| services.errbot.instances.<name>.extraConfig | String to be appended to the config verbatim
|
| services.wordpress.sites.<name>.mergedConfig | Read only representation of the final configuration.
|
| systemd.services.<name>.stopIfChanged | If set, a changed unit is restarted by calling
systemctl stop in the old configuration,
then systemctl start in the new one
|
| services.openssh.settings.PasswordAuthentication | Specifies whether password authentication is allowed.
|
| services.fedimintd.<name>.api.openFirewall | Opens port in firewall for fedimintd's api port
|
| services.pgbackrest.stanzas.<name>.jobs | Backups jobs to schedule for this stanza as described in:
https://pgbackrest.org/user-guide.html#quickstart/schedule-backup
|
| services.klipper.firmwares.<name>.serial | Path to serial port this printer is connected to
|
| services.kimai.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.ghostunnel.servers.<name>.key | Path to certificate private key (PEM with private key)
|
| environment.etc.<name>.group | Group name of file owner
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.label | Each address may be tagged with a label string
|
| security.pam.services.<name>.ttyAudit.enablePattern | For each user matching one of comma-separated
glob patterns, enable TTY auditing
|
| services.jitsi-videobridge.xmppConfigs.<name>.hostName | Hostname of the XMPP server to connect to
|
| systemd.services.<name>.enableDefaultPath | Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
|
| services.firewalld.zones.<name>.forwardPorts | Ports to forward in the zone.
|
| services.firewalld.zones.<name>.sources.*.ipset | An ipset.
|
| services.nginx.virtualHosts.<name>.locations | Declarative location config
|
| services.vdirsyncer.jobs.<name>.timerConfig | systemd timer configuration
|
| services.vault-agent.instances.<name>.package | The vault package to use.
|
| services.chhoto-url.settings.disable_frontend | Whether to disable the frontend.
|
| virtualisation.xen.store.settings.quota.maxSize | Size limit for transactions.
|
| services.geoclue2.appConfig.<name>.desktopID | Desktop ID of the application.
|
| services.radicle.httpd.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.firezone.server.settingsSecret.RELEASE_COOKIE | A file containing a unique secret identifier for the Erlang
cluster
|
| services.wordpress.sites.<name>.virtualHost.hostName | Canonical hostname for the server.
|
| services.wstunnel.clients.<name>.remoteToLocal | Listen on remote and forwards traffic from local
|
| services.kimai.sites.<name>.database.createLocally | Create the database and database user locally.
|
| services.awstats.configs.<name>.webService.urlPrefix | The URL prefix under which the awstats pages appear.
|
| services.firewalld.services.<name>.version | Version of the service.
|
| services.firewalld.services.<name>.helpers | Helpers for the service.
|
| security.pam.services.<name>.duoSecurity.enable | If set, use the Duo Security pam module
pam_duo for authentication
|
| boot.initrd.luks.devices.<name>.yubikey.slot | Which slot on the YubiKey to challenge.
|
| services.pixelfed.secretFile | A secret file to be sourced for the .env settings
|
| services.livekit.settings.rtc.port_range_start | Start of UDP port range for WebRTC
|
| security.pam.services.<name>.startSession | If set, the service will register a new session with
systemd's login manager
|
| security.pam.services.<name>.kwallet.forceRun | The force_run option is used to tell the PAM module for KWallet
to forcefully run even if no graphical session (such as a GUI
display manager) is detected
|
| systemd.sockets.<name>.aliases | Aliases of that unit.
|
| systemd.targets.<name>.aliases | Aliases of that unit.
|
| systemd.slices.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.slices.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.timers.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.timers.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| networking.ipips.<name>.dev | The underlying network device on which the tunnel resides.
|
| systemd.user.services.<name>.reloadIfChanged | Whether the service should be reloaded during a NixOS
configuration switch if its definition has changed
|
| virtualisation.xen.store.settings.quota.maxPath | Path limit for the quota system.
|
| services.atalkd.interfaces.<name>.config | Optional configuration string for this interface.
|
| services.nezha-agent.settings.skip_procs_count | Do not monitor the number of processes.
|
| services.rke2.autoDeployCharts.<name>.version | The version of the Helm chart
|
| services.prosody.virtualHosts.<name>.ssl.extraOptions | Extra SSL configuration options.
|
| services.bitcoind.<name>.prune | Reduce storage requirements by enabling pruning (deleting) of old
blocks
|
| services.ghostunnel.servers.<name>.cert | Path to certificate (PEM with certificate chain)
|
| services.httpd.virtualHosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.httpd.virtualHosts.<name>.robotsEntries | Specification of pages to be ignored by web crawlers
|
| services.fedimintd.<name>.p2p.openFirewall | Opens port in firewall for fedimintd's p2p port (both TCP and UDP)
|
| services.caddy.virtualHosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.nginx.virtualHosts.<name>.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.matrix-synapse.settings.max_upload_size | The largest allowed upload size in bytes
|
| services.firewalld.zones.<name>.forward | Whether to enable intra-zone forwarding
|
| services.vmalert.instances.<name>.rules | A list of the given alerting or recording rules against configured "datasource.url" compatible with
Prometheus HTTP API for vmalert to execute
|
| services.postfix.masterConfig.<name>.maxproc | The maximum number of processes to spawn for this service
|
| users.users.<name>.description | A short description of the user account, typically the
user's full name
|
| services.grafana.provision.dashboards.settings.providers.*.options.path | Path grafana will watch for dashboards
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.id | IKE identity to use for authentication round
|
| services.grafana.provision.alerting.contactPoints.settings.deleteContactPoints.*.uid | Unique identifier for the receiver
|
| systemd.user.slices.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.timers.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.user.timers.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.slices.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| power.ups.upsmon.monitor.<name>.powerValue | Number of power supplies that the UPS feeds on this system
|
| services.quicktun.<name>.remoteAddress | IP address or hostname of the remote end (use 0.0.0.0 for a floating/dynamic remote endpoint).
|
| services.chhoto-url.settings.try_longer_slugs | Whether to try a longer UID upon collision.
|
| services.agorakit.nginx.locations.<name>.index | Adds index directive.
|
| services.kanboard.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.dolibarr.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.fediwall.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.librenms.nginx.locations.<name>.index | Adds index directive.
|
| services.kanboard.nginx.locations.<name>.index | Adds index directive.
|
| services.agorakit.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.fediwall.nginx.locations.<name>.index | Adds index directive.
|
| services.librenms.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.dolibarr.nginx.locations.<name>.index | Adds index directive.
|
| services.pixelfed.nginx.locations.<name>.index | Adds index directive.
|
| services.mainsail.nginx.locations.<name>.index | Adds index directive.
|
| services.mainsail.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.pixelfed.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.borgbackup.jobs.<name>.prune.prefix | Only consider archive names starting with this prefix for pruning
|
| services.nebula.networks.<name>.staticHostMap | The static host map defines a set of hosts with fixed IP addresses on the internet (or any network)
|
| services.dependency-track.oidc.usernameClaim | Defines the name of the claim that contains the username in the provider's userinfo endpoint
|
| services.tahoe.nodes.<name>.client.introducer | The furl for a Tahoe introducer node
|
| services.nextcloud-spreed-signaling.settings.https.certificate | Path to the certificate used for the HTTPS listener
|
| systemd.user.sockets.<name>.aliases | Aliases of that unit.
|
| systemd.user.targets.<name>.aliases | Aliases of that unit.
|
| services.ytdl-sub.instances.<name>.schedule | How often to run ytdl-sub
|
| services.gitlab-runner.services.<name>.preBuildScript | Runner-specific command script executed after code is pulled,
just before build executes.
|
| services.openvpn.servers.<name>.authUserPass | This option can be used to store the username / password credentials
with the "auth-user-pass" authentication method
|
| services.borgbackup.jobs.<name>.extraInitArgs | Additional arguments for borg init
|
| services.mosquitto.bridges.<name>.topics | Topic patterns to be shared between the two brokers
|
| services.openafsServer.cellServDB.*.dnsname | DNS full-qualified domain name of a database server
|
| services.openafsClient.cellServDB.*.dnsname | DNS full-qualified domain name of a database server
|
| systemd.nspawn.<name>.execConfig | Each attribute in this set specifies an option in the
[Exec] section of this unit
|
| systemd.timers.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.slices.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.kmonad.keyboards.<name>.defcfg.compose.key | The (optional) compose key to use.
|
| services.grafana.provision.alerting.contactPoints.settings.deleteContactPoints.*.orgId | Organization ID, default = 1.
|
| fileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| networking.ipips.<name>.ttl | The time-to-live of the connection to the remote tunnel endpoint.
|
| security.acme.certs.<name>.profile | The certificate profile to choose if the CA offers multiple profiles.
|
| services.snapserver.streams.<name>.codec | Default audio compression method.
|
| services.httpd.virtualHosts.<name>.locations | Declarative location config
|
| services.tinc.networks.<name>.interfaceType | The type of virtual interface used for the network connection.
|
| services.nextcloud.settings.mail_smtpmode | Which mode to use for sending mail
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert | Section for a certificate candidate to use for
authentication
|
| services.kanata.keyboards.<name>.extraDefCfg | Configuration of defcfg other than linux-dev (generated
from the devices option) and
linux-continue-if-no-devs-found (hardcoded to be yes)
|
| services.keyd.keyboards.<name>.extraConfig | Extra configuration that is appended to the end of the file.
Do not write ids section here, use a separate option for it
|
| systemd.user.timers.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.user.slices.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.grafana.provision.alerting.templates.settings.deleteTemplates | List of alert rule UIDs that should be deleted.
|
| services.radicale.config | Radicale configuration, this will set the service
configuration file
|
| services.postfix.masterConfig.<name>.private | Whether the service's sockets and storage directory is restricted to
be only available via the mail system
|
| services.restic.backups.<name>.dynamicFilesFrom | A script that produces a list of files to back up
|
| services.github-runners.<name>.nodeRuntimes | List of Node.js runtimes the runner should support.
|
| documentation.man.mandoc.settings.output.style | Path to the file used for an external style-sheet
|
| networking.networkmanager.settings | Configuration added to the generated NetworkManager.conf, note that you can overwrite settings with this
|
| services.neo4j.ssl.policies.<name>.revokedDir | Path to directory of CRLs (Certificate Revocation Lists) in
PEM format
|
| services.nextcloud-spreed-signaling.settings.sessions.blockkeyFile | The path to the file containing the value for sessions.blockkey
|
| services.strongswan-swanctl.swanctl.secrets.ecdsa.<name>.file | File name in the ecdsa folder for which this
passphrase should be used.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs8.<name>.file | File name in the pkcs8 folder for which this
passphrase should be used.
|
| services.davis.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.movim.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.slskd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| users.extraUsers.<name>.packages | The set of packages that should be made available to the user
|
| services.mediagoblin.settings.mediagoblin.sql_engine | Database to use.
|
| services.znc.confOptions.networks.<name>.channels | IRC channels to join.
|
| services.fedimintd.<name>.bitcoin.network | Bitcoin network to participate in.
|
| services.akkoma.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.fluidd.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.fedimintd.<name>.nginx.config.extraConfig | These lines go to the end of the vhost verbatim.
|
| services.gancio.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.monica.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.matomo.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.rke2.autoDeployCharts.<name>.enable | Whether to enable the installation of this Helm chart
|
| services.tarsnap.archives.<name>.excludes | Exclude files and directories matching these patterns.
|
| services.jibri.xmppEnvironments.<name>.control.muc.nickname | The nickname for this Jibri instance in the MUC.
|
| services.netbird.tunnels.<name>.hardened | Hardened service:
- runs as a dedicated user with minimal set of permissions (see caveats),
- restricts daemon configuration socket access to dedicated user group
(you can grant access to it with
users.users."<user>".extraGroups = [ netbird-‹name› ]),
Even though the local system resources access is restricted:
CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
- older kernels don't have
CAP_BPF and use CAP_SYS_ADMIN instead,
Known security features that are not (yet) integrated into the module:
- 2024-02-14:
rosenpass is an experimental feature configurable solely
through --enable-rosenpass flag on the netbird up command,
see the docs
|
| services.netbird.clients.<name>.hardened | Hardened service:
- runs as a dedicated user with minimal set of permissions (see caveats),
- restricts daemon configuration socket access to dedicated user group
(you can grant access to it with
users.users."<user>".extraGroups = [ netbird-‹name› ]),
Even though the local system resources access is restricted:
CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
- older kernels don't have
CAP_BPF and use CAP_SYS_ADMIN instead,
Known security features that are not (yet) integrated into the module:
- 2024-02-14:
rosenpass is an experimental feature configurable solely
through --enable-rosenpass flag on the netbird up command,
see the docs
|
| services.firezone.server.settingsSecret.LIVE_VIEW_SIGNING_SALT | A file containing a unique base64 encoded secret for the
LIVE_VIEW_SIGNING_SALT
|
| services.mautrix-meta.instances.<name>.dataDir | Path to the directory with database, registration, and other data for the bridge service
|
| boot.loader.grub.users.<name>.password | Specifies the clear text password for the account
|
| services.nextcloud-spreed-signaling.settings.stats.allowed_ips | List of IP addresses that are allowed to access the debug, stats and metrics endpoints
|
| services.maubot.settings.plugin_databases.sqlite | The directory where SQLite plugin databases should be stored.
|
| services.mpdscribble.endpoints.<name>.username | Username for the scrobble service.
|
| services.easytier.instances.<name>.enable | Enable the instance.
|
| services.opkssh.providers.<name>.lifetime | Token lifetime
|
| documentation.man.mandoc.settings.output.toc | Whether to enable printing a table of contents near the beginning of the HTML output
of mandoc(1) if an input file contains at least two
non-standard sections
.
|
| services.geoclue2.appConfig.<name>.isAllowed | Whether the application will be allowed access to location information.
|
| services.firewalld.services.<name>.sourcePorts | Source ports for the service.
|
| security.pam.services.<name>.gnupg.noAutostart | Don't start gpg-agent if it is not running
|
| services.system76-scheduler.settings.processScheduler.useExecsnoop | Use execsnoop (otherwise poll the precess list periodically).
|
| services.klipper.firmwares.<name>.package | Path to the built firmware package.
|
| services.fedimintd.<name>.nginx.config.listen.*.port | Port number to listen on
|
| users.extraUsers.<name>.useDefaultShell | If true, the user's shell will be set to
users.defaultUserShell.
|
| services.redis.servers.<name>.maxclients | Set the max number of connected clients at the same time.
|
| programs.neovim.runtime.<name>.text | Text of the file.
|
| services.nginx.virtualHosts.<name>.reuseport | Create an individual listening socket
|
| services.headscale.settings.oidc.allowed_domains | Allowed principal domains. if an authenticated user's domain
is not in this list authentication request will be rejected.
|
| services.maddy.hostname | Hostname to use
|
| services.radicle.httpd.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.spiped.config.<name>.weakHandshake | Use fast/weak handshaking: This reduces the CPU time spent
in the initial connection setup, at the expense of losing
perfect forward secrecy.
|
| services.kanata.keyboards.<name>.devices | Paths to keyboard devices
|
| services.httpd.virtualHosts.<name>.documentRoot | The path of Apache's document root directory
|
| services.drupal.sites.<name>.database.tablePrefix | The $table_prefix is the value placed in the front of your database tables
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.ports.*.to | The end of the port range, inclusive.
|
| services.snipe-it.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.dolibarr.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.agorakit.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.kanboard.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.anuko-time-tracker.nginx.locations.<name>.root | Root directory for requests.
|
| services.librenms.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.fediwall.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.mainsail.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.pixelfed.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.vdirsyncer.jobs.<name>.config.statusPath | vdirsyncer's status path
|
| services.wordpress.sites.<name>.virtualHost.addSSL | Whether to enable HTTPS in addition to plain HTTP
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.ports | Either a single port or port range to allow
|
| services.grafana.settings.users.auto_assign_org | Set to true to automatically add new users to the main organization (id 1)
|
| services.postfix.settings.main.mynetworks_style | The method used for generating the default value for mynetworks, if that option is unset.
https://www.postfix.org/postconf.5.html#mynetworks_style
|
| services.openvpn.servers.<name>.authUserPass.password | The password to store inside the credentials file.
|
| services.fcgiwrap.instances.<name>.socket.user | User to be set as owner of the UNIX socket.
|
| services.fcgiwrap.instances.<name>.socket.type | Socket type: 'unix', 'tcp' or 'tcp6'.
|
| services.v4l2-relayd.instances.<name>.output.format | The video-format to write to output-stream.
|
| services.znc.confOptions.networks.<name>.password | IRC server password, such as for a Slack gateway.
|
| services.errbot.instances.<name>.identity | Errbot identity configuration
|
| services.fedimintd.<name>.nginx.config.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| virtualisation.xen.store.settings.quota.maxWatch | Maximum number of watches by the Xenstore Watchdog.
|
| services.gitlab-runner.services.<name>.postBuildScript | Runner-specific command script executed after code is pulled
and just after build executes.
|
| services.wstunnel.servers.<name>.restrictTo | Accepted traffic will be forwarded only to this service.
|
| services.keepalived.vrrpScripts.<name>.fall | Required number of failures for KO transition.
|
| services.keepalived.vrrpScripts.<name>.rise | Required number of successes for OK transition.
|
| services.nextcloud.settings.trusted_proxies | Trusted proxies, to provide if the nextcloud installation is being
proxied to secure against e.g. spoofing.
|
| services.nextcloud.settings.trusted_domains | Trusted domains, from which the nextcloud installation will be
accessible
|
| services.ergochat.configFile | Path to configuration file
|
| services.snapserver.streams.<name>.query | Key-value pairs that convey additional parameters about a stream.
|
| services.klipper.firmwares.<name>.configFile | Path to firmware config which is generated using klipper-genconf
|
| services.firezone.server.provision.accounts.<name>.actors | All actors (users) to provision
|
| systemd.user.services.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.services.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.vmalert.instances.<name>.enable | Wether to enable VictoriaMetrics's vmalert.
vmalert evaluates alerting and recording rules against a data source, sends notifications via Alertmanager.
|
| services.bepasty.servers.<name>.secretKeyFile | A file that contains the server secret for safe session cookies, must be set.
secretKeyFile takes precedence over secretKey
|
| services.orangefs.server.fileSystems.<name>.troveSyncData | Sync data.
|
| services.vdirsyncer.jobs.<name>.config.general | general configuration
|
| services.grafana.provision.alerting.templates.settings.deleteTemplates.*.orgId | Organization ID, default = 1.
|
| services.kanidm.provision.persons.<name>.groups | List of groups this person should belong to.
|
| services.wstunnel.servers.<name>.listen.enableHTTPS | Use HTTPS for the tunnel server.
|
| services.nominatim.database.dbname | Name of the postgresql database.
|
| services.roundcube.database.dbname | Name of the postgresql database
|
| services.firewalld.zones.<name>.forwardPorts.*.port | |
| services.firezone.server.settingsSecret.COOKIE_SIGNING_SALT | A file containing a unique base64 encoded secret for the
COOKIE_SIGNING_SALT
|
| services.drupal.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| services.matrix-conduit.settings.global.trusted_servers | Servers trusted with signing server keys.
|
| services.drupal.sites.<name>.virtualHost.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.drupal.sites.<name>.virtualHost.robotsEntries | Specification of pages to be ignored by web crawlers
|
| services.gitlab-runner.services.<name>.dockerExtraHosts | Add a custom host-to-IP mapping.
|
| security.acme.certs.<name>.extraLegoFlags | Additional global flags to pass to all lego commands.
|
| systemd.sockets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.targets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.autorandr.profiles.<name>.config | Per output profile configuration.
|
| services.authelia.instances.<name>.enable | Whether to enable Authelia instance.
|
| services.sanoid.templates.<name>.autosnap | Whether to automatically take snapshots.
|
| services.public-inbox.settings.publicinboxmda.spamcheck | If set to spamc, public-inbox-watch(1) will filter spam
using SpamAssassin.
|
| services.grafana.settings.users.allow_org_create | Set to false to prohibit users from creating new organizations.
|
| services.github-runners.<name>.group | Group under which to run the service
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.enable | Boost Pipewire client priorities.
|
| services.fedimintd.<name>.nginx.config.http2 | Whether to enable the HTTP/2 protocol
|
| services.snapserver.settings.tcp.bind_to_address | Address to listen on for snapclient connections.
|
| systemd.user.paths.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.units.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.maubot.settings.server.plugin_base_path | The base path for plugin endpoints
|
| services.grafana.settings.security.admin_password | Default admin password
|
| systemd.user.sockets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| systemd.user.targets.<name>.upheldBy | Keep this unit running as long as the listed units are running
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.id | IKE identity to expect for authentication round
|
| services.syncoid.commands.<name>.sendOptions | Advanced options to pass to zfs send
|
| services.syncoid.commands.<name>.recvOptions | Advanced options to pass to zfs recv
|
| services.mobilizon.settings.":mobilizon".":instance".email_from | The email for the From: header in emails
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert | Section for a certificate candidate to use for
authentication
|
| systemd.services.<name>.reloadIfChanged | Whether the service should be reloaded during a NixOS
configuration switch if its definition has changed
|
| services.hostapd.radios.<name>.networks.<name>.ignoreBroadcastSsid | Send empty SSID in beacons and ignore probe request frames that do not
specify full SSID, i.e., require stations to know SSID
|
| services.warpgate.settings.http.sni_certificates | Certificates for additional domains.
|
| services.orangefs.server.fileSystems.<name>.troveSyncMeta | Sync meta data.
|
| services.veilid.settings.core.protected_store.directory | The filesystem directory to store your protected store in.
|
| services.drupal.sites.<name>.database.createLocally | Create the database and database user locally.
|
| services.moodle.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.nagios.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.moodle.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.nagios.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.wordpress.sites.<name>.virtualHost.adminAddr | E-mail address of the server administrator.
|
| services.kanidm.provision.groups.<name>.present | Whether to ensure that this group is present or absent.
|
| services.kmonad.keyboards.<name>.defcfg.enable | Whether to enable automatic generation of the defcfg block
|
| services.wordpress.sites.<name>.virtualHost.onlySSL | Whether to enable HTTPS and reject plain HTTP connections
|
| virtualisation.xen.store.settings.quota.enable | Whether to enable the quota system.
|
| services.wordpress.sites.<name>.virtualHost.acmeRoot | Directory for the acme challenge which is PUBLIC, don't put certs or keys in here
|
| services.gitlab-runner.services.<name>.executor | Select executor, eg. shell, docker, etc
|
| services.mbpfan.settings.general.polling_interval | The polling interval.
|
| services.nylon.<name>.nrConnections | The number of allowed simultaneous connections to the daemon, default 10.
|
| services.sanoid.datasets.<name>.autoprune | Whether to automatically prune old snapshots.
|
| services.wyoming.piper.servers.<name>.zeroconf.enable | Whether to enable zeroconf discovery.
|
| services.grafana.settings.database.client_key_path | The path to the client key
|
| services.swapspace.settings.lower_freelimit | Lower free-space threshold: if the percentage of free space drops below this number, additional swapspace is allocated
|
| users.extraUsers.<name>.subGidRanges.*.startGid | Start of the range of subordinate group ids that user is
allowed to use.
|
| users.extraUsers.<name>.subUidRanges.*.startUid | Start of the range of subordinate user ids that user is
allowed to use.
|
| services.grafana.provision.datasources.settings.datasources | List of datasources to insert/update.
|
| services.fedimintd.<name>.nginx.config.listen | Listen addresses and ports for this virtual host
|
| services.rshim.device | Specify the device name to attach
|
| services.prefect.workerPools.<name>.installPolicy | install policy for the worker (always, if-not-present, never, prompt)
|
| services.displayManager.dms-greeter.compositor.name | The Wayland compositor to run the greeter in
|
| services.glitchtip.settings.ENABLE_ORGANIZATION_CREATION | When false, only superusers will be able to create new organizations after the first
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.eap_id | Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
|
| systemd.units.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.paths.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.borgbackup.jobs.<name>.extraPruneArgs | Additional arguments for borg prune
|
| virtualisation.qemu.drives.*.name | A name for the drive
|
| services.orangefs.server.fileSystems.<name>.rootHandle | File system root ID.
|
| services.anubis.instances.<name>.policy.extraBots | Additional bot rules appended to the policy
|
| services.drupal.sites.<name>.virtualHost.locations | Declarative location config
|
| services.gitlab-runner.services.<name>.dockerPullPolicy | Default pull-policy for Docker images
|
| services.buildkite-agents.<name>.package | The buildkite-agent package to use.
|
| services.hickory-dns.configFile | Path to an existing toml file to configure hickory-dns with
|
| services.fcgiwrap.instances.<name>.socket.mode | Mode to be set on the UNIX socket
|
| virtualisation.xen.store.settings.perms.enable | Whether to enable the node permission system.
|
| security.pam.services.<name>.ttyAudit.disablePattern | For each user matching one of comma-separated
glob patterns, disable TTY auditing
|
| services.nbd.server.exports.<name>.allowAddresses | IPs and subnets that are authorized to connect for this device
|
| services.firewalld.zones.<name>.forwardPorts.*.to-port | |
| services.restic.backups.<name>.repository | repository to backup to.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.ports.*.from | The start of the port range, inclusive.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.round | Optional numeric identifier by which authentication rounds are
sorted
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.root | Root directory for requests.
|
| services.radicle.httpd.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.radicle.httpd.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.i2pd.proto.http.hostname | Expected hostname for WebUI.
|
| security.auditd.plugins.<name>.path | This is the absolute path to the plugin executable.
|
| services.movim.h2o.serverName | Server name to be used for this virtual host
|
| services.adguardhome.settings.schema_version | Schema version for the configuration
|
| services.namecoind.rpc.key | Key file for securing RPC connections.
|
| services.easytier.instances.<name>.extraArgs | Extra args append to the easytier command-line.
|
| services.restic.backups.<name>.rcloneConfigFile | Path to the file containing rclone configuration
|
| services.restic.backups.<name>.createWrapper | Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service
|
| boot.initrd.systemd.contents.<name>.text | Text of the file.
|
| services.grafana.settings.server.static_root_path | Root path for static assets.
|
| services.snapserver.settings.http.bind_to_address | Address to listen on for snapclient connections.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs12.<name>.file | File name in the pkcs12 folder for which this
passphrase should be used.
|
| services.swapspace.settings.upper_freelimit | Upper free-space threshold: if the percentage of free space exceeds this number, swapspace will attempt to free up swapspace
|
| services.borgbackup.jobs.<name>.privateTmp | Set the PrivateTmp option for
the systemd-service
|
| services.bookstack.nginx.locations.<name>.root | Root directory for requests.
|
| services.parsedmarc.settings.general.save_aggregate | Save aggregate report data to Elasticsearch and/or Splunk.
|
| virtualisation.xen.store.settings.quota.maxEntity | Entity limit for transactions.
|
| services.cjdns.ETHInterface.connectTo.<name>.publicKey | Public key at the opposite end of the tunnel.
|
| services.cjdns.UDPInterface.connectTo.<name>.publicKey | Public key at the opposite end of the tunnel.
|
| services.printing.cups-pdf.instances.<name>.enable | Whether to enable this cups-pdf instance.
|
| services.kanidm.provision.groups.<name>.members | List of kanidm entities (persons, groups, ...) which are part of this group.
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.nice | Niceness.
|
| services.buildkite-agents.<name>.tokenPath | The token from your Buildkite "Agents" page
|
| services.biboumi.settings.policy_directory | A directory that should contain the policy files,
used to customize Botan’s behaviour
when negotiating the TLS connections with the IRC servers.
|
| services.restic.backups.<name>.initialize | Create the repository if it doesn't exist.
|
| services.jibri.xmppEnvironments.<name>.control.login.username | User part of the JID.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.gatewayGroups | A list of gateway groups (sites) which can reach the resource and may be used to connect to it.
|
| networking.fooOverUDP.<name>.local.dev | Network device to bind to.
|
| services.parsedmarc.settings.elasticsearch.password | The password to use when connecting to Elasticsearch,
if required
|
| services.grafana.provision.datasources.settings.datasources.*.url | Url of the datasource.
|
| services.minidlna.settings.notify_interval | The interval between announces (in seconds)
|
| systemd.paths.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.grafana.settings.users.default_language | This setting configures the default UI language, which must be a supported IETF language tag, such as en-US.
|
| services.ghostunnel.servers.<name>.allowAll | If true, allow all clients, do not check client cert subject.
|
| systemd.user.paths.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.dovecot2.mailboxes.<name>.auto | Whether to automatically create or create and subscribe to the mailbox or not.
|
| services.blockbook-frontend.<name>.sync | Synchronizes until tip, if together with zeromq, keeps index synchronized.
|
| networking.fooOverUDP.<name>.port | Local port of the encapsulation UDP socket.
|
| services.tuned.settings.recommend_command | Whether to enable recommend functionality.
|
| services.quickwit.settings.grpc_listen_port | The port to listen on for gRPC traffic.
|
| services.nvme-rs.settings.thresholds.error_threshold | Error count warning threshold
|
| services.neo4j.ssl.policies.<name>.trustedDir | Path to directory of X.509 certificates in PEM format for
trusted parties
|
| systemd.user.services.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.wyoming.piper.servers.<name>.streaming | Whether to enable audio streaming on sentence boundaries.
|
| services.wordpress.sites.<name>.virtualHost.listen.*.ip | IP to listen on. 0.0.0.0 for IPv4 only, * for all.
|
| services.drupal.sites.<name>.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.davis.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.slskd.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.movim.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.grafana.settings.users.viewers_can_edit | Viewers can access and use Explore and perform temporary edits on panels in dashboards they have access to
|
| services.firewalld.zones.<name>.ports.*.protocol | |
| services.firezone.server.provision.accounts.<name>.groups | All groups to provision
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.prio | CPU scheduler priority.
|
| security.acme.certs.<name>.extraLegoRunFlags | Additional flags to pass to lego run.
|
| services.fedimintd.<name>.nginx.config.forceSSL | Whether to add a separate nginx server block that redirects (defaults
to 301, configurable with redirectCode) all plain HTTP traffic to
HTTPS
|
| services.jupyterhub.kernels.<name>.logo64 | Path to 64x64 logo png.
|
| services.jupyterhub.kernels.<name>.logo32 | Path to 32x32 logo png.
|
| services.tinc.networks.<name>.ed25519PrivateKeyFile | Path of the private ed25519 keyfile.
|
| services.system76-scheduler.settings.processScheduler.refreshInterval | Process list poll interval, in seconds
|
| services.warpgate.settings.http.sni_certificates.*.key | Path to private key.
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.dev | The name of the device to add the address to.
|
| services.minidlna.settings.enable_subtitles | Enable subtitle support on unknown clients.
|
| boot.initrd.luks.devices.<name>.yubikey | The options to use for this LUKS device in YubiKey-PBA
|
| services.bacula-sd.director.<name>.monitor | If Monitor is set to no, this director will have
full access to this Storage daemon
|
| services.bacula-fd.director.<name>.monitor | If Monitor is set to no, this director will have
full access to this Storage daemon
|
| services.nebula.networks.<name>.enableReload | Enable automatic config reload on config change
|
| services.akkoma.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fluidd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fedimintd.<name>.nginx.config.basicAuthFile | Basic Auth password file for a vhost
|
| services.gancio.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.monica.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.matomo.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.borgbackup.jobs.<name>.dumpCommand | Backup the stdout of this program instead of filesystem paths
|
| networking.sits.<name>.local | The address of the local endpoint which the remote
side should send packets to.
|
| services.firewalld.services.<name>.sourcePorts.*.port | |
| services.anuko-time-tracker.nginx.locations.<name>.index | Adds index directive.
|
| services.anuko-time-tracker.nginx.locations.<name>.alias | Alias directory for requests.
|
| users.mysql.pam.userColumn | The name of the column that contains a unix login name.
|
| services.tarsnap.archives.<name>.includes | Include only files and directories matching these
patterns (the empty list includes everything)
|
| services.mautrix-meta.instances.<name>.enable | Whether to enable Mautrix-Meta, a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge.
|
| services.kimai.sites.<name>.database.serverVersion | MySQL exact version string
|
| services.dokuwiki.sites.<name>.templates | List of path(s) to respective template(s) which are copied into the 'tpl' directory.
These templates need to be packaged before use, see example.
|
| services.invoiceplane.sites.<name>.cron.key | Cron key taken from the administration page.
|
| services.agorakit.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.dolibarr.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fediwall.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.librenms.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fcgiwrap.instances.<name>.socket.group | Group to be set as owner of the UNIX socket.
|
| services.kanboard.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.pixelfed.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.mainsail.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.radicle.httpd.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.ioPrio | IO scheduler priority.
|
| services.parsedmarc.settings.elasticsearch.cert_path | The path to a TLS certificate bundle used to verify
the server's certificate.
|
| services.wstunnel.servers.<name>.restrictTo.*.port | The port.
|
| services.wstunnel.servers.<name>.restrictTo.*.host | The hostname.
|
| services.firewalld.zones.<name>.protocols | Protocols to allow in the zone.
|
| services.zeronsd.servedNetworks.<name>.package | The zeronsd package to use.
|
| services.anubis.instances.<name>.botPolicy | Anubis policy configuration in Nix syntax
|
| systemd.user.slices.<name>.sliceConfig | Each attribute in this set specifies an option in the
[Slice] section of the unit
|
| services.firewalld.zones.<name>.forwardPorts.*.to-addr | Destination IP address.
|
| services.restic.backups.<name>.rcloneOptions | Options to pass to rclone to control its behavior
|
| systemd.slices.<name>.sliceConfig | Each attribute in this set specifies an option in the
[Slice] section of the unit
|
| systemd.nspawn.<name>.filesConfig | Each attribute in this set specifies an option in the
[Files] section of this unit
|
| services.httpd.virtualHosts.<name>.globalRedirect | If set, all requests for this host are redirected permanently to
the given URL.
|
| containers.<name>.bindMounts.<name>.hostPath | Location of the host path to be mounted.
|
| services.kubernetes.kubelet.taints.<name>.value | Value of taint.
|
| security.wrappers.<name>.group | The group of the wrapper program.
|
| security.wrappers.<name>.owner | The owner of the wrapper program.
|
| services.headscale.settings.database.postgres.password_file | A file containing the password corresponding to
database.user.
|
| services.firewalld.services.<name>.includes | Services to include for the service.
|
| services.borgbackup.jobs.<name>.exclude | Exclude paths matching any of the given patterns
|
| services.grafana.settings.database.isolation_level | Only the MySQL driver supports isolation levels in Grafana
|
| services.wordpress.sites.<name>.database.socket | Path to the unix socket file to use for authentication.
|
| services.netbird.clients.<name>.openFirewall | Opens up firewall port for communication between NetBird peers directly over LAN or public IP,
without using (internet-hosted) TURN servers as intermediaries.
|
| services.netbird.tunnels.<name>.openFirewall | Opens up firewall port for communication between NetBird peers directly over LAN or public IP,
without using (internet-hosted) TURN servers as intermediaries.
|
| services.snipe-it.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.gitlab-runner.services.<name>.dockerVolumes | Bind-mount a volume and create it
if it doesn't exist prior to mounting.
|
| services.kmonad.keyboards.<name>.defcfg.compose.delay | The delay (in milliseconds) between compose key sequences.
|
| virtualisation.xen.store.settings.enableMerge | Whether to enable transaction merge support.
|
| services.nextcloud.settings.mail_smtpsecure | This depends on mail_smtpmode
|
| security.acme.certs.<name>.server | ACME Directory Resource URI
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.certs | List of certificates to accept for authentication
|
| services.grafana.provision.datasources.settings.datasources.*.type | Datasource type
|
| services.kerberos_server.settings.includedir | Directories containing files to include in the Kerberos configuration.
|
| systemd.services.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.ghostunnel.servers.<name>.target | Address to forward connections to (can be HOST:PORT or unix:PATH).
|
| services.ghostunnel.servers.<name>.listen | Address and port to listen on (can be HOST:PORT, unix:PATH).
|
| services.stash.username | Username for login.
|
| systemd.network.links.<name>.enable | Whether to enable this .link unit
|
| environment.etc.<name>.text | Text of the file.
|
| services.slurm.nodeName | Name that SLURM uses to refer to a node (or base partition for BlueGene
systems)
|
| systemd.services.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.round | Optional numeric identifier by which authentication rounds are
sorted
|
| services.wyoming.faster-whisper.servers.<name>.extraArgs | Extra arguments to pass to the server commandline.
|
| services.wordpress.sites.<name>.virtualHost.listen.*.ssl | Whether to enable SSL (https) support.
|
| services.openvpn.servers.<name>.updateResolvConf | Use the script from the update-resolv-conf package to automatically
update resolv.conf with the DNS information provided by openvpn
|
| systemd.sockets.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.targets.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.user.targets.<name>.upholds | Keeps the specified running while this unit is running
|
| systemd.user.sockets.<name>.upholds | Keeps the specified running while this unit is running
|
| services.openssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.fedimintd.<name>.nginx.config.rejectSSL | Whether to listen for and reject all HTTPS connections to this vhost
|
| services.github-runners.<name>.extraPackages | Extra packages to add to PATH of the service to make them available to workflows.
|
| services.matrix-appservice-irc.settings.ircService.passwordEncryptionKeyPath | Location of the key with which IRC passwords are encrypted
for storage
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.interface | Optional interface name to restrict outbound IPsec policies.
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.class | CPU scheduler class.
|
| services.consul-template.instances.<name>.user | User under which this instance runs.
|
| services.bacula-sd.director.<name>.tls.certificate | The full path to the PEM encoded TLS certificate
|
| services.bacula-fd.director.<name>.tls.certificate | The full path to the PEM encoded TLS certificate
|
| boot.initrd.luks.devices.<name>.gpgCard.gracePeriod | Time in seconds to wait for the GPG Smartcard.
|
| services.gitea-actions-runner.instances.<name>.url | Base URL of your Gitea/Forgejo instance.
|
| users.mysql.nss | Settings for libnss-mysql
|
| services.nebula.networks.<name>.firewall.inbound | Firewall rules for inbound traffic.
|
| services.orangefs.server.fileSystems.<name>.extraConfig | Extra config for <FileSystem> section.
|
| services.wordpress.sites.<name>.virtualHost.listen.*.port | Port to listen on
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.alias | Alias directory for requests.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.index | Adds index directive.
|
| services.openssh.knownHosts.<name>.certAuthority | This public key is an SSH certificate authority, rather than an
individual host's key.
|
| services.woodpecker-agents.agents.<name>.path | Additional packages that should be added to the agent's PATH
|
| services.wyoming.faster-whisper.servers.<name>.enable | Whether to enable Wyoming faster-whisper server.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.bandwidth-size | sched_cfs_bandwidth_slice_us.
|
| services.buildkite-agents.<name>.extraGroups | Groups the user for this buildkite agent should belong to
|
| systemd.user.paths.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.module | Optional PKCS#11 module name to access the token.
|
| services.wyoming.faster-whisper.servers.<name>.beamSize | The number of beams to use in beam search
|
| boot.specialFileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| services.grafana.provision.alerting.templates.settings.templates.*.template | Alerting with a custom text template
|
| services.jitsi-videobridge.xmppConfigs.<name>.mucNickname | Videobridges use the same XMPP account and need to be distinguished by the
nickname (aka resource part of the JID)
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.ioClass | IO scheduler class.
|
| users.extraUsers.<name>.expires | Set the date on which the user's account will no longer be
accessible
|
| systemd.paths.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.blockbook-frontend.<name>.cssDir | Location of the dir with main.css CSS file
|
| services.anuko-time-tracker.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.bookstack.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.bookstack.nginx.locations.<name>.index | Adds index directive.
|
| services.wstunnel.clients.<name>.customHeaders | Custom HTTP headers to send during the upgrade request.
|
| services.wordpress.sites.<name>.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.namecoind.rpc.port | Port the RPC server will bind to.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert | Section for a CA certificate to accept for authentication
|
| services.fedimintd.<name>.nginx.config.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| services.dolibarr.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.librenms.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.dolibarr.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.librenms.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.kanboard.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.kanboard.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.fediwall.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.fediwall.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.agorakit.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.agorakit.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.mainsail.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.pixelfed.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.pixelfed.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.mainsail.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| virtualisation.docker.daemon.settings | Configuration for docker daemon
|
| services.nginx.virtualHosts.<name>.globalRedirect | If set, all requests for this host are redirected (defaults to 301,
configurable with redirectCode) to the given hostname.
|
| boot.loader.systemd-boot.windows.<name>.title | The title of the boot menu entry.
|
| services.github-runners.<name>.tokenType | Type of token to use for runner registration
|
| services.headscale.settings.derp.update_frequency | Frequency to update DERP maps.
|
| services.buildkite-agents.<name>.extraConfig | Extra lines to be added verbatim to the configuration file.
|
| services.dependency-track.settings."alpine.oidc.user.provisioning" | Specifies if mapped OpenID Connect accounts are automatically created upon successful
authentication
|
| services.authelia.instances.<name>.package | The authelia package to use.
|
| services.wordpress.sites.<name>.virtualHost.http2 | Whether to enable HTTP 2
|
| services.dovecot2.pluginSettings | Plugin settings for dovecot in general, e.g. sieve, sieve_default, etc
|
| services.kanata.keyboards.<name>.configFile | The config file
|
| services.grafana.provision.datasources.settings.datasources.*.uid | Custom UID which can be used to reference this datasource in other parts of the configuration, if not specified will be generated automatically.
|
| services.snapper.configs.<name>.TIMELINE_CREATE | Defines whether hourly snapshots should be created.
|
| systemd.user.services.<name>.environment | Environment variables passed to the service's processes.
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.nginx.virtualHosts.<name>.redirectCode | HTTP status used by globalRedirect and forceSSL
|
| services.moodle.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.nagios.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.borgbackup.jobs.<name>.extraCreateArgs | Additional arguments for borg create
|
| services.strongswan-swanctl.swanctl.secrets.private.<name>.file | File name in the private folder for which this passphrase should be used.
|
| services.matrix-synapse.settings.media_store_path | Directory where uploaded images and attachments are stored.
|
| services.matrix-synapse.settings.max_image_pixels | Maximum number of pixels that will be thumbnailed
|
| services.matrix-synapse.settings.signing_key_path | Path to the signing key to sign messages with.
|
| services.btrbk.instances.<name>.onCalendar | How often this btrbk instance is started
|
| services.snapper.configs.<name>.SUBVOLUME | Path of the subvolume or mount point
|
| systemd.user.sockets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.sockets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.user.targets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.user.targets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| services.snapserver.settings.stream.bind_to_address | Address to listen on for snapclient connections.
|
| services.rke2.manifests.<name>.content | Content of the manifest file
|
| systemd.targets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.targets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| systemd.sockets.<name>.onFailure | A list of one or more units that are activated when
this unit enters the "failed" state.
|
| systemd.sockets.<name>.onSuccess | A list of one or more units that are activated when
this unit enters the "inactive" state.
|
| security.acme.certs.<name>.enableDebugLogs | Whether to enable debug logging for this certificate.
|
| power.ups.ups.<name>.description | Description of the UPS.
|
| services.firezone.server.provision.accounts.<name>.relayGroups | All relay groups to provision
|
| services.nebula.networks.<name>.lighthouse.dns.port | UDP port number for lighthouse DNS server.
|
| services.jirafeau.nginxConfig.locations.<name>.root | Root directory for requests.
|
| services.gitlab-runner.services.<name>.runUntagged | Register to run untagged builds; defaults to
true when tagList is empty
|
| services.kanidm.provision.persons.<name>.present | Whether to ensure that this person is present or absent.
|
| boot.initrd.luks.devices.<name>.keyFileSize | The size of the key file
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.eap_id | Identity to use as peer identity during EAP authentication
|
| services.nntp-proxy.users.<name>.maxConnections | Maximum number of concurrent connections to the proxy for this user
|
| services.drupal.sites.<name>.virtualHost.globalRedirect | If set, all requests for this host are redirected permanently to
the given URL.
|
| services.wordpress.sites.<name>.virtualHost.servedDirs | This option provides a simple way to serve static directories.
|
| services.wordpress.sites.<name>.virtualHost.logFormat | Log format for Apache's log files
|
| systemd.user.timers.<name>.timerConfig | Each attribute in this set specifies an option in the
[Timer] section of the unit
|
| services.grafana.provision.datasources.settings.datasources.*.jsonData | Extra data for datasource plugins.
|
| services.system76-scheduler.settings.cfsProfiles.default.wakeup-granularity | sched_wakeup_granularity_ns.
|
| services.fedimintd.<name>.bitcoin.rpc.secretFile | If set the URL specified in bitcoin.rpc.url will get the content of this file added
as an URL password, so http://user@example.com will turn into http://user:SOMESECRET@example.com
|
| services.borgbackup.jobs.<name>.readWritePaths | By default, borg cannot write anywhere on the system but
$HOME/.config/borg and $HOME/.cache/borg
|
| services.wstunnel.servers.<name>.loggingLevel | Passed to --log-lvl
Control the log verbosity. i.e: TRACE, DEBUG, INFO, WARN, ERROR, OFF
For more details, checkout [EnvFilter](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct
|
| services.wstunnel.clients.<name>.loggingLevel | Passed to --log-lvl
Control the log verbosity. i.e: TRACE, DEBUG, INFO, WARN, ERROR, OFF
For more details, checkout [EnvFilter](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct
|
| systemd.services.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.wstunnel.clients.<name>.httpProxy | Proxy to use to connect to the wstunnel server (USER:PASS@HOST:PORT).
Passwords specified here will be world-readable in the Nix store!
To pass a password to the service, point the environmentFile option
to a file containing PROXY_PASSWORD=<your-password-here> and set
this option to <user>:$PROXY_PASSWORD@<host>:<port>
|
| services.murmur.registerHostname | DNS hostname where your server can be reached
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.tryFiles | Adds try_files directive.
|
| services.firezone.server.provision.accounts.<name>.policies.<name>.description | The description of this policy
|
| security.acme.certs.<name>.listenHTTP | Interface and port to listen on to solve HTTP challenges
in the form [INTERFACE]:PORT
|
| services.radicle.httpd.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| hardware.tuxedo-drivers.settings.charging-profile | The maximum charge level to help reduce battery wear:
high_capacity charges to 100% (driver default)
balanced charges to 90%
stationary charges to 80% (maximum lifespan)
Note: Regardless of the configured charging profile, the operating system will always report the battery as being charged to 100%.
|
| services.tor.settings.VersioningAuthoritativeDirectory | See torrc manual.
|
| systemd.user.targets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.user.sockets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| users.extraUsers.<name>.description | A short description of the user account, typically the
user's full name
|
| services.wordpress.sites.<name>.virtualHost.sslServerCert | Path to server SSL certificate.
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.filters.*.protocol | The protocol to allow
|
| services.blockbook-frontend.<name>.debug | Debug mode, return more verbose errors, reload templates on each request.
|
| services.jupyterhub.kernels.<name>.extraPaths | Extra paths to link in kernel directory
|
| services.syncoid.commands.<name>.recursive | Whether to enable the transfer of child datasets.
|
| services.akkoma.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.fediwall.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.kanboard.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.librenms.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.dolibarr.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.fluidd.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.gancio.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.agorakit.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.matomo.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.mainsail.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.monica.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.pixelfed.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| boot.specialFileSystems.<name>.fsType | Type of the file system
|
| systemd.timers.<name>.timerConfig | Each attribute in this set specifies an option in the
[Timer] section of the unit
|
| services.fedimintd.<name>.api_ws.openFirewall | Opens TCP port in firewall for fedimintd's Websocket API
|
| systemd.user.services.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.anubis.instances | An attribute set of Anubis instances
|
| services.wordpress.sites.<name>.languages | List of path(s) to respective language(s) which are copied from the 'languages' directory.
|
| services.healthchecks.settings.REGISTRATION_OPEN | A boolean that controls whether site visitors can create new accounts
|
| services.ghostunnel.servers.<name>.cacert | Path to CA bundle file (PEM/X509)
|
| services.kimai.sites.<name>.environmentFile | Securely pass environment variabels to Kimai
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.certs | List of certificate candidates to use for
authentication
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.xauth_id | Client XAuth username used in the XAuth exchange.
|
| systemd.targets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| systemd.sockets.<name>.unitConfig | Each attribute in this set specifies an option in the
[Unit] section of the unit
|
| services.github-runners.<name>.noDefaultLabels | Disables adding the default labels
|
| services.swapspace.settings.cache_elasticity | Percentage of cache space considered to be "free"
|
| services.snipe-it.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.monica.hostname | The hostname to serve monica on.
|
| services.bookstack.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.vdirsyncer.jobs.<name>.config.storages | vdirsyncer storage configurations
|
| services.v4l2-relayd.instances.<name>.input.pipeline | The gstreamer-pipeline to use for the input-stream.
|
| services.davis.hostname | Domain of the host to serve davis under
|
| services.grafana.provision.datasources.settings.deleteDatasources | List of datasources that should be deleted from the database.
|
| services.matrix-synapse.settings.listeners.*.bind_addresses | IP addresses to bind the listener to.
|
| security.pam.services.<name>.enableGnomeKeyring | If enabled, pam_gnome_keyring will attempt to automatically unlock the
user's default Gnome keyring upon login
|
| services.maubot.settings.plugin_databases.postgres | The connection URL for plugin database
|
| systemd.user.slices.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.timers.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.nextcloud-spreed-signaling.settings.backend.backendtype | Type of backend configuration
|
| boot.initrd.luks.devices.<name>.keyFileTimeout | The amount of time in seconds for a keyFile to appear before
timing out and trying passwords.
|
| services.maubot.configMutable | Whether maubot should write updated config into extraConfigFile. This will make your Nix module settings have no effect besides the initial config, as extraConfigFile takes precedence over NixOS settings!
|
| services.livekit.ingress.settings.rtc_config.port_range_end | End of UDP port range for WebRTC
|
| networking.sits.<name>.remote | The address of the remote endpoint to forward traffic over.
|
| services.kubernetes.kubelet.taints.<name>.effect | Effect of taint.
|
| hardware.tuxedo-drivers.settings.charging-priority | These options manage the trade-off between battery charging and CPU performance when the USB-C power supply cannot provide sufficient power for both simultaneously:
charge_battery prioritizes battery charging (driver default)
performance prioritizes maximum CPU performance
|
| services.consul-template.instances.<name>.group | Group under which this instance runs.
|
| services.tahoe.introducers.<name>.package | The tahoelafs package to use.
|
| security.agnos.settings.accounts.*.certificates | Certificates for agnos to issue or renew.
|
| services.wordpress.sites.<name>.virtualHost.enableUserDir | Whether to enable serving ~/public_html as
/~«username».
|
| services.gitlab-runner.services.<name>.preGetSourcesScript | Runner-specific command script executed before code is pulled.
|
| services.gitlab.smtp.username | Username of the SMTP server for GitLab.
|
| services.xserver.xkb.extraLayouts.<name>.languages | A list of languages provided by the layout.
(Use ISO 639-2 codes, for example: "eng" for english)
|
| services.keepalived.vrrpScripts.<name>.weight | Following a failure, adjust the priority by this weight.
|
| services.k3s.autoDeployCharts.<name>.createNamespace | Whether to create the target namespace if not present.
|
| services.k3s.autoDeployCharts.<name>.targetNamespace | The namespace in which the Helm chart gets installed.
|
| services.ncps.cache.redis.username | Redis username for authentication (for Redis ACL).
|
| users.extraUsers.<name>.isNormalUser | Indicates whether this is an account for a “real” user
|
| services.i2pd.inTunnels.<name>.destination | Remote endpoint, I2P hostname or b32.i2p address.
|
| services.mosquitto.listeners.*.users.<name>.acl | Control client access to topics on the broker.
|
| services.matrix-tuwunel.settings.global.trusted_servers | Servers listed here will be used to gather public keys of other servers
(notary trusted key servers)
|
| services.tor.relay.onionServices.<name>.authorizeClient.clientNames | Only clients that are listed here are authorized to access the hidden service
|
| services.pgbackrest.stanzas.<name>.instances | An attribute set of database instances as described in:
https://pgbackrest.org/configuration.html#section-stanza
Each instance defaults to set pg-host to the attribute's name
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.help | A human-readable description of this metric.
|
| systemd.network.links.<name>.extraConfig | Extra configuration append to unit
|
| services.postgresql.settings.log_line_prefix | A printf-style string that is output at the beginning of each log line
|
| fileSystems.<name>.noCheck | Disable running fsck on this filesystem.
|
| services.matrix-conduit.settings.global.allow_federation | Whether this server federates with other servers.
|
| services.matrix-tuwunel.settings.global.allow_federation | Whether this server federates with other servers.
|
| fileSystems.<name>.encrypted.blkDev | Location of the backing encrypted device.
|
| services.wordpress.sites.<name>.virtualHost.listen | Listen addresses and ports for this virtual host.
This option overrides addSSL, forceSSL and onlySSL
|
| services.librenms.database.username | Name of the user on the MySQL/MariaDB server
|
| services.fcgiwrap.instances.<name>.process.group | Group as which this instance of fcgiwrap will be run.
|
| services.anuko-time-tracker.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.searx.limiterSettings | Limiter settings for SearXNG.
|
| networking.ipips.<name>.local | The address of the local endpoint which the remote
side should send packets to.
|
| security.acme.certs.<name>.ocspMustStaple | Turns on the OCSP Must-Staple TLS extension
|
| services.grafana.settings.security.allow_embedding | When false, the HTTP header X-Frame-Options: deny will be set in Grafana HTTP responses
which will instruct browsers to not allow rendering Grafana in a <frame>, <iframe>, <embed> or <object>
|
| services.davis.nginx.serverName | Name of this virtual host
|
| services.slskd.nginx.serverName | Name of this virtual host
|
| services.movim.nginx.serverName | Name of this virtual host
|
| services.firezone.server.provision.accounts.<name>.policies | All policies to provision
|
| services.wyoming.faster-whisper.servers.<name>.device | Determines the platform faster-whisper is run on
|
| services.openafsServer.roles.backup.cellServDB.*.dnsname | DNS full-qualified domain name of a database server
|
| services.restic.backups.<name>.repositoryFile | Path to the file containing the repository location to backup to.
|
| services.headscale.settings.noise.private_key_path | Path to noise private key file, generated automatically if it does not exist.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.id | A unique identifier for this authentication token
|
| services.neo4j.ssl.policies.<name>.publicCertificate | The name of public X.509 certificate (chain) file in PEM format
for this policy to be found in the baseDirectory,
or the absolute path to the certificate file
|
| documentation.man.mandoc.settings.output.width | The ASCII and UTF-8 output width, default is 78
|
| services.syncoid.commands.<name>.localSourceAllow | Permissions granted for the services.syncoid.user user
for local source datasets
|
| services.undervolt.useTimer | Whether to set a timer that applies the undervolt settings every 30s
|
| services.gitlab-runner.services.<name>.dockerDisableCache | Disable all container caching.
|
| services.strongswan-swanctl.swanctl.connections.<name>.pools | List of named IP pools to allocate virtual IP addresses
and other configuration attributes from
|
| programs.dms-shell.plugins.<name>.enable | Whether to enable this plugin
|
| systemd.nspawn.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.timers.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.slices.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_DAILY | Limits for timeline cleanup.
|
| environment.etc.<name>.gid | GID of created file
|
| environment.etc.<name>.uid | UID of created file
|
| services.davis.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.movim.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.slskd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fcgiwrap.instances.<name>.process.user | User as which this instance of fcgiwrap will be run
|
| users.extraUsers.<name>.isSystemUser | Indicates if the user is a system user or not
|
| systemd.user.slices.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.user.timers.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.user.units.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.paths.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.sanoid.templates.<name>.autoprune | Whether to automatically prune old snapshots.
|
| services.i2pd.outTunnels.<name>.destination | Remote endpoint, I2P hostname or b32.i2p address.
|
| services.reposilite.database.dbname | Database name.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.updown | Updown script to invoke on CHILD_SA up and down events.
|
| services.kanidm.provision.systems.oauth2.<name>.public | Whether this is a public client (enforces PKCE, doesn't use a basic secret)
|
| networking.vswitches.<name>.interfaces.<name>.vlan | Vlan tag to apply to interface
|
| networking.vswitches.<name>.interfaces.<name>.type | Openvswitch type to assign to interface
|
| services.blockbook-frontend.<name>.coinName | See https://github.com/trezor/blockbook/blob/master/bchain/coins/blockchain.go#L61
for current of coins supported in master (Note: may differ from release).
|
| services.fedimintd.<name>.nginx.config.locations | Declarative location config
|
| services.jirafeau.nginxConfig.locations.<name>.alias | Alias directory for requests.
|
| services.jirafeau.nginxConfig.locations.<name>.index | Adds index directive.
|
| services.grafana.settings.database.client_cert_path | The path to the client cert
|
| services.grafana.provision.datasources.settings.datasources.*.access | Access mode. proxy or direct (Server or Browser in the UI)
|
| services.wordpress.sites.<name>.virtualHost.enableACME | Whether to ask Let's Encrypt to sign a certificate for this vhost
|
| systemd.slices.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.timers.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| virtualisation.xen.store.settings.quota.maxWatchEvents | Maximum number of outstanding watch events per watch.
|
| services.borgbackup.jobs.<name>.inhibitsSleep | Prevents the system from sleeping while backing up.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.query | The SQL query to run.
|
| services.blockbook-frontend.<name>.enable | Whether to enable blockbook-frontend application.
|
| systemd.services.<name>.environment | Environment variables passed to the service's processes.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacerts | List of CA certificates to accept for
authentication
|
| services.grafana.settings.security.disable_gravatar | Set to true to disable the use of Gravatar for user profile images.
|
| services.matrix-conduit.settings.global.max_request_size | Max request size in bytes
|
| services.matrix-tuwunel.settings.global.max_request_size | Max request size in bytes
|
| services.nsd.zones.<name>.outgoingInterface | This address will be used for zone-transfer requests if configured
as a secondary server or notifications in case of a primary server
|
| services.grafana.provision.datasources.settings.deleteDatasources.*.orgId | Organization ID of the datasource to delete.
|
| systemd.paths.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.units.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.paths.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.samba-wsdd.hostname | Override (NetBIOS) hostname to be used (default hostname).
|
| services.headscale.settings.derp.server.private_key_path | Path to derp private key file, generated automatically if it does not exist.
|
| services.hickory-dns.settings.listen_addrs_ipv4 | List of ipv4 addresses on which to listen for DNS queries.
|
| services.hickory-dns.settings.listen_addrs_ipv6 | List of ipv6 addresses on which to listen for DNS queries.
|
| services.bacula-sd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.bacula-fd.director.<name>.tls.caCertificateFile | The path specifying a PEM encoded TLS CA certificate(s)
|
| services.gitlab-runner.services.<name>.postGetSourcesScript | Runner-specific command script executed after code is pulled.
|
| services.fedimintd.<name>.nginx.config.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| services.snipe-it.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.snapserver.settings.tcp-control.bind_to_address | Address to listen on for snapclient connections.
|
| services.nebula.networks.<name>.isLighthouse | Whether this node is a lighthouse.
|
| containers.<name>.bindMounts.<name>.isReadOnly | Determine whether the mounted path will be accessed in read-only mode.
|
| systemd.paths.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.nginx.virtualHosts.<name>.listen.*.proxyProtocol | Enable PROXY protocol.
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.firewalld.zones.<name>.egressPriority | Priority for outbound traffic
|
| services.snipe-it.nginx.serverName | Name of this virtual host
|
| services.blockbook-frontend.<name>.public | Public http server binding [address]:port.
|
| services.keepalived.vrrpScripts.<name>.script | (Path of) Script command to execute followed by args, i.e. cmd [args]...
|
| services.firewalld.services.<name>.ports.*.protocol | |
| services.firewalld.services.<name>.protocols | Protocols for the service.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.groups | Authorization group memberships to require
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.pubkeys | List of raw public keys to accept for
authentication
|
| boot.initrd.luks.devices.<name>.fido2.gracePeriod | Time in seconds to wait for the FIDO2 key.
|
| services.bookstack.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.fediwall.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.dolibarr.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.agorakit.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.librenms.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.kanboard.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.pixelfed.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.mainsail.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.wordpress.sites.<name>.virtualHost.sslServerChain | Path to server SSL chain file.
|
| services.radicle.httpd.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.ca_id | Identity in CA certificate to accept for authentication
|
| services.anuko-time-tracker.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.anuko-time-tracker.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| security.wrappers.<name>.enable | Whether to enable the wrapper.
|
| services.omnom.settings.smtp.connection_timeout | Connection timeout duration in seconds.
|
| services.kanidm.provision.systems.oauth2.<name>.scopeMaps | Maps kanidm groups to returned oauth scopes
|
| services.caddy.virtualHosts.<name>.listenAddresses | A list of host interfaces to bind to for this virtual host.
|
| services.restic.backups.<name>.backupPrepareCommand | A script that must run before starting the backup process.
|
| services.restic.backups.<name>.backupCleanupCommand | A script that must run after finishing the backup process.
|
| services.matrix-conduit.settings.global.database_backend | The database backend for the service
|
| services.nextcloud.settings.mail_smtptimeout | This depends on mail_smtpmode
|
| services.sftpgo.settings.httpd.bindings.*.enable_web_admin | Enable the built-in web admin for this interface binding.
|
| systemd.user.services.<name>.notSocketActivated | If set, a changed unit is never assumed to be
socket-activated on configuration switch, even if
it might have associated socket units
|
| services.nebula.networks.<name>.firewall.outbound | Firewall rules for outbound traffic.
|
| security.acme.certs.<name>.extraLegoRenewFlags | Additional flags to pass to lego renew.
|
| systemd.network.networks.<name>.DHCP | Whether to enable DHCP on the interfaces matched.
|
| services.matomo.webServerUser | Name of the web server user that forwards requests to services.phpfpm.pools.<name>.socket the fastcgi socket for Matomo if the nginx
option is not used
|
| systemd.services.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.nipap.settings.auth.auth_cache_timeout | Seconds to store cached auth entries for.
|
| openstack.zfs.datasets.<name>.mount | Where to mount this dataset.
|
| security.auditd.plugins.<name>.args | This allows you to pass arguments to the child program
|
| services.peertube-runner.instancesToRegister.<name>.runnerName | Runner name declared to the PeerTube instance.
|
| services.matrix-tuwunel.settings.global.allow_encryption | Whether new encrypted rooms can be created
|
| services.matrix-conduit.settings.global.allow_encryption | Whether new encrypted rooms can be created
|
| services.kmonad.keyboards.<name>.extraGroups | Extra permission groups to attach to the KMonad instance for
this keyboard
|
| services.nvme-rs.settings.email.smtp_password_file | File containing SMTP password
|
| services.tarsnap.archives.<name>.followSymlinks | Whether to follow all symlinks in archive trees.
|
| networking.fooOverUDP.<name>.local | Local address (and optionally device) to bind to using the given port.
|
| services.omnom.settings.smtp.tls_allow_insecure | Whether to enable Whether to allow insecure TLS..
|
| systemd.user.timers.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.user.slices.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.gitea-actions-runner.instances.<name>.token | Plain token to register at the configured Gitea/Forgejo instance.
|
| services.vdirsyncer.jobs.<name>.forceDiscover | Run yes | vdirsyncer discover prior to vdirsyncer sync
|
| services.jirafeau.nginxConfig.locations.<name>.tryFiles | Adds try_files directive.
|
| services.borgbackup.jobs.<name>.extraCompactArgs | Additional arguments for borg compact
|
| services.gitlab-runner.services.<name>.protected | When set to true Runner will only run on pipelines
triggered on protected branches
|
| services.cjdns.UDPInterface.connectTo.<name>.password | Authorized password to the opposite end of the tunnel.
|
| services.cjdns.ETHInterface.connectTo.<name>.password | Authorized password to the opposite end of the tunnel.
|
| virtualisation.xen.store.settings.quota.maxRequests | Maximum number of requests per transaction.
|
| services.bacula-sd.autochanger.<name>.devices | |
| services.autorandr.profiles.<name>.fingerprint | Output name to EDID mapping
|
| services.wordpress.sites.<name>.virtualHost.forceSSL | Whether to add a separate nginx server block that permanently redirects (301)
all plain HTTP traffic to HTTPS
|
| users.ldap.base | The distinguished name of the search base.
|
| boot.loader.grub.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the account
|
| services.netbird.tunnels.<name>.dns-resolver.address | An explicit address that NetBird will serve *.netbird.cloud. (usually) entries on
|
| services.netbird.clients.<name>.dns-resolver.address | An explicit address that NetBird will serve *.netbird.cloud. (usually) entries on
|
| services.wordpress.sites.<name>.virtualHost.extraConfig | These lines go to httpd.conf verbatim
|
| systemd.network.links.<name>.linkConfig | Each attribute in this set specifies an option in the
[Link] section of the unit
|
| services.firewalld.zones.<name>.interfaces | Interfaces to bind.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.kanidm.provision.systems.oauth2.<name>.originUrl | The redirect URL of the service
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saeAddToMacAllow | If set, all sae password entries that have a non-wildcard MAC associated to
them will additionally be used to populate the MAC allow list
|
| services.zabbixWeb.hostname | Hostname for either nginx or httpd.
|
| services.i2pd.outTunnels.<name>.destinationPort | Connect to particular port at destination.
|
| security.wrappers.<name>.source | The absolute path to the program to be wrapped.
|
| services.xray.enable | Whether to run xray server
|
| services.tor.relay.onionServices.<name>.authorizeClient | See torrc manual.
|
| networking.fooOverUDP.<name>.local.address | Local address to bind to
|
| programs.neovim.runtime.<name>.source | Path of the source file.
|
| services.fedimintd.<name>.nginx.config.reuseport | Create an individual listening socket
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.aaa_id | Server side EAP-Identity to expect in the EAP method
|
| services.anuko-time-tracker.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.headscale.settings.database.sqlite.write_ahead_log | Enable WAL mode for SQLite
|
| security.acme.certs.<name>.webroot | Where the webroot of the HTTP vhost is located.
.well-known/acme-challenge/ directory
will be created below the webroot if it doesn't exist.
http://example.org/.well-known/acme-challenge/ must also
be available (notice unencrypted HTTP).
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.allAccess | Grants all permissions in the associated organization.
|
| services.system76-scheduler.settings.processScheduler.pipewireBoost.profile.matchers | Process matchers.
|
| systemd.timers.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.slices.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.grafana.settings.security.cookie_samesite | Sets the SameSite cookie attribute and prevents the browser from sending this cookie along with cross-site requests
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.reqid | Fixed reqid to use for this CHILD_SA
|
| services.openssh.settings.KbdInteractiveAuthentication | Specifies whether keyboard-interactive authentication is allowed.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.tokenFile | The token value
|
| services.snapper.configs.<name>.TIMELINE_CLEANUP | Defines whether the timeline cleanup algorithm should be run for the config.
|
| virtualisation.xen.store.settings.xenstored.log.file | Path to the Xen Store log file.
|
| security.pam.services.<name>.allowNullPassword | Whether to allow logging into accounts that have no password
set (i.e., have an empty password field in
/etc/passwd or
/etc/group)
|
| services.moodle.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.strongswan-swanctl.swanctl.pools.<name>.dns | Address or CIDR subnets
StrongSwan default: []
|
| services.nagios.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.kanidm.provision.systems.oauth2.<name>.claimMaps | Adds additional claims (and values) based on which kanidm groups an authenticating party belongs to
|
| services.tahoe.introducers.<name>.tub.location | The external location that the introducer should listen on
|
| services.bookstack.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.bookstack.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| boot.initrd.systemd.contents.<name>.target | Path of the symlink.
|
| services.postfix.masterConfig.<name>.privileged | |
| services.nebula.networks.<name>.lighthouse.dns.enable | Whether this lighthouse node should serve DNS.
|
| services.matrix-continuwuity.settings.global.database_path | Path to the continuwuity database, the directory where continuwuity will save its data
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.tags | Tags to add to ntfy.sh messages
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.labels | A set of columns that will be used as Prometheus labels.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries.<name>.values | A set of columns that will be used as values of this metric.
|
| services.firewalld.zones.<name>.masquerade | Whether to enable masquerading in the zone.
|
| services.autosuspend.checks.<name>.enabled | Whether to enable this activity check.
|
| services.keepalived.vrrpScripts.<name>.timeout | Seconds after which script is considered to have failed.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.pubkeys | List of raw public key candidates to use for
authentication
|
| services.gitlab-runner.services.<name>.dockerAllowedImages | Whitelist allowed images.
|
| networking.ipips.<name>.remote | The address of the remote endpoint to forward traffic over.
|
| services.bitcoind.<name>.extraCmdlineOptions | Extra command line options to pass to bitcoind
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.pgbackrest.repos.<name>.sftp-private-key-file | SFTP private key file
|
| services.gancio.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fluidd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.akkoma.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.matomo.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.monica.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.wyoming.faster-whisper.servers.<name>.model | Name of the voice model to use
|
| containers.<name>.bindMounts.<name>.mountPoint | Mount point on the container file system.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_YEARLY | Limits for timeline cleanup.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_WEEKLY | Limits for timeline cleanup.
|
| services.mosquitto.bridges.<name>.addresses | Remote endpoints for the bridge.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_HOURLY | Limits for timeline cleanup.
|
| services.tarsnap.archives.<name>.cachedir | The cache allows tarsnap to identify previously stored data
blocks, reducing archival time and bandwidth usage
|
| systemd.user.tmpfiles.users.<name>.rules | Per-user rules for creation, deletion and cleaning of volatile and
temporary files automatically
|
| services.consul-template.instances.<name>.enable | Whether to enable this consul-template instance.
|
| boot.initrd.luks.devices.<name>.yubikey.twoFactor | Whether to use a passphrase and a YubiKey (true), or only a YubiKey (false).
|
| boot.initrd.luks.devices.<name>.yubikey.keyLength | Length of the LUKS slot key derived with PBKDF2 in byte.
|
| boot.initrd.systemd.contents.<name>.source | Path of the source file.
|
| services.fcgiwrap.instances.<name>.socket.address | Socket address
|
| services.kanidm.provision.systems.oauth2.<name>.present | Whether to ensure that this oauth2 resource server is present or absent.
|
| services.firezone.server.provision.accounts.<name>.gatewayGroups | All gateway groups (sites) to provision
|
| hardware.alsa.controls.<name>.maxVolume | The maximum volume in dB.
|
| services.httpd.virtualHosts.<name>.listenAddresses | Listen addresses for this virtual host
|
| services.blockbook-frontend.<name>.configFile | Location of the blockbook configuration file.
|
| services.borgbackup.jobs.<name>.failOnWarnings | Fail the whole backup job if any borg command returns a warning
(exit code 1), for example because a file changed during backup.
|
| documentation.man.mandoc.settings.manpath | Override the default search path for man(1),
apropos(1), and makewhatis(8)
|
| systemd.user.paths.<name>.requisite | Similar to requires
|
| services.firezone.server.provision.accounts.<name>.resources | All resources to provision
|
| services.borgbackup.repos.<name>.allowSubRepos | Allow clients to create repositories in subdirectories of the
specified path
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.ipcomp | Enable IPComp compression before encryption
|
| services.v4l2-relayd.instances.<name>.input.framerate | The framerate to read from input-stream.
|
| security.acme.certs.<name>.extraDomainNames | A list of extra domain names, which are included in the one certificate to be issued.
|
| boot.initrd.clevis.devices.<name>.secretFile | Clevis JWE file used to decrypt the device at boot, in concert with the chosen pin (one of TPM2, Tang server, or SSS).
|
| services.v4l2-relayd.instances.<name>.extraPackages | Extra packages to add to GST_PLUGIN_PATH for the instance.
|
| services.gitlab-runner.services.<name>.debugTraceDisabled | When set to true Runner will disable the possibility of
using the CI_DEBUG_TRACE feature.
|
| services.radicle.httpd.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.neo4j.ssl.policies.<name>.baseDirectory | The mandatory base directory for cryptographic objects of this
policy
|
| services.maubot.settings.plugin_directories | Plugin directory paths
|
| virtualisation.xen.store.settings.xenstored.log.level | Logging level for the Xen Store.
|
| security.auditd.plugins.<name>.active | Whether to enable Whether to enable this plugin.
|
| services.bookstack.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| security.wrappers.<name>.setuid | Whether to add the setuid bit the wrapper program.
|
| security.wrappers.<name>.setgid | Whether to add the setgid bit the wrapper program.
|
| services.blockbook-frontend.<name>.package | The blockbook package to use.
|
| services.monica.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.tags.*.tag | The tag to add
|
| services.ax25.axports.<name>.description | Free format description of this interface.
|
| services.xserver.cmt.models | Which models to enable cmt for
|
| services.snapserver.streams.<name>.sampleFormat | Default sample format.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.present | Whether to ensure that this user is present or absent.
|
| services.grafana.provision.datasources.settings.datasources.*.editable | Allow users to edit datasources from the UI.
|
| services.invoiceplane.sites.<name>.enable | Whether to enable InvoicePlane web application.
|
| services.armagetronad.servers.<name>.dns | DNS address to use for this server
|
| services.strongswan-swanctl.swanctl.pools.<name>.nbns | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.dhcp | Address or CIDR subnets
StrongSwan default: []
|
| services.jirafeau.nginxConfig.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.dolibarr.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.kanboard.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.librenms.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.agorakit.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.fediwall.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.mainsail.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.pixelfed.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.maubot.settings.plugin_directories.load | The directories from which plugins should be loaded
|
| environment.etc.<name>.mode | If set to something else than symlink,
the file is copied instead of symlinked, with the given
file mode.
|
| systemd.paths.<name>.requisite | Similar to requires
|
| services.outline.smtp.username | Username to authenticate with.
|
| services.gerrit.plugins | List of plugins to add to Gerrit
|
| systemd.network.networks.<name>.dns | A list of dns servers to be added to the network section of the
unit
|
| systemd.network.networks.<name>.vrf | A list of vrf interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.ntp | A list of ntp servers to be added to the network section of the
unit
|
| services.wordpress.sites.<name>.virtualHost.useACMEHost | A host of an existing Let's Encrypt certificate to use
|
| boot.initrd.luks.devices.<name>.keyFileOffset | The offset of the key file
|
| services.firewalld.zones.<name>.sourcePorts.*.protocol | |
| services.woodpecker-agents.agents.<name>.package | The woodpecker-agent package to use.
|
| services.kmonad.keyboards.<name>.defcfg.allowCommands | Whether to enable keys to run shell commands.
|
| services.nebula.networks.<name>.lighthouse.dns.host | IP address on which nebula lighthouse should serve DNS.
'localhost' is a good default to ensure the service does not listen on public interfaces;
use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.
|
| services.prometheus.exporters.fritz.settings.devices.*.password_file | Path to a file which contains the password to authenticate with the target device
|
| services.gitea-actions-runner.instances.<name>.enable | Whether to enable Gitea Actions Runner instance.
|
| networking.jool.siit | Definitions of SIIT instances of Jool
|
| services.public-inbox.settings.publicinboxwatch.watchspam | If set, mail in this maildir will be trained as spam and
deleted from all watched inboxes
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.enable | Boost foreground process priorities.
(And de-boost background ones)
|
| security.pam.services.<name>.setEnvironment | Whether the service should set the environment variables
listed in environment.sessionVariables
using pam_env.so.
|
| boot.initrd.systemd.contents.<name>.enable | Whether to enable copying of this file and symlinking it.
|
| systemd.user.timers.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.slices.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.matomo.hostname | URL of the host, without https prefix
|
| services.anuko-time-tracker.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.wyoming.faster-whisper.servers.<name>.language | The language used to to parse words and sentences.
|
| services.fluidd.nginx.serverName | Name of this virtual host
|
| services.akkoma.nginx.serverName | Name of this virtual host
|
| services.gancio.nginx.serverName | Name of this virtual host
|
| services.matomo.nginx.serverName | Name of this virtual host
|
| services.monica.nginx.serverName | Name of this virtual host
|
| services.radicle.ci.adapters.native.instances.<name>.enable | Whether to enable this radicle-native-ci instance.
|
| documentation.man.mandoc.settings.output.indent | Number of blank characters at the left margin for normal text,
default of 5 for mdoc(7) and 7 for
man(7)
|
| services.sanoid.datasets.<name>.processChildrenOnly | Whether to only snapshot child datasets if recursing.
|
| services.spiped.config.<name>.disableKeepalives | Disable transport layer keep-alives.
|
| security.dhparams.params.<name>.bits | The bit size for the prime that is used during a Diffie-Hellman
key exchange.
|
| documentation.man.mandoc.settings.output.includes | A string of relative path used as a template for the output path of
linked header files (usually via the In macro) in HTML output
|
| services.drupal.sites.<name>.virtualHost.listenAddresses | Listen addresses for this virtual host
|
| services.firewalld.zones.<name>.ingressPriority | Priority for inbound traffic
|
| systemd.services.<name>.notSocketActivated | If set, a changed unit is never assumed to be
socket-activated on configuration switch, even if
it might have associated socket units
|
| systemd.services.<name>.confinement.binSh | The program to make available as /bin/sh inside
the chroot
|
| services.nginx.virtualHosts.<name>.listenAddresses | Listen addresses for this virtual host
|
| services.wstunnel.clients.<name>.upgradePathPrefix | Use a specific HTTP path prefix that will show up in the upgrade
request to the wstunnel server
|
| services.mpd.settings.playlist_directory | The directory where MPD stores playlists
|
| systemd.user.targets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.user.sockets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.swapspace.settings.buffer_elasticity | Percentage of buffer space considered to be "free"
|
| services.armagetronad.servers.<name>.host | Host to listen on
|
| services.armagetronad.servers.<name>.port | Port to listen on
|
| services.keepalived.vrrpInstances.<name>.useVmac | Use VRRP Virtual MAC.
|
| services.firezone.server.settingsSecret.COOKIE_ENCRYPTION_SALT | A file containing a unique base64 encoded secret for the
COOKIE_ENCRYPTION_SALT
|
| services.parsedmarc.provision.localMail.hostname | The hostname to use when configuring Postfix
|
| systemd.user.timers.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.user.slices.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.public-inbox.settings.publicinboxwatch.spamcheck | If set to spamc, public-inbox-watch(1) will filter spam
using SpamAssassin.
|
| services.keepalived.vrrpScripts.<name>.extraConfig | Extra lines to be added verbatim to the vrrp_script section.
|
| security.acme.certs.<name>.directory | Directory where certificate and other state is stored.
|
| services.matrix-tuwunel.settings.global.unix_socket_path | Listen on a UNIX socket at the specified path
|
| services.invoiceplane.sites.<name>.stateDir | This directory is used for uploads of attachments and cache
|
| services.postfix.settings.main.message_size_limit | Maximum size of an email message in bytes.
https://www.postfix.org/postconf.5.html#message_size_limit
|
| networking.bridges.<name>.rstp | Whether the bridge interface should enable rstp.
|
| networking.greTunnels.<name>.dev | The underlying network device on which the tunnel resides.
|
| boot.initrd.luks.devices.<name>.yubikey.saltLength | Length of the new salt in byte (64 is the effective maximum).
|
| services.gitlab-runner.services.<name>.maximumTimeout | What is the maximum timeout (in seconds) that will be set for
job when using this Runner. 0 (default) simply means don't limit
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.fcgiwrap.instances.<name>.process.prefork | Number of processes to prefork.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.readBuckets | The organization's buckets which should be allowed to be read
|
| fileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| services.kanidm.provision.systems.oauth2.<name>.imageFile | Application image to display in the WebUI
|
| services.hostapd.radios.<name>.countryCode | Country code (ISO/IEC 3166-1)
|
| services.jirafeau.nginxConfig.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.jirafeau.nginxConfig.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.searx.faviconsSettings | Favicons settings for SearXNG.
|
| security.auditd.plugins.<name>.type | This tells the dispatcher how the plugin wants to be run
|
| systemd.timers.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.slices.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| containers.<name>.flake | The Flake URI of the NixOS configuration to use for the container
|
| services.nezha-agent.settings.disable_send_query | Disable sending TCP/ICMP/HTTP requests.
|
| systemd.slices.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.timers.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| hardware.display.outputs.<name>.edid | An EDID filename to be used for configured display, as in edid/<filename>
|
| systemd.user.targets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.user.sockets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.grafana.settings.security.x_xss_protection | Set to true to enable the X-XSS-Protection header,
which tells browsers to stop pages from loading when they detect reflected cross-site scripting (XSS) attacks.
Note: this is the default in Grafana, it's turned off here
since it's recommended to not use this header anymore.
|
| services.orangefs.server.fileSystems.<name>.extraStorageHints | Extra config for <StorageHints> section.
|
| services.fedimintd.<name>.nginx.config.globalRedirect | If set, all requests for this host are redirected (defaults to 301,
configurable with redirectCode) to the given hostname.
|
| services.woodpecker-agents.agents.<name>.extraGroups | Additional groups for the systemd service.
|
| services.maubot.settings.plugin_directories.upload | The directory where uploaded new plugins should be stored.
|
| programs.ssh.knownHosts.<name>.publicKey | The public key data for the host
|
| services.buildkite-agents.<name>.privateSshKeyPath | OpenSSH private key
A run-time path to the key file, which is supposed to be provisioned
outside of Nix store.
|
| services.maubot.settings.plugin_directories.trash | The directory where old plugin versions and conflicting plugins should be moved
|
| services.hadoop.hdfs.namenode.extraEnv | Extra environment variables for HDFS NameNode
|
| security.acme.certs.<name>.dnsProvider | DNS Challenge provider
|
| services.snapserver.settings.tcp-streaming.bind_to_address | Address to listen on for snapclient connections.
|
| virtualisation.xen.store.settings.ringScanInterval | Perodic scanning for all the rings as a safenet for lazy clients
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.operator | Grants all permissions in all organizations.
|
| services.minio.configDir | The config directory, for the access keys and other settings.
|
| services.fedimintd.<name>.nginx.config.redirectCode | HTTP status used by globalRedirect and forceSSL
|
| environment.etc.<name>.source | Path of the source file.
|
| services.matrix-tuwunel.settings.global.unix_socket_perms | The default permissions (in octal) to create the UNIX socket with.
|
| services.woodpecker-agents.agents.<name>.enable | Whether to enable this Woodpecker-Agent
|
| services.bookstack.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".socket_dir | Path to the postgres socket directory
|
| services.invoiceplane.sites.<name>.cron.enable | Enable cron service which periodically runs Invoiceplane tasks
|
| virtualisation.containerd.settings | Verbatim lines to add to containerd.toml
|
| services.mpdscribble.endpoints.<name>.url | The url endpoint where the scrobble API is listening.
|
| boot.initrd.luks.devices.<name>.postOpenCommands | Commands that should be run right after we have mounted our LUKS device.
|
| services.jibri.xmppEnvironments.<name>.call.login.domain | The domain part of the JID for the recorder.
|
| systemd.sockets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| systemd.targets.<name>.enable | If set to false, this unit will be a symlink to
/dev/null
|
| services.etebase-server.settings.allowed_hosts.allowed_host1 | The main host that is allowed access.
|
| services.system76-scheduler.settings.cfsProfiles.responsive.wakeup-granularity | sched_wakeup_granularity_ns.
|
| systemd.network.networks.<name>.bond | A list of bond interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.vlan | A list of vlan interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.xfrm | A list of xfrm interfaces to be added to the network section of the
unit
|
| systemd.user.sockets.<name>.socketConfig | Each attribute in this set specifies an option in the
[Socket] section of the unit
|
| systemd.services.<name>.confinement.enable | If set, all the required runtime store paths for this service are
bind-mounted into a tmpfs-based
chroot(2).
|
| services.nitter.server.hostname | Hostname of the instance.
|
| services.btrbk.instances.<name>.snapshotOnly | Whether to run in snapshot only mode
|
| boot.initrd.luks.devices.<name>.yubikey.gracePeriod | Time in seconds to wait for the YubiKey.
|
| services.mautrix-meta.instances.<name>.serviceUnit | The systemd unit (a service or a target) for other services to depend on if they
need to be started after matrix-synapse
|
| services.beesd.filesystems.<name>.spec | Description of how to identify the filesystem to be duplicated by this
instance of bees
|
| systemd.sockets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| systemd.targets.<name>.requires | Start the specified units when this unit is started, and stop
this unit when the specified units are stopped or fail.
|
| services.borgbackup.jobs.<name>.patterns | Include/exclude paths matching the given patterns
|
| services.kanboard.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.agorakit.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.dolibarr.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.librenms.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.fediwall.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.pixelfed.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.mainsail.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.jirafeau.nginxConfig.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.consul-template.instances.<name>.package | The consul-template package to use.
|
| services.autosuspend.wakeups.<name>.enabled | Whether to enable this wake-up check.
|
| services.nginx.virtualHosts.<name>.sslCertificate | Path to server SSL certificate.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_df | Whether to copy the DF bit to the outer IPv4 header in tunnel mode
|
| boot.initrd.luks.devices.<name>.yubikey.storage.fsType | The filesystem of the unencrypted device.
|
| services.networkd-dispatcher.rules.<name>.script | Shell commands executed on specified operational states.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.writeBuckets | The organization's buckets which should be allowed to be written
|
| virtualisation.xen.store.settings.persistent | Whether to activate the filed base backend.
|
| services.authelia.instances.<name>.secrets | It is recommended you keep your secrets separate from the configuration
|
| services.mailpit.instances.<name>.database | Specify the local database filename to store persistent data
|
| documentation.man.mandoc.settings.output.fragment | Whether to omit the declaration and the , , and
elements and only emit the subtree below the element in HTML
output of mandoc(1)
|
| services.mediagoblin.settings.mediagoblin.email_debug_mode | Disable email debug mode to start sending outgoing mails
|
| networking.bonds.<name>.mode | DEPRECATED, use driverOptions
|
| networking.jool.nat64 | Definitions of NAT64 instances of Jool
|
| services.dendrite.settings.mscs.database.connection_string | Database for exerimental MSC's.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.auth | Authentication to perform locally.
- The default
pubkey uses public key authentication
using a private key associated to a usable certificate.
psk uses pre-shared key authentication.
- The IKEv1 specific
xauth is used for XAuth or Hybrid
authentication,
- while the IKEv2 specific
eap keyword defines EAP
authentication.
- For
xauth, a specific backend name may be appended,
separated by a dash
|
| services.h2o.hosts.<name>.tls.identity.*.certificate-file | Path to certificate file
|
| virtualisation.docker.daemon.settings.live-restore | Allow dockerd to be restarted without affecting running container
|
| services.syncoid.commands.<name>.localTargetAllow | Permissions granted for the services.syncoid.user user
for local target datasets
|
| programs.ssh.knownHosts.<name>.extraHostNames | A list of additional host names and/or IP numbers used for
accessing the host's ssh service
|
| systemd.user.services.<name>.enableStrictShellChecks | Enable running shellcheck on the generated scripts for this unit
|
| networking.greTunnels.<name>.ttl | The time-to-live/hoplimit of the connection to the remote tunnel endpoint.
|
| services.keepalived.vrrpScripts.<name>.interval | Seconds between script invocations.
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_MONTHLY | Limits for timeline cleanup.
|
| hardware.sane.brscan5.netDevices.<name>.ip | The ip address of the device
|
| hardware.sane.brscan4.netDevices.<name>.ip | The ip address of the device
|
| boot.loader.grub.users.<name>.hashedPassword | Specifies the password hash for the account,
generated with grub-mkpasswd-pbkdf2
|
| services.github-runners.<name>.tokenFile | The full path to a file which contains either
- a fine-grained personal access token (PAT),
- a classic PAT
- or a runner registration token
Changing this option or the tokenFile’s content triggers a new runner registration
|
| services.libeufin.bank.settings.libeufin-bank.SUGGESTED_WITHDRAWAL_EXCHANGE | Exchange that is suggested to wallets when withdrawing
|
| services.nextcloud.settings.mail_from_address | FROM address that overrides the built-in sharing-noreply and lostpassword-noreply FROM addresses
|
| services.warpgate.settings.ssh.inactivity_timeout | How long can user be inactive until Warpgate terminates the connection.
|
| services.firewalld.zones.<name>.sources.*.address | An IP address or a network IP address with a mask for IPv4 or IPv6
|
| fileSystems.<name>.overlay.workdir | The path to the workdir
|
| services.authelia.instances.<name>.secrets.jwtSecretFile | Path to your JWT secret used during identity verificaton.
|
| services.wordpress.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| boot.loader.systemd-boot.windows.<name>.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.wordpress.sites.<name>.virtualHost.robotsEntries | Specification of pages to be ignored by web crawlers
|
| services.wordpress.sites.<name>.virtualHost.serverAliases | Additional names of virtual hosts served by this virtual host configuration.
|
| programs.neovim.runtime.<name>.enable | Whether this runtime directory should be generated
|
| services.matrix-synapse.workers.<name>.worker_app | Type of this worker
|
| systemd.nspawn.<name>.networkConfig | Each attribute in this set specifies an option in the
[Network] section of this unit
|
| systemd.sockets.<name>.socketConfig | Each attribute in this set specifies an option in the
[Socket] section of the unit
|
| services.k3s.nodeName | Node name.
|
| services.sftpgo.settings.httpd.bindings.*.enable_web_client | Enable the built-in web client for this interface binding.
|
| systemd.user.sockets.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.user.targets.<name>.startLimitBurst | Configure unit start rate limiting
|
| services.roundcube.database.username | Username for the postgresql connection
|
| services.cloudflared.tunnels.<name>.default | Catch-all service if no ingress matches
|
| services.cloudflared.tunnels.<name>.ingress | Ingress rules
|
| services.mosquitto.bridges.<name>.addresses.*.port | Port of the remote MQTT broker.
|
| services.fedimintd.<name>.api_iroh.openFirewall | Opens UDP port in firewall for fedimintd's API Iroh endpoint
|
| services.wordpress.sites.<name>.database.tablePrefix | The $table_prefix is the value placed in the front of your database tables
|
| services.beesd.filesystems.<name>.extraOptions | Extra command-line options passed to the daemon
|
| systemd.network.netdevs.<name>.enable | Whether to manage network configuration using systemd-network
|
| services.simplesamlphp.<name>.libDir | Path to the SimpleSAMLphp library directory.
|
| services.wordpress.sites.<name>.database.createLocally | Create the database and database user locally.
|
| virtualisation.docker.rootless.daemon.settings | Configuration for docker daemon
|
| services.tarsnap.archives.<name>.verylowmem | Reduce memory consumption by a factor of 2 beyond what
lowmem does, at the cost of significantly
slowing down the archiving process.
|
| services.anuko-time-tracker.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.gitea-actions-runner.instances.<name>.tokenFile | Path to an environment file, containing the TOKEN environment
variable, that holds a token to register at the configured
Gitea/Forgejo instance.
|
| services.livekit.ingress.settings.rtc_config.use_external_ip | When set to true, attempts to discover the host's public IP via STUN
|
| services.radicle.ci.adapters.native.instances.<name>.package | The radicle-native-ci package to use.
|
| services.hadoop.hdfs.namenode.enable | Whether to enable HDFS NameNode.
|
| services.rke2.autoDeployCharts.<name>.createNamespace | Whether to create the target namespace if not present.
|
| services.rke2.autoDeployCharts.<name>.targetNamespace | The namespace in which the Helm chart gets installed.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.id | If this attribute is given with non-zero length, it will set the password identifier
for this entry
|
| services.radicle.httpd.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.nextcloud.settings.skeletondirectory | The directory where the skeleton files are located
|
| services.warpgate.settings.ssh.keepalive_interval | If nothing is received from the client for this amount of time, server will send a keepalive message.
|
| services.netbird.tunnels.<name>.environment | Environment for the netbird service, used to pass configuration options.
|
| services.netbird.clients.<name>.environment | Environment for the netbird service, used to pass configuration options.
|
| services.influxdb2.provision.organizations.<name>.buckets.<name>.present | Whether to ensure that this bucket is present or absent.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPasswordFile | Sets the password for WPA-PSK
|
| services.plausible.database.postgres.dbname | Name of the database to use.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children | CHILD_SA configuration sub-section
|
| services.wordpress.sites.<name>.virtualHost.locations | Declarative location config
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| systemd.user.slices.<name>.requisite | Similar to requires
|
| systemd.user.timers.<name>.requisite | Similar to requires
|
| services.borgbackup.jobs.<name>.encryption.mode | Encryption mode to use
|
| services.nagios.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.moodle.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.firewalld.zones.<name>.forwardPorts.*.protocol | |
| services.grafana.provision.datasources.settings.datasources.*.secureJsonData | Datasource specific secure configuration
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.username | If empty string mailaddress value is used
|
| services.public-inbox.inboxes.<name>.description | User-visible description for the repository.
|
| networking.supplicant.<name>.bridge | Name of the bridge interface that wpa_supplicant should listen at.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.policies | Whether to install IPsec policies or not
|
| services.nvme-rs.settings.check_interval_secs | Check interval in seconds
|
| services.xserver.xkb.extraLayouts.<name>.description | A short description of the layout.
|
| services.firewalld.zones.<name>.icmpBlockInversion | Whether to invert the icmp block handling
|
| services.tor.relay.onionServices.<name>.authorizeClient.authType | Either "basic" for a general-purpose authorization protocol
or "stealth" for a less scalable protocol
that also hides service activity from unauthorized clients.
|
| services.blockbook-frontend.<name>.rpc.password | RPC password for JSON-RPC connections
|
| services.networkd-dispatcher.rules.<name>.onState | List of names of the systemd-networkd operational states which
should trigger the script
|
| services.honk.host | The host name or IP address the server should listen to.
|
| systemd.sockets.<name>.startLimitBurst | Configure unit start rate limiting
|
| systemd.targets.<name>.startLimitBurst | Configure unit start rate limiting
|
| virtualisation.xen.store.settings.xenstored.accessLog.file | Path to the Xen Store access log file.
|
| services.jitsi-videobridge.xmppConfigs.<name>.userName | User part of the JID.
|
| services.nginx.virtualHosts.<name>.sslCertificateKey | Path to server SSL certificate key.
|
| boot.initrd.luks.devices.<name>.yubikey.storage.path | Absolute path of the salt on the unencrypted device with
that device's root directory as "/".
|
| services.mailman.ldap.attrMap.username | LDAP-attribute that corresponds to the username-attribute in mailman.
|
| services.anubis.instances.<name>.policy.useDefaultBotRules | Whether to include Anubis's default bot detection rules via the
(data)/meta/default-config.yaml import
|
| security.agnos.settings.accounts.*.certificates.*.domains | Domains the certificate represents
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_ecn | Whether to copy the ECN (Explicit Congestion Notification) header field
to/from the outer IP header in tunnel mode
|
| services.restic.backups.<name>.environmentFile | file containing the credentials to access the repository, in the
format of an EnvironmentFile as described by systemd.exec(5)
|
| services.wordpress.sites.<name>.virtualHost.documentRoot | The path of Apache's document root directory
|
| services.mediawiki.httpd.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.mediawiki.httpd.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.ghostunnel.servers.<name>.unsafeTarget | If set, does not limit target to localhost, 127.0.0.1, [::1], or UNIX sockets
|
| security.acme.certs.<name>.renewInterval | Systemd calendar expression when to check for renewal
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.nice | Niceness.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.nice | Niceness.
|
| services.postfix.hostname | Hostname to use
|
| services.firewalld.zones.<name>.description | Description for the zone.
|
| services.firewalld.services.<name>.sourcePorts.*.protocol | |
| services.listmonk.database.settings."privacy.domain_blocklist" | E-mail addresses with these domains are disallowed from subscribing.
|
| security.auditd.settings.space_left | If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by
space_left_action
|
| boot.specialFileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| systemd.slices.<name>.requisite | Similar to requires
|
| systemd.timers.<name>.requisite | Similar to requires
|
| services.namecoind.enable | Whether to enable namecoind, Namecoin client.
|
| services.autorandr.profiles.<name>.hooks.preswitch | Preswitch hook executed before mode switch.
|
| services.fedimintd.<name>.nginx.config.listen.*.proxyProtocol | Enable PROXY protocol.
|
| services.strongswan-swanctl.swanctl.pools.<name>.server | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.subnet | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.p_cscf | Address or CIDR subnets
StrongSwan default: []
|
| services.jirafeau.nginxConfig.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.jitsi-videobridge.xmppConfigs.<name>.mucJids | JID of the MUC to join
|
| services.bookstack.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| systemd.user.services.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.tailscale.serve.services.<name>.advertised | Whether the service should accept new connections
|
| containers.<name>.extraVeths.<name>.hostBridge | Put the host-side of the veth-pair into the named bridge
|
| services.grafana.settings.database.conn_max_lifetime | Sets the maximum amount of time a connection may be reused
|
| services.tailscale.serve.services.<name>.endpoints | Map of incoming traffic patterns to local targets
|
| systemd.user.sockets.<name>.listenStreams | For each item in this list, a ListenStream
option in the [Socket] section will be created.
|
| services.jibri.xmppEnvironments.<name>.xmppDomain | The base XMPP domain.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.prio | CPU scheduler priority.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.prio | CPU scheduler priority.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.description | Optional description for the API token
|
| services.invoiceplane.sites.<name>.database.user | Database user.
|
| services.nextcloud.settings.mail_sendmailmode | For smtp, the sendmail binary is started with the parameter -bs: Use the SMTP protocol on standard input and output
|
| services.movim.secretFile | The secret file to be sourced for the .env settings.
|
| services.grafana.settings.users.auto_assign_org_id | Set this value to automatically add new users to the provided org
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.priority | Optional fixed priority for IPsec policies
|
| services.netbird.tunnels.<name>.openInternalFirewall | Opens up internal firewall ports for the NetBird's network interface.
|
| services.netbird.clients.<name>.openInternalFirewall | Opens up internal firewall ports for the NetBird's network interface.
|
| services.frigate.hostname | Hostname of the nginx vhost to configure
|
| security.acme.certs.<name>.dnsResolver | Set the resolver to use for performing recursive DNS queries
|
| systemd.network.links.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| services.strongswan-swanctl.swanctl.secrets.ppk.<name>.id | PPK identity the PPK belongs to
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.topic | Note: when using ntfy.sh and other public instances
it is recommended to set this option to an empty string and set the actual topic via
services.prometheus.alertmanager-ntfy.extraConfigFiles since
the topic in ntfy.sh is essentially a password
|
| services.invoiceplane.sites.<name>.poolConfig | Options for the InvoicePlane PHP pool
|
| services.hostapd.radios.<name>.dynamicConfigScripts | All of these scripts will be executed in lexicographical order before hostapd
is started, right after the global segment was generated and may dynamically
append global options the generated configuration file
|
| services.dovecot2.mailPlugins.perProtocol.<name>.enable | mail plugins to enable as a list of strings to append to the corresponding per-protocol $mail_plugins configuration variable
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.ioPrio | IO scheduler priority.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.ioPrio | IO scheduler priority.
|
| services.livekit.ingress.settings.rtc_config.port_range_start | Start of UDP port range for WebRTC
|
| services.firezone.server.provision.accounts.<name>.resources.<name>.addressDescription | An optional description for resource address, usually a full link to the resource including a schema.
|
| services.dovecot2.mailboxes.<name>.specialUse | Null if no special use flag is set
|
| systemd.network.netdevs.<name>.extraConfig | Extra configuration append to unit
|
| services.invoiceplane.sites.<name>.database.host | Database host address.
|
| services.invoiceplane.sites.<name>.database.port | Database host port.
|
| services.strongswan-swanctl.swanctl.secrets.eap.<name>.id | Identity the EAP/XAuth secret belongs to
|
| services.borgbackup.jobs.<name>.removableDevice | Whether the repo (which must be local) is a removable device.
|
| services.influxdb2.provision.users.<name>.present | Whether to ensure that this user is present or absent.
|
| services.davis.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.autorandr.profiles.<name>.hooks.predetect | Predetect hook executed before autorandr attempts to run xrandr.
|
| services.slskd.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.movim.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| nix.checkAllErrors | If enabled, checks the nix.conf parsing for any kind of error
|
| systemd.network.networks.<name>.vxlan | A list of vxlan interfaces to be added to the network section of the
unit
|
| systemd.network.netdevs.<name>.tapConfig | Each attribute in this set specifies an option in the
[Tap] section of the unit
|
| systemd.network.netdevs.<name>.tunConfig | Each attribute in this set specifies an option in the
[Tun] section of the unit
|
| services.stash.settings.gallery_cover_regex | Regex used to identify images as gallery covers
|
| services.stash.settings.preview_exclude_end | Duration of start of video to exclude when generating previews
|
| services.blockbook-frontend.<name>.rpc.passwordFile | File containing password of the RPC user
|
| services.namecoind.rpc.allowFrom | List of IP address ranges allowed to use the RPC API
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.remote_ts | List of remote selectors to include in CHILD_SA
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rand_time | Time range from which to choose a random value to subtract from
rekey_time
|
| boot.initrd.luks.devices.<name>.preOpenCommands | Commands that should be run right before we try to mount our LUKS device
|
| services.armagetronad.servers.<name>.enable | Whether to enable armagetronad.
|
| services.authelia.instances.<name>.secrets.manual | Configuring authelia's secret files via the secrets attribute set
is intended to be convenient and help catch cases where values are required
to run at all
|
| services.nextcloud-spreed-signaling.backends.<name>.secretFile | The path to the file containing the value for backends.<name>.secret
|
| services.strongswan-swanctl.swanctl.secrets.ike.<name>.id | IKE identity the IKE preshared secret belongs to
|
| services.hostapd.radios.<name>.wifi6.multiUserBeamformer | HE multi user beamformee support
|
| services.beesd.filesystems.<name>.verbosity | Log verbosity (syslog keyword/level).
|
| services.tarsnap.archives.<name>.explicitSymlinks | Whether to follow symlinks specified as archives.
|
| services.kanidm.provision.systems.oauth2.<name>.basicSecretFile | The basic secret to use for this service
|
| services.anuko-time-tracker.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| systemd.sockets.<name>.listenStreams | For each item in this list, a ListenStream
option in the [Socket] section will be created.
|
| services.znapzend.zetup.<name>.timestampFormat | The timestamp format to use for constructing snapshot names
|
| services.blockbook-frontend.<name>.internal | Internal http server binding [address]:port.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.mac | If this attribute is not included, or if is set to the wildcard address (ff:ff:ff:ff:ff:ff),
the entry is available for any station (client) to use
|
| services.gitlab-runner.services.<name>.dockerPrivileged | Give extended privileges to container.
|
| systemd.user.sockets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.user.targets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| services.ghostunnel.servers.<name>.keystore | Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.class | CPU scheduler class.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.class | CPU scheduler class.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.zabbixWeb.httpd.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.borgbackup.jobs.<name>.createCommand | Borg command to use for archive creation
|
| services.snipe-it.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.hostapd.radios.<name>.wifi7.multiUserBeamformer | EHT multi user beamformee support
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.pk | If this attribute is given, SAE-PK will be enabled for this connection
|
| containers.<name>.extraVeths.<name>.hostAddress | The IPv4 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| services.bacula-sd.director.<name>.password | Specifies the password that must be supplied for the default Bacula
Console to be authorized
|
| services.bacula-fd.director.<name>.password | Specifies the password that must be supplied for the default Bacula
Console to be authorized
|
| services.gitlab-runner.services.<name>.dockerAllowedServices | Whitelist allowed services.
|
| systemd.user.sockets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.user.targets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.ioClass | IO scheduler class.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.ioClass | IO scheduler class.
|
| hardware.sane.brscan4.netDevices.<name>.model | The model of the network device.
|
| hardware.sane.brscan5.netDevices.<name>.model | The model of the network device.
|
| services.strongswan-swanctl.swanctl.secrets.ntlm.<name>.id | Identity the NTLM secret belongs to
|
| services.namecoind.wallet | Wallet file
|
| services.nextcloud.settings.overwriteprotocol | Force Nextcloud to always use HTTP or HTTPS i.e. for link generation
|
| networking.macvlans.<name>.mode | The mode of the macvlan device.
|
| services.agorakit.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.librenms.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.kanboard.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.dolibarr.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.fediwall.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.mainsail.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.pixelfed.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.priority | The ntfy.sh message priority (see https://docs.ntfy.sh/publish/#message-priority for more information)
|
| services.headscale.settings.oidc.strip_email_domain | Whether the domain part of the email address should be removed when generating namespaces.
|
| boot.specialFileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| services.firewalld.services.<name>.destination.ipv4 | IPv4 destination.
|
| services.firewalld.services.<name>.destination.ipv6 | IPv6 destination.
|
| services.znapzend.zetup.<name>.destinations | Additional destinations.
|
| services.wordpress.sites.<name>.virtualHost.globalRedirect | If set, all requests for this host are redirected permanently to
the given URL.
|
| services.tarsnap.archives.<name>.directories | List of filesystem paths to archive.
|
| systemd.services.<name>.enableStrictShellChecks | Enable running shellcheck on the generated scripts for this unit
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mode | IPsec Mode to establish CHILD_SA with.
tunnel negotiates the CHILD_SA in IPsec Tunnel Mode,
- whereas
transport uses IPsec Transport Mode.
transport_proxy signifying the special Mobile IPv6
Transport Proxy Mode.
beet is the Bound End to End Tunnel mixture mode,
working with fixed inner addresses without the need to include them in
each packet.
- Both
transport and beet modes are
subject to mode negotiation; tunnel mode is
negotiated if the preferred mode is not available.
pass and drop are used to install
shunt policies which explicitly bypass the defined traffic from IPsec
processing or drop it, respectively
|
| services.fedimintd.<name>.environment | Extra Environment variables to pass to the fedimintd.
|
| power.ups.upsmon.monitor.<name>.passwordFile | The full path to a file containing the password from
upsd.users for accessing this UPS
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.vlanid | If this attribute is given, all clients using this entry will get tagged with the given VLAN ID.
|
| services.public-inbox.inboxes.<name>.watchheader | If specified, public-inbox-watch(1) will only process
mail containing a matching header.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.root | Root directory for requests.
|
| services.jibri.xmppEnvironments.<name>.control.muc.domain | The domain part of the MUC to connect to for control.
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.slot | Optional slot number to access the token.
|
| containers.<name>.extraVeths.<name>.hostAddress6 | The IPv6 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| boot.initrd.luks.devices.<name>.gpgCard.encryptedPass | Path to the GPG encrypted passphrase.
|
| security.agnos.settings.dns_listen_addr | Address for agnos to listen on
|
| services.mollysocket.settings.allowed_endpoints | List of UnifiedPush servers
|
| services.kanidm.provision.persons.<name>.mailAddresses | Mail addresses
|
| services.crab-hole.settings.blocklist.include_subdomains | Whether to enable Include subdomains.
|
| services.bookstack.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| virtualisation.emptyDiskImages.*.driveConfig.name | A name for the drive
|
| services.klipper.firmwares.<name>.klipperFlashPackage | Path to the built klipper-flash package.
|
| services.stash.settings.sequential_scanning | Modifies behaviour of the scanning functionality to generate support files (previews/sprites/phash) at the same time as fingerprinting/screenshotting
|
| systemd.sockets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| systemd.targets.<name>.requiredBy | Units that require (i.e. depend on and need to go down with) this unit
|
| virtualisation.containers.storage.settings | storage.conf configuration
|
| security.dhparams.params.<name>.path | The resulting path of the generated Diffie-Hellman parameters
file for other services to reference
|
| services.headscale.settings.oidc.client_secret_path | Path to OpenID Connect client secret file
|
| ec2.zfs.datasets.<name>.properties | Properties to set on this dataset.
|
| services.keepalived.vrrpInstances.<name>.vmacXmitBase | Send/Recv VRRP messages from base interface instead of VMAC interface.
|
| systemd.targets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| systemd.sockets.<name>.conflicts | If the specified units are started, then this unit is stopped
and vice versa.
|
| environment.etc.<name>.enable | Whether this /etc file should be generated
|
| networking.greTunnels.<name>.type | Whether the tunnel routes layer 2 (tap) or layer 3 (tun) traffic.
|
| services.mediawiki.httpd.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.hostaccess | Hostaccess variable to pass to updown script
|
| services.keepalived.vrrpInstances.<name>.state | Initial state
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.templates.title | The ntfy.sh message title template.
|
| services.authelia.instances.<name>.secrets.oidcHmacSecretFile | Path to your HMAC secret used to sign OIDC JWTs.
|
| services.jirafeau.nginxConfig.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.stargazer.certOrg | The name of the organization responsible for the X.509
certificate's /O name.
|
| systemd.network.netdevs.<name>.wlanConfig | Each attribute in this set specifies an option in the [WLAN] section of the unit
|
| systemd.network.netdevs.<name>.l2tpConfig | Each attribute in this set specifies an option in the
[L2TP] section of the unit
|
| systemd.network.netdevs.<name>.xfrmConfig | Each attribute in this set specifies an option in the
[Xfrm] section of the unit
|
| systemd.network.netdevs.<name>.vlanConfig | Each attribute in this set specifies an option in the
[VLAN] section of the unit
|
| systemd.network.netdevs.<name>.bondConfig | Each attribute in this set specifies an option in the
[Bond] section of the unit
|
| systemd.network.netdevs.<name>.peerConfig | Each attribute in this set specifies an option in the
[Peer] section of the unit
|
| services.nextcloud-spreed-signaling.settings.clients.internalsecretFile | The path to the file containing the value for clients.internalsecret
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_time | Maximum lifetime before CHILD_SA gets closed
|
| services.namecoind.rpc.address | IP address the RPC server will bind to.
|
| services.icecream.daemon.netName | Network name to connect to
|
| services.zitadel.extraSettingsPaths | A list of paths to extra settings files
|
| services.kmonad.keyboards.<name>.enableHardening | Whether to enable systemd hardening.
If KMonad is used to execute shell commands, hardening may make some of them fail.
|
| services.gitea-actions-runner.instances.<name>.labels | Labels used to map jobs to their runtime environment
|
| services.nebula.networks.<name>.lighthouses | List of IPs of lighthouse hosts this node should report to and query from
|
| services.matrix-synapse.settings.turn_shared_secret | The shared secret used to compute passwords for the TURN server
|
| services.hadoop.hdfs.namenode.extraFlags | Extra command line flags to pass to HDFS NameNode
|
| services.jitsi-videobridge.xmppConfigs.<name>.domain | Domain part of JID of the XMPP user, if it is different from hostName.
|
| security.pam.services | This option defines the PAM services
|
| services.matrix-conduit.settings.global.allow_registration | Whether new users can register on this server.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.module | Optional PKCS#11 module name.
|
| hardware.display.outputs.<name>.mode | A video kernel parameter (framebuffer mode) configuration for the specific output:
<xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m][eDd]
See for more information:
|
| security.acme.certs.<name>.reloadServices | The list of systemd services to call systemctl try-reload-or-restart
on.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.if_id_in | XFRM interface ID set on inbound policies/SA
|
| services.strongswan-swanctl.swanctl.pools.<name>.netmask | Address or CIDR subnets
StrongSwan default: []
|
| fileSystems.<name>.fsType | Type of the file system
|
| services.gancio.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.fluidd.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.akkoma.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.monica.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.matomo.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| virtualisation.xen.store.settings.quota.transaction | Maximum number of transactions.
|
| services.fedimintd.<name>.nginx.config.listenAddresses | Listen addresses for this virtual host
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert_policy | List of certificate policy OIDs the peer's certificate
must have
|
| services.doh-server.settings.ecs_use_precise_ip | If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask
|
| services.nginx.virtualHosts.<name>.listen.*.extraParameters | Extra parameters of this listen directive.
|
| services.blockbook-frontend.<name>.templateDir | Location of the HTML templates
|
| services.strongswan-swanctl.swanctl.secrets.rsa.<name>.secret | Value of decryption passphrase for RSA key.
|
| services.librenms.hostname | The hostname to serve LibreNMS on.
|
| systemd.network.networks.<name>.routes | A list of route sections to be added to the unit
|
| services.dawarich.sidekiqProcesses.<name>.threads | Number of threads this process should use for executing jobs
|
| services.mastodon.sidekiqProcesses.<name>.threads | Number of threads this process should use for executing jobs
|
| services.znc.user | The name of an existing user account to use to own the ZNC server
process
|
| services.nextcloud.notify_push.dbname | Database name.
|
| networking.greTunnels.<name>.local | The address of the local endpoint which the remote
side should send packets to.
|
| image.repart.partitions.<name>.storePaths | The store paths to include in the partition.
|
| fileSystems.<name>.encrypted.enable | The block device is backed by an encrypted one, adds this device as a initrd luks entry.
|
| networking.wlanInterfaces.<name>.device | The name of the underlying hardware WLAN device as assigned by udev.
|
| services.peertube-runner.instancesToRegister.<name>.url | URL of the PeerTube instance.
|
| services.github-runners.<name>.serviceOverrides | Modify the systemd service
|
| services.mobilizon.settings.":mobilizon".":instance".email_reply_to | The email for the Reply-To: header in emails
|
| services.firewalld.services.<name>.destination | Destinations for the service.
|
| services.firewalld.services.<name>.description | Description for the service.
|
| services.hostapd.radios.<name>.wifi6.singleUserBeamformee | HE single user beamformee support
|
| services.hostapd.radios.<name>.wifi6.singleUserBeamformer | HE single user beamformer support
|
| services.strongswan-swanctl.swanctl.secrets.xauth.<name>.id | Identity the EAP/XAuth secret belongs to
|
| services.warpgate.settings.http.sni_certificates.*.certificate | Path to certificate.
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.pin | Optional PIN required to access the key on the token
|
| networking.jool.nat64.<name>.global.pool6 | The prefix used for embedding IPv4 into IPv6 addresses
|
| services.neo4j.ssl.policies.<name>.allowKeyGeneration | Allows the generation of a private key and associated self-signed
certificate
|
| services.limesurvey.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.limesurvey.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rand_bytes | Byte range from which to choose a random value to subtract from
rekey_bytes
|
| services.grafana.settings.analytics.reporting_enabled | When enabled Grafana will send anonymous usage statistics to stats.grafana.org
|
| services.namecoind.extraNodes | List of additional peer IP addresses to connect to.
|
| services.borgmatic.settings.source_directories | List of source directories and files to backup
|
| services.fedimintd.<name>.consensus.finalityDelay | Consensus peg-in finality delay.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.index | Adds index directive.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.alias | Alias directory for requests.
|
| systemd.services.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.dependency-track.settings."alpine.oidc.team.synchronization" | This option will ensure that team memberships for OpenID Connect users are dynamic and
synchronized with membership of OpenID Connect groups or assigned roles
|
| services.hostapd.radios.<name>.wifi7.singleUserBeamformer | EHT single user beamformer support
|
| services.hostapd.radios.<name>.wifi7.singleUserBeamformee | EHT single user beamformee support
|
| systemd.user.targets.<name>.requisite | Similar to requires
|
| systemd.user.paths.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.requisite | Similar to requires
|
| services.buffyboard.configFile | Path to an INI format configuration file to provide Buffyboard
|
| services.blockbook-frontend.<name>.extraConfig | Additional configurations to be appended to coin.conf
|
| systemd.shutdownRamfs.contents.<name>.text | Text of the file.
|
| services.dendrite.settings.sync_api.database.connection_string | Database for the Sync API.
|
| services.cloud-init.config | raw cloud-init configuration
|
| services.keepalived.vrrpInstances.<name>.virtualIps | Declarative vhost config
|
| services.kanidm.provision.systems.oauth2.<name>.originLanding | When redirecting from the Kanidm Apps Listing page, some linked applications may need to land on a specific page to trigger oauth2/oidc interactions.
|
| services.dolibarr.h2o.serverName | Server name to be used for this virtual host
|
| services.buildkite-agents.<name>.runtimePackages | Add programs to the buildkite-agent environment
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.tags.*.condition | The condition under which this tag should be added
|
| services.gitea.appName | Application name.
|
| services.postfix.settings.main.recipient_delimiter | Set of characters used as the delimiters for address extensions
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.adapter_config.clientSecretFile | A file containing a the client secret for an openid_connect adapter
|
| systemd.services.<name>.confinement.fullUnit | Whether to include the full closure of the systemd unit file into the
chroot, instead of just the dependencies for the executables.
While it may be tempting to just enable this option to
make things work quickly, please be aware that this might add paths
to the closure of the chroot that you didn't anticipate
|
| services.limesurvey.httpd.virtualHost.locations.<name>.index | Adds DirectoryIndex directive
|
| services.limesurvey.httpd.virtualHost.locations.<name>.alias | Alias directory for requests
|
| services.acme-dns.settings.api.disable_registration | Whether to disable the HTTP registration endpoint.
|
| systemd.network.networks.<name>.enable | Whether to manage network configuration using systemd-network
|
| systemd.network.networks.<name>.tunnel | A list of tunnel interfaces to be added to the network section of the
unit
|
| systemd.network.networks.<name>.bridge | A list of bridge interfaces to be added to the network section of the
unit
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.local_ts | List of local traffic selectors to include in CHILD_SA
|
| systemd.user.services.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.fedimintd.<name>.nginx.config.sslCertificate | Path to server SSL certificate.
|
| services.influxdb2.provision.organizations.<name>.buckets.<name>.retention | The duration in seconds for which the bucket will retain data (0 is infinite).
|
| programs.tsmClient.servers.<name>.tcpport | TCP port of the IBM TSM server
|
| services.znc.confOptions.networks.<name>.hasBitlbeeControlChannel | Whether to add the special Bitlbee operations channel.
|
| services.jirafeau.nginxConfig.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.anuko-time-tracker.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| boot.initrd.luks.devices.<name>.fido2.passwordLess | Defines whatever to use an empty string as a default salt
|
| services.autorandr.profiles.<name>.hooks.postswitch | Postswitch hook executed after mode switch.
|
| systemd.user.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.network.networks.<name>.domains | A list of domains to pass to the network config.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.tryFiles | Adds try_files directive.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.sha256_96 | HMAC-SHA-256 is used with 128-bit truncation with IPsec
|
| services.jibri.xmppEnvironments.<name>.control.login.domain | The domain part of the JID for this Jibri instance.
|
| services.gatus.configFile | Path to the Gatus configuration file
|
| services.tt-rss.auth.autoLogin | Automatically login user on remote or other kind of externally supplied
authentication, otherwise redirect to login form as normal
|
| systemd.paths.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.targets.<name>.requisite | Similar to requires
|
| systemd.sockets.<name>.requisite | Similar to requires
|
| services.jibri.xmppEnvironments.<name>.xmppServerHosts | Hostnames of the XMPP servers to connect to.
|
| services.sanoid.datasets.<name>.use_template | Names of the templates to use for this dataset.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords | Sets allowed passwords for WPA3-SAE
|
| services.simplesamlphp.<name>.configDir | Path to the SimpleSAMLphp config directory.
|
| services.h2o.hosts | The hosts config to be merged with the settings
|
| services.nsd.zones | Define your zones here
|
| services.keepalived.vrrpInstances.<name>.extraConfig | Extra lines to be added verbatim to the vrrp_instance section.
|
| systemd.network.networks.<name>.bridgeFDBs | A list of BridgeFDB sections to be added to the unit
|
| systemd.network.networks.<name>.bridgeMDBs | A list of BridgeMDB sections to be added to the unit
|
| virtualisation.xen.store.settings.quota.maxOutstanding | Maximum outstanding requests, i.e. in-flight requests / domain.
|
| services.mosquitto.listeners.*.users.<name>.password | Specifies the (clear text) password for the MQTT User.
|
| services.coder.database.username | Username for accessing the database.
|
| services.dawarich.sidekiqProcesses.<name>.jobClasses | If not empty, which job classes should be executed by this process.
If left empty, all job classes will be executed by this process.
|
| services.quorum.genesis | Blockchain genesis settings.
|
| services.datadog-agent.hostname | The hostname to show in the Datadog dashboard (optional)
|
| systemd.network.netdevs.<name>.vxlanConfig | Each attribute in this set specifies an option in the
[VXLAN] section of the unit
|
| services.ghostunnel.servers.<name>.extraArguments | Extra arguments to pass to ghostunnel server
|
| services.vdirsyncer.jobs.<name>.additionalGroups | additional groups to add the dynamic user to
|
| services.matrix-continuwuity.settings.global.trusted_servers | Servers listed here will be used to gather public keys of other servers
(notary trusted key servers)
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.root | Root directory for requests.
|
| boot.loader.grub.users.<name>.hashedPasswordFile | Specifies the path to a file containing the password hash
for the account, generated with grub-mkpasswd-pbkdf2
|
| services.matrix-continuwuity.settings.global.allow_federation | Whether this server federates with other servers.
|
| security.apparmor.policies.<name>.path | A path of a profile file to include
|
| services.lldap.settings.ldap_user_pass_file | Path to a file containing the default admin password
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.inactivity | Timeout before closing CHILD_SA after inactivity
|
| services.pgbouncer.settings.pgbouncer.default_pool_size | How many server connections to allow per user/database pair
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.background.matchers | Process matchers.
|
| services.system76-scheduler.settings.processScheduler.foregroundBoost.foreground.matchers | Process matchers.
|
| networking.interfaces.<name>.useDHCP | Whether this interface should be configured with DHCP
|
| services.postfixadmin.database.dbname | Name of the postgresql database
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPassword | Sets the password for WPA-PSK that will be converted to the pre-shared key
|
| services.grafana.settings.analytics.check_for_updates | When set to false, disables checking for new versions of Grafana from Grafana's GitHub repository
|
| services.kanidm.provision.systems.oauth2.<name>.enableLegacyCrypto | Enable legacy crypto on this client
|
| services.bookstack.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_bytes | Maximum bytes processed before CHILD_SA gets closed
|
| systemd.network.netdevs.<name>.vrfConfig | Each attribute in this set specifies an option in the
[VRF] section of the unit
|
| boot.initrd.luks.devices.<name>.allowDiscards | Whether to allow TRIM requests to the underlying device
|
| security.acme.certs.<name>.inheritDefaults | Whether to inherit values set in security.acme.defaults or not.
|
| services.borgbackup.jobs.<name>.compression | Compression method to use
|
| services.github-runners.<name>.extraEnvironment | Extra environment variables to set for the runner, as an attrset.
|
| services.wstunnel.servers.<name>.tlsCertificate | TLS certificate to use instead of the hardcoded one in case of HTTPS connections
|
| services.beesd.filesystems.<name>.hashTableSizeMB | Hash table size in MB; must be a multiple of 16
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.revocation | Certificate revocation policy for CRL or OCSP revocation.
- A
strict revocation policy fails if no revocation information is
available, i.e. the certificate is not known to be unrevoked.
ifuri fails only if a CRL/OCSP URI is available, but certificate
revocation checking fails, i.e. there should be revocation information
available, but it could not be obtained.
- The default revocation policy
relaxed fails only if a certificate is
revoked, i.e. it is explicitly known that it is bad
|
| security.auditd.plugins.<name>.format | Binary passes the data exactly as the audit event dispatcher gets it from
the audit daemon
|
| services.wyoming.faster-whisper.servers.<name>.initialPrompt | Optional text to provide as a prompt for the first window
|
| networking.greTunnels.<name>.remote | The address of the remote endpoint to forward traffic over.
|
| services.fedimintd.<name>.nginx.config.sslCertificateKey | Path to server SSL certificate key.
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.brd | The broadcast address on the interface.
|
| systemd.network.networks.<name>.bridgeVLANs | A list of BridgeVLAN sections to be added to the unit
|
| services.mediawiki.httpd.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.strongswan-swanctl.swanctl.secrets.ecdsa.<name>.secret | Value of decryption passphrase for ECDSA key.
|
| networking.bonds.<name>.miimon | DEPRECATED, use driverOptions
|
| users.users.<name>.ignoreShellProgramCheck | By default, nixos will check that programs
|
| services.radicle.httpd.nginx.serverName | Name of this virtual host
|
| services.cloudflared.tunnels.<name>.originRequest.caPool | Path to the certificate authority (CA) for the certificate of your origin
|
| services.tor.relay.onionServices.<name>.authorizedClients | Authorized clients for a v3 onion service,
as a list of public key, in the format:
descriptor:x25519:<base32-public-key>
See torrc manual.
|
| services.snapserver.streams.<name>.location | For type pipe or file, the path to the pipe or file
|
| systemd.network.networks.<name>.extraConfig | Extra configuration append to unit
|
| systemd.user.paths.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.borgbackup.jobs.<name>.environment | Environment variables passed to the backup script
|
| services.borgbackup.jobs.<name>.persistentTimer | Set the Persistent option for the
systemd.timer(5)
which triggers the backup immediately if the last trigger
was missed (e.g. if the system was powered down).
|
| services.dendrite.settings.media_api.database.connection_string | Database for the Media API.
|
| services.dendrite.settings.relay_api.database.connection_string | Database for the Relay Server.
|
| services.matrix-continuwuity.settings.global.max_request_size | Max request size in bytes
|
| systemd.network.netdevs.<name>.fooOverUDPConfig | Each attribute in this set specifies an option in the
[FooOverUDP] section of the unit
|
| systemd.network.networks.<name>.canConfig | Each attribute in this set specifies an option in the
[CAN] section of the unit
|
| systemd.network.networks.<name>.pieConfig | Each attribute in this set specifies an option in the
[PIE] section of the unit
|
| services.limesurvey.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.jibri.xmppEnvironments.<name>.call.login.passwordFile | File containing the password for the user.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs8.<name>.secret | Value of decryption passphrase for PKCS#8 key.
|
| services.matrix-synapse.settings.dynamic_thumbnails | Whether to generate new thumbnails on the fly to precisely match
the resolution requested by the client
|
| services.mosquitto.bridges.<name>.addresses.*.address | Address of the remote MQTT broker.
|
| services.icingaweb2.modules.monitoring.backends.<name>.resource | Name of the IDO resource
|
| services.cross-seed.useGenConfigDefaults | Whether to use the option defaults from the configuration generated by
cross-seed gen-config
|
| systemd.paths.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| security.apparmor.policies.<name>.state | How strictly this policy should be enforced
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in | Netfilter mark and mask for input traffic
|
| services.matrix-tuwunel.settings.global.allow_registration | Whether new users can register on this server
|
| services.neo4j.ssl.policies | Defines the SSL policies for use with Neo4j connectors
|
| services.maubot.settings.plugin_databases.postgres_opts | Overrides for the default database_opts when using a non-default postgres connection URL.
|
| services.klipper.firmwares.<name>.enableKlipperFlash | Whether to enable flashings scripts for firmware
|
| boot.loader.grub.extraFiles | A set of files to be copied to /boot
|
| services.snapper.configs.<name>.TIMELINE_LIMIT_QUARTERLY | Limits for timeline cleanup.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| services.radicle.httpd.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.kmonad.keyboards.<name>.defcfg.fallthrough | Whether to enable re-emitting unhandled key events.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPskFile | Sets the password(s) for WPA-PSK
|
| services.printing.cups-pdf.instances.<name>.installPrinter | Whether to enable a CUPS printer queue for this instance
|
| services.firefox-syncserver.singleNode.hostname | Host name to use for this service.
|
| networking.wg-quick.interfaces.<name>.listenPort | 16-bit port for listening
|
| programs.xfs_quota.projects.<name>.id | Project ID.
|
| services.simplesamlphp.<name>.package | The simplesamlphp package to use.
|
| services.kmscon.useXkbConfig | Whether to configure keymap from xserver keyboard settings.
|
| services.gitea-actions-runner.instances.<name>.hostPackages | List of packages, that are available to actions, when the runner is configured
with a host execution label.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.if_id_out | XFRM interface ID set on outbound policies/SA
|
| services.mautrix-meta.instances.<name>.registerToSynapse | Whether to add registration file to services.matrix-synapse.settings.app_service_config_files and
make Synapse wait for registration service.
|
| services.dnscrypt-proxy2.configFile | Path to TOML config file
|
| services.mastodon.sidekiqProcesses.<name>.jobClasses | If not empty, which job classes should be executed by this process. *Only one process should handle the 'scheduler' class
|
| services.limesurvey.httpd.virtualHost.locations.<name>.proxyPass | Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.
|
| services.tarsnap.archives.<name>.checkpointBytes | Create a checkpoint every checkpointBytes
of uploaded data (optionally specified using an SI prefix).
1GB is the minimum value
|
| virtualisation.xen.store.settings.conflict.burstLimit | Limits applied to domains whose writes cause other domains' transaction
commits to fail
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.index | Adds index directive.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.alias | Alias directory for requests.
|
| services.jibri.xmppEnvironments.<name>.usageTimeout | The duration that the Jibri session can be
|
| services.maddy.ensureCredentials.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the user.
|
| services.headscale.settings.derp.auto_update_enabled | Whether to automatically update DERP maps on a set frequency.
|
| services.matrix-continuwuity.settings.global.allow_encryption | Whether new encrypted rooms can be created
|
| services.namecoind.rpc.password | Password for RPC connections.
|
| services.strongswan-swanctl.swanctl.secrets.eap.<name>.secret | Value of the EAP/XAuth secret
|
| services.strongswan-swanctl.swanctl.secrets.ike.<name>.secret | Value of the IKE preshared secret
|
| services.armagetronad.servers.<name>.package | The armagetronad-dedicated package to use
|
| services.matrix-synapse.settings.enable_registration | Enable registration for new users.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_out | Netfilter mark and mask for output traffic
|
| services.strongswan-swanctl.swanctl.secrets.token.<name>.handle | Hex-encoded CKA_ID or handle of the private key on the token or TPM,
respectively.
|
| systemd.network.networks.<name>.ipoIBConfig | Each attribute in this set specifies an option in the
[IPoIB] section of the unit
|
| services.tt-rss.pool | Name of existing phpfpm pool that is used to run web-application
|
| services.simplesamlphp.<name>.phpfpmPool | The PHP-FPM pool that serves SimpleSAMLphp instance.
|
| services.wordpress.sites.<name>.virtualHost.listenAddresses | Listen addresses for this virtual host
|
| services.patroni.namespace | Path within the configuration store where Patroni will keep information about the cluster.
|
| services.lasuite-docs.collaborationServer.settings.COLLABORATION_SERVER_ORIGIN | Origins allowed to connect to the collaboration server
|
| services.matrix-synapse.settings.trusted_key_servers | The trusted servers to download signing keys from.
|
| services.lasuite-docs.collaborationServer.settings.COLLABORATION_BACKEND_BASE_URL | URL to the backend server base
|
| services.pcscd.extendReaderNames | String to append to every reader name
|
| services.borgbackup.jobs.<name>.encryption.passCommand | A command which prints the passphrase to stdout
|
| services.authelia.instances.<name>.secrets.sessionSecretFile | Path to your session secret
|
| systemd.user.slices.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.timers.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.bcg.device | Device name to configure gateway to use.
|
| systemd.paths.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.factorio.username | Your factorio.com login credentials
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.dpd_action | Action to perform for this CHILD_SA on DPD timeout
|
| services.limesurvey.nginx.virtualHost.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.icingaweb2.modules.monitoring.transports.<name>.username | Username for the api or remote transport
|
| services.agorakit.nginx.serverName | Name of this virtual host
|
| services.dolibarr.nginx.serverName | Name of this virtual host
|
| services.librenms.nginx.serverName | Name of this virtual host
|
| services.kanboard.nginx.serverName | Name of this virtual host
|
| services.fediwall.nginx.serverName | Name of this virtual host
|
| services.pixelfed.nginx.serverName | Name of this virtual host
|
| services.mainsail.nginx.serverName | Name of this virtual host
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswordsFile | Sets the password for WPA3-SAE
|
| programs.uwsm.waylandCompositors.<name>.prettyName | The full name of the desktop entry file.
|
| systemd.services.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.tryFiles | Adds try_files directive.
|
| services.peertube.settings.video_transcription.enabled | Enable automatic transcription of videos.
|
| systemd.network.networks.<name>.linkConfig | Each attribute in this set specifies an option in the
[Link] section of the unit
|
| systemd.network.networks.<name>.lldpConfig | Each attribute in this set specifies an option in the
[LLDP] section of the unit
|
| systemd.network.networks.<name>.cakeConfig | Each attribute in this set specifies an option in the
[CAKE] section of the unit
|
| services.jirafeau.nginxConfig.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.bepasty.servers.<name>.defaultPermissions | default permissions for all unauthenticated accesses.
|
| services.blockbook-frontend.<name>.extraCmdLineOptions | Extra command line options to pass to Blockbook
|
| programs.ssh.knownHosts.<name>.certAuthority | This public key is an SSH certificate authority, rather than an
individual host's key.
|
| services.keepalived.vrrpInstances.<name>.trackScripts | List of script names to invoke for health tracking.
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.addr | IP address, optionally with a netmask: IPADDR[/MASK]
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.copy_dscp | Whether to copy the DSCP (Differentiated Services Field Codepoint)
header field to/from the outer IP header in tunnel mode
|
| services.bacula-sd.autochanger.<name>.changerCommand | The name-string specifies an external program to be called that will
automatically change volumes as required by Bacula
|
| services.strongswan-swanctl.swanctl.secrets.ppk.<name>.secret | Value of the PPK
|
| systemd.network.networks.<name>.address | A list of addresses to be added to the network section of the
unit
|
| systemd.network.networks.<name>.gateway | A list of gateways to be added to the network section of the
unit
|
| services.bcg.automaticRenameNodes | Automatically rename all nodes.
|
| services.jitsi-meet.config | Client-side web application settings that override the defaults in config.js
|
| boot.initrd.luks.devices.<name>.yubikey.storage.device | An unencrypted device that will temporarily be mounted in stage-1
|
| services.grafana.settings.plugins.preinstall_disabled | When set to true, disables the Background Plugin Installer, which runs before Grafana starts
|
| services.chhoto-url.settings.cache_control_header | The Cache-Control header to send.
|
| services.spiped.config.<name>.disableReresolution | Disable target address re-resolution.
|
| services.strongswan-swanctl.swanctl.secrets.pkcs12.<name>.secret | Value of decryption passphrase for PKCS#12 container.
|
| programs.schroot.profiles.<name>.fstab | A file in the format described in fstab(5), used to mount filesystems inside the chroot
|
| services.limesurvey.nginx.virtualHost.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.wstunnel.servers.<name>.websocketPingInterval | Frequency at which the client will send websocket ping to the server.
|
| services.wstunnel.clients.<name>.websocketPingInterval | Frequency at which the client will send websocket ping to the server.
|
| systemd.user.slices.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.timers.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.keepalived.vrrpInstances.<name>.priority | For electing MASTER, highest priority wins
|
| systemd.network.netdevs.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| services.nextcloud-spreed-signaling.backends.<name>.urls | List of URLs of the Nextcloud instance
|
| systemd.user.paths.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.firezone.server.smtp.username | Username to authenticate against the SMTP relay
|
| boot.initrd.luks.devices.<name>.fido2.credential | The FIDO2 credential ID.
|
| services.jibri.xmppEnvironments.<name>.stripFromRoomDomain | The prefix to strip from the room's JID domain to derive the call URL.
|
| services.artalk.user | Artalk user name.
|
| services.sogo.vhostName | Name of the nginx vhost
|
| services.zammad.user | Name of the Zammad user.
|
| systemd.slices.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.timers.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.cloudflared.tunnels.<name>.warp-routing.enabled | Enable warp routing
|
| systemd.network.networks.<name>.macvtap | A list of macvtap interfaces to be added to the network section of the
unit
|
| systemd.network.netdevs.<name>.tunnelConfig | Each attribute in this set specifies an option in the
[Tunnel] section of the unit
|
| systemd.network.netdevs.<name>.bridgeConfig | Each attribute in this set specifies an option in the
[Bridge] section of the unit
|
| systemd.network.netdevs.<name>.netdevConfig | Each attribute in this set specifies an option in the
[Netdev] section of the unit
|
| systemd.network.networks.<name>.macvlan | A list of macvlan interfaces to be added to the network section of the
unit
|
| systemd.network.netdevs.<name>.ipvlanConfig | Each attribute in this set specifies an option in the [IPVLAN] section of the unit
|
| systemd.network.netdevs.<name>.ipvtapConfig | Each attribute in this set specifies an option in the [IPVTAP] section of the unit
|
| services.matrix-synapse.settings.url_preview_enabled | Is the preview URL API enabled? If enabled, you must specify an
explicit url_preview_ip_range_blacklist of IPs that the spider is
denied from accessing.
|
| services.grav.pool | Name of existing phpfpm pool that is used to run web-application
|
| services.hostapd.radios.<name>.networks.<name>.authentication.pairwiseCiphers | Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets)
|
| networking.interfaces.<name>.virtualType | The type of interface to create
|
| services.nginx.virtualHosts.<name>.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.monero.rpc.user | User name for RPC connections.
|
| services.fedimintd.<name>.nginx.config.listen.*.extraParameters | Extra parameters of this listen directive.
|
| services.grafana.settings.users.verify_email_enabled | Require email validation before sign up completes.
|
| services.dendrite.settings.key_server.database.connection_string | Database for the Key Server (for end-to-end encryption).
|
| containers.<name>.extraVeths.<name>.forwardPorts.*.hostPort | Source port of the external interface on host
|
| services.postfix.masterConfig.<name>.wakeupUnusedComponent | If set to false the component will only be woken
up if it is used
|
| services.keepalived.vrrpInstances.<name>.unicastSrcIp | Default IP for binding vrrpd is the primary IP on interface
|
| services.borgbackup.repos.<name>.authorizedKeys | Public SSH keys that are given full write access to this repository
|
| programs.xfs_quota.projects.<name>.path | Project directory.
|
| services.strongswan-swanctl.swanctl.pools.<name>.addrs | Addresses allocated in pool
|
| services.anuko-time-tracker.hostname | The hostname to serve Anuko Time Tracker on.
|
| services.grafana.settings.database.transaction_retries | This setting applies to sqlite3 only and controls the number of times the system retries a transaction when the database is locked.
|
| services.prometheus.exporters.mail.configuration.servers.*.name | Value for label 'configname' which will be added to all metrics.
|
| services.keepalived.vrrpInstances.<name>.virtualIps.*.scope | The scope of the area where this address is valid.
|
| services.fediwall.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.dolibarr.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.agorakit.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.librenms.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.kanboard.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.pixelfed.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.mainsail.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.grafana.settings.server.serve_from_sub_path | Serve Grafana from subpath specified in the root_url setting
|
| services.slurm.partitionName | Name by which the partition may be referenced
|
| services.influxdb2.provision.organizations.<name>.buckets.<name>.description | Optional description for the bucket.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.return | Adds a return directive, for e.g. redirections.
|
| fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.hw_offload | Enable hardware offload for this CHILD_SA, if supported by the IPsec
implementation
|
| services.gitea.dump.file | Filename to be used for the dump
|
| services.rke2.nodeName | Node name.
|
| systemd.user.slices.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.user.timers.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.github-runners.<name>.ephemeral | If enabled, causes the following behavior:
- Passes the
--ephemeral flag to the runner configuration script
- De-registers and stops the runner with GitHub after it has processed one job
- On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
- Restarts the service after its successful exit
- On start, wipes the state directory and configures a new runner
You should only enable this option if tokenFile points to a file which contains a
personal access token (PAT)
|
| services.fediwall.nginx | Allows customizing the nginx virtualHost settings
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in_sa | Whether to set mark_in on the inbound SA
|
| services.strongswan-swanctl.swanctl.secrets.xauth.<name>.secret | Value of the EAP/XAuth secret
|
| systemd.network.networks.<name>.dhcpV4Config | Each attribute in this set specifies an option in the
[DHCPv4] section of the unit
|
| systemd.network.networks.<name>.dhcpV6Config | Each attribute in this set specifies an option in the
[DHCPv6] section of the unit
|
| services.influxdb2.provision.users.<name>.passwordFile | Password for the user
|
| services.k3s.autoDeployCharts.<name>.extraFieldDefinitions | Extra HelmChart field definitions that are merged with the rest of the HelmChart
custom resource
|
| services.simplesamlphp.<name>.localDomain | The domain serving your SimpleSAMLphp instance
|
| services.limesurvey.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.prometheus.scrapeConfigs.*.job_name | The job name assigned to scraped metrics by default.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.auth | Authentication to expect from remote
|
| services.cloudflared.tunnels.<name>.originRequest.tcpKeepAlive | The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rand_packets | Packet range from which to choose a random value to subtract from
rekey_packets
|
| services.mediawiki.httpd.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.gitlab-runner.services.<name>.requestConcurrency | Limit number of concurrent requests for new jobs from GitLab.
|
| services.simplesamlphp.<name>.authSources | Auth sources options used by SimpleSAMLphp.
|
| fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| systemd.paths.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.passwordFile | The password for this entry, read from the given file when starting hostapd
|
| systemd.shutdownRamfs.contents.<name>.target | Path of the symlink.
|
| services.tarsnap.archives | Tarsnap archive configurations
|
| systemd.timers.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.slices.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.grafana.settings.users.auto_assign_org_role | The role new users will be assigned for the main organization (if the auto_assign_org setting is set to true).
|
| services.limesurvey.httpd.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.matrix-synapse.settings.macaroon_secret_key | Secret key for authentication tokens
|
| services.discourse.hostname | The hostname to serve Discourse on.
|
| services.bookstack.hostname | The hostname to serve BookStack on.
|
| services.strongswan-swanctl.swanctl.secrets.ntlm.<name>.secret | Value of the NTLM secret, which is the NT Hash of the actual secret,
that is, MD4(UTF-16LE(secret))
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_time | Time to schedule CHILD_SA rekeying
|
| services.taskserver.fqdn | The fully qualified domain name of this server, which is also used
as the common name in the certificates.
|
| services.hostapd.radios.<name>.wifi5.capabilities | VHT (Very High Throughput) capabilities given as a list of flags
|
| image.repart.partitions.<name>.contents | The contents to end up in the filesystem image.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.proxyPass | Adds proxy_pass directive and sets recommended proxy headers if
recommendedProxySettings is enabled.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.uwsgiPass | Adds uwsgi_pass directive and sets recommended proxy headers if
recommendedUwsgiSettings is enabled.
|
| services.radicle.ci.adapters.native.instances.<name>.runtimePackages | Packages added to the adapter's PATH.
|
| services.invidious.extraSettingsFile | A file including Invidious settings
|
| services.matrix-continuwuity.settings.global.unix_socket_perms | The default permissions (in octal) to create the UNIX socket with.
|
| services.agorakit.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.librenms.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.murmur.registerName | Public server registration name, and also the name of the
Root channel
|
| systemd.network.networks.<name>.qdiscConfig | Each attribute in this set specifies an option in the
[QDisc] section of the unit
|
| systemd.network.networks.<name>.pfifoConfig | Each attribute in this set specifies an option in the
[PFIFO] section of the unit
|
| systemd.network.networks.<name>.bfifoConfig | Each attribute in this set specifies an option in the
[BFIFO] section of the unit
|
| services.pgadmin.emailServer.username | SMTP server username for email delivery
|
| systemd.shutdownRamfs.contents.<name>.source | Path of the source file.
|
| services.authelia.instances.<name>.secrets.oidcIssuerPrivateKeyFile | Path to your private key file used to encrypt OIDC JWTs.
|
| services.dependency-track.database.type | h2 database is not recommended for a production setup.
postgresql this settings it recommended for production setups.
manual the module doesn't handle database settings.
|
| services.bcg.automaticRenameKitNodes | Automatically rename kit's nodes.
|
| services.namecoind.generate | Whether to generate (mine) Namecoins.
|
| services.strongswan-swanctl.swanctl.secrets.private.<name>.secret | Value of decryption passphrase for private key.
|
| services.nextcloud.settings.mail_template_class | Replaces the default mail template layout
|
| services.sftpgo.user | User account name under which SFTPGo runs.
|
| services.jitsi-videobridge.xmppConfigs.<name>.passwordFile | File containing the password for the user.
|
| services.keepalived.vrrpInstances.<name>.interface | Interface for inside_network, bound by vrrp.
|
| services.archisteamfarm.bots.<name>.enabled | Whether to enable the bot on startup.
|
| services.kanidm.provision.groups.<name>.overwriteMembers | Whether the member list should be overwritten each time (true) or appended
(false)
|
| services.kanidm.provision.systems.oauth2.<name>.removeOrphanedClaimMaps | Whether claim maps not specified here but present in kanidm should be removed from kanidm.
|
| services.cloudflared.tunnels.<name>.originRequest.noTLSVerify | Disables TLS verification of the certificate presented by your origin
|
| programs.ssh.knownHosts.<name>.publicKeyFile | The path to the public key file for the host
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.basicAuth | Basic Auth protection for a vhost
|
| services.system76-scheduler.assignments.<name>.nice | Niceness.
|
| services.dendrite.settings.room_server.database.connection_string | Database for the Room Server.
|
| services.mysql.galeraCluster.localName | The unique name that identifies this particular node within the cluster
|
| systemd.timers.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.slices.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.jellyfin.forceEncodingConfig | Whether to overwrite Jellyfin's encoding.xml configuration file on each service start
|
| virtualisation.xen.store.settings.conflict.maxHistorySeconds | Limits applied to domains whose writes cause other domains' transaction
commits to fail
|
| services.artalk.allowModify | allow Artalk store the settings to config file persistently
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords.*.password | The password for this entry
|
| boot.initrd.luks.devices.<name>.yubikey.iterationStep | How much the iteration count for PBKDF2 is increased at each successful authentication.
|
| services.discourse.admin.username | The admin user username.
|
| services.blockbook-frontend.<name>.messageQueueBinding | Message Queue Binding address:port.
|
| services.wstunnel.clients.<name>.environmentFile | Environment file to be passed to the systemd service
|
| services.wstunnel.servers.<name>.environmentFile | Environment file to be passed to the systemd service
|
| services.szurubooru.server.settings.delete_source_files | Whether to delete thumbnails and source files on post delete.
|
| services.armagetronad.servers.<name>.openFirewall | Set to true to open the configured UDP port for Armagetron Advanced.
|
| systemd.user.targets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.listenDatagrams | For each item in this list, a ListenDatagram
option in the [Socket] section will be created.
|
| services.zabbixWeb.nginx.virtualHost.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| systemd.shutdownRamfs.contents.<name>.enable | Whether to enable copying of this file and symlinking it.
|
| services.system76-scheduler.assignments.<name>.prio | CPU scheduler priority.
|
| networking.bonds.<name>.driverOptions | Options for the bonding driver
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.tfc_padding | Pads ESP packets with additional data to have a consistent ESP packet
size for improved Traffic Flow Confidentiality
|
| containers.<name>.extraVeths.<name>.forwardPorts | List of forwarded ports from host to container
|
| services.pantalaimon-headless.instances.<name>.ssl | Whether or not SSL verification should be enabled for outgoing
connections to the homeserver.
|
| services.bind.enable | Whether to enable BIND domain name server.
|
| services.bluemap.maps | Settings for files in maps/
|
| services.anuko-time-tracker.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| systemd.user.slices.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.user.timers.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.hostapd.radios.<name>.wifi6.operatingChannelWidth | Determines the operating channel width for HE.
- "20or40": 20 or 40 MHz operating channel width
- "80": 80 MHz channel width
- "160": 160 MHz channel width
- "80+80": 80+80 MHz channel width
|
| services.icecream.daemon.hostname | Hostname of the daemon in the icecream infrastructure
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_packets | Maximum number of packets processed before CHILD_SA gets closed
|
| services.hadoop.hdfs.namenode.formatOnInit | Format HDFS namenode on first start
|
| services.r53-ddns.domain | The name of your domain in Route53
|
| services.hostapd.radios.<name>.wifi4.capabilities | HT (High Throughput) capabilities given as a list of flags
|
| services.mosquitto.listeners.*.users.<name>.passwordFile | Specifies the path to a file containing the
clear text password for the MQTT user
|
| users.mysql.pam.logging.userColumn | The name of the column in the log table to which the name of the
user being authenticated is stored.
|
| users.mysql.pam.logging.hostColumn | The name of the column in the log table to which the name of the user
being authenticated is stored.
|
| systemd.network.netdevs.<name>.l2tpSessions | Each item in this array specifies an option in the
[L2TPSession] section of the unit
|
| systemd.network.networks.<name>.ipv6SendRAConfig | Each attribute in this set specifies an option in the
[IPv6SendRA] section of the unit
|
| services.stash.settings.notifications_enabled | If we should send notifications to the desktop
|
| services.limesurvey.nginx.virtualHost.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| services.wstunnel.clients.<name>.tlsVerifyCertificate | Whether to verify the TLS certificate of the server
|
| services.hostapd.radios.<name>.wifi5.operatingChannelWidth | Determines the operating channel width for VHT.
- "20or40": 20 or 40 MHz operating channel width
- "80": 80 MHz channel width
- "160": 160 MHz channel width
- "80+80": 80+80 MHz channel width
|
| services.hostapd.radios.<name>.wifi7.operatingChannelWidth | Determines the operating channel width for EHT.
- "20or40": 20 or 40 MHz operating channel width
- "80": 80 MHz channel width
- "160": 160 MHz channel width
- "80+80": 80+80 MHz channel width
|
| boot.initrd.luks.devices.<name>.tryEmptyPassphrase | If keyFile fails then try an empty passphrase first before
prompting for password.
|
| services.system76-scheduler.assignments.<name>.ioPrio | IO scheduler priority.
|
| services.hadoop.hdfs.namenode.openFirewall | Open firewall ports for HDFS NameNode.
|
| networking.vlans.<name>.interface | The interface the vlan will transmit packets through.
|
| services.anuko-time-tracker.nginx.serverName | Name of this virtual host
|
| services.scrutiny.settings.web.influxdb.tls.insecure_skip_verify | Whether to enable skipping TLS verification when connecting to InfluxDB.
|
| services.jibri.xmppEnvironments.<name>.control.login.passwordFile | File containing the password for the user.
|
| containers.<name>.extraVeths.<name>.localAddress | The IPv4 address assigned to the interface in the container
|
| users.extraUsers.<name>.ignoreShellProgramCheck | By default, nixos will check that programs
|
| networking.nftables.tables.<name>.enable | Enable this table.
|
| networking.nftables.tables.<name>.family | Table family.
|
| services.buffyboard.settings.quirks.fbdev_force_refresh | If true and using the framebuffer backend, this triggers a display refresh after every draw operation
|
| services.cloudflared.tunnels.<name>.originRequest.proxyPort | cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP
|
| services.tor.torsocks.socks5Username | SOCKS5 username
|
| services.postgresqlWalReceiver.receivers.<name>.connection | Specifies parameters used to connect to the server, as a connection string
|
| systemd.user.targets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.user.sockets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.mpdscribble.endpoints.<name>.passwordFile | File containing the password, either as MD5SUM or cleartext.
|
| services.matrix-continuwuity.settings.global.unix_socket_path | Listen on a UNIX socket at the specified path
|
| services.stash.settings.preview_exclude_start | Duration of end of video to exclude when generating previews
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.extraConfig | These lines go to the end of the location verbatim.
|
| services.cloudflared.tunnels.<name>.originRequest.httpHostHeader | Sets the HTTP Host header on requests sent to the local service.
|
| services.keepalived.vrrpInstances.<name>.noPreempt | VRRP will normally preempt a lower priority machine when a higher
priority machine comes online. "nopreempt" allows the lower priority
machine to maintain the master role, even when a higher priority machine
comes back online
|
| services.synapse-auto-compressor.settings.chunks_to_compress | chunks_to_compress chunks of size chunk_size will be compressed
|
| services.gitlab-runner.services.<name>.registrationFlags | Extra command-line flags passed to
gitlab-runner register
|
| services.postgresqlWalReceiver.receivers.<name>.extraArgs | A list of extra arguments to pass to the pg_receivewal command.
|
| systemd.network.netdevs.<name>.macvlanConfig | Each attribute in this set specifies an option in the
[MACVLAN] section of the unit
|
| services.bookstack.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.cloudflared.tunnels.<name>.originRequest.tlsTimeout | Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
|
| virtualisation.containers.containersConf.settings | containers.conf configuration
|
| services.hqplayerd.auth.username | Username used for HQPlayer's WebUI
|
| containers.<name>.extraVeths.<name>.localAddress6 | The IPv6 address assigned to the interface in the container
|
| services.ytdl-sub.instances.<name>.subscriptions | Subscriptions for ytdl-sub
|
| systemd.sockets.<name>.listenDatagrams | For each item in this list, a ListenDatagram
option in the [Socket] section will be created.
|
| systemd.targets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| systemd.sockets.<name>.restartTriggers | An arbitrary list of items such as derivations
|
| services.prometheus.alertmanager-ntfy.settings.ntfy.notification.templates.description | The ntfy.sh message description template.
|
| services.keepalived.vrrpInstances.<name>.virtualRouterId | Arbitrary unique number 1..255
|
| services.system76-scheduler.assignments.<name>.class | CPU scheduler class.
|
| programs.tsmClient.servers.<name>.inclexcl | Text lines with include.* and exclude.* directives
to be used when sending files to the IBM TSM server,
or an absolute path pointing to a file with such lines.
|
| boot.specialFileSystems.<name>.device | The device as passed to mount
|
| systemd.timers.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.slices.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.network.networks.<name>.matchConfig | Each attribute in this set specifies an option in the
[Match] section of the unit
|
| services.artalk.group | Artalk group name.
|
| services.zammad.group | Name of the Zammad group.
|
| systemd.user.targets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.user.sockets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.services.<name>.confinement.packages | Additional packages or strings with context to add to the closure of
the chroot
|
| services.tuned.ppdSettings | Settings for TuneD's power-profiles-daemon compatibility service.
|
| fileSystems.<name>.label | Label of the device
|
| services.invoiceplane.sites.<name>.database.passwordFile | A file containing the password corresponding to
database.user.
|
| systemd.network.networks.<name>.bridgeConfig | Each attribute in this set specifies an option in the
[Bridge] section of the unit
|
| systemd.network.networks.<name>.pfifoFastConfig | Each attribute in this set specifies an option in the
[PFIFOFast] section of the unit
|
| services.namecoind.trustedNodes | List of the only peer IP addresses to connect to
|
| services.limesurvey.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.gitlab.host | GitLab host name
|
| services.gancio.user | The user (and PostgreSQL database name) used to run the gancio server
|
| services.gitlab.databaseUsername | GitLab database user.
|
| services.limesurvey.nginx.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.limesurvey.httpd.virtualHost.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.system76-scheduler.assignments.<name>.ioClass | IO scheduler class.
|
| services.matrix-synapse.settings.tls_private_key_path | PEM encoded private key for TLS
|
| services.invoiceplane.sites.<name>.database.createLocally | Create the database and database user locally.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_bytes | Number of bytes processed before initiating CHILD_SA rekeying
|
| services.fedimintd.<name>.nginx.config.sslTrustedCertificate | Path to root SSL certificate for stapling and client certificates.
|
| services.gitlab-runner.services.<name>.registrationConfigFile | Absolute path to a file with environment variables
used for gitlab-runner registration with runner registration
tokens
|
| networking.fooOverUDP.<name>.protocol | Protocol number of the encapsulated packets
|
| services.doh-server.configFile | The config file for the doh-server
|
| services.bookstack.nginx.serverName | Name of this virtual host
|
| services.crab-hole.configFile | The config file of crab-hole
|
| services.fcron.allow | Users allowed to use fcrontab and fcrondyn (one name per
line, all for everyone).
|
| services.nullmailer.config.me | The fully-qualifiled host name of the computer running nullmailer
|
| networking.jool.siit.<name>.framework | The framework to use for attaching Jool's translation to the exist
kernel packet processing rules
|
| services.nezha-agent.settings.skip_connection_count | Do not monitor the number of connections.
|
| boot.initrd.luks.devices.<name>.fallbackToPassword | Whether to fallback to interactive passphrase prompt if the keyfile
cannot be found
|
| services.chhoto-url.settings.allow_capital_letters | Whether to allow capital letters in slugs.
|
| services.coturn.realm | The default realm to be used for the users when no explicit
origin/realm relationship was found in the database, or if the TURN
server is not using any database (just the commands-line settings
and the userdb file)
|
| services.deepin.dde-daemon.enable | Whether to enable daemon for handling the deepin session settings.
|
| networking.wireless.networks.<name>.pskRaw | Either the raw pre-shared key in hexadecimal format
or the name of the secret (as defined inside
networking.wireless.secretsFile and prefixed
with ext:) containing the network pre-shared key.
Be aware that this will be written to the Nix store
in plaintext! Always use an external reference.
The external secret can be either the plaintext
passphrase or the raw pre-shared key.
Mutually exclusive with psk and auth.
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.mailaddress | Your email address (at the moment used as login name)
|
| services.grafana.settings.security.csrf_trusted_origins | List of additional allowed URLs to pass by the CSRF check
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.basicAuthFile | Basic Auth password file for a vhost
|
| image.repart.partitions.<name>.repartConfig | Specify the repart options for a partiton as a structural setting
|
| systemd.sockets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| systemd.targets.<name>.reloadTriggers | An arbitrary list of items such as derivations
|
| services.nezha-agent.settings.use_ipv6_country_code | Use ipv6 countrycode to report location.
|
| services.sftpgo.group | Group name under which SFTPGo runs.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.set_mark_in | Netfilter mark applied to packets after the inbound IPsec SA processed
them
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.replay_window | IPsec replay window to configure for this CHILD_SA
|
| services.pantalaimon-headless.instances.<name>.logLevel | Set the log level of the daemon.
|
| console.useXkbConfig | If set, configure the virtual console keymap from the xserver
keyboard settings.
|
| services.zabbixWeb.nginx.virtualHost.serverName | Name of this virtual host
|
| services.pantalaimon-headless.instances.<name>.dataPath | The directory where pantalaimon should store its state such as the database file.
|
| services.netbird.clients.<name>.login.systemdDependencies | Additional systemd dependencies required to succeed before the Setup Key file becomes available.
|
| services.netbird.tunnels.<name>.login.systemdDependencies | Additional systemd dependencies required to succeed before the Setup Key file becomes available.
|
| security.apparmor.policies.<name>.profile | The profile file contents
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.close_action | Action to perform after a CHILD_SA gets closed by the peer.
- The default of
none does not take any action,
trap installs a trap policy for the CHILD_SA.
start tries to re-create the CHILD_SA.
close_action does not provide any guarantee that the
CHILD_SA is kept alive
|
| services.cloudflared.tunnels.<name>.originRequest.proxyType | cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP
|
| services.litellm.settings.environment_variables | Environment variables to pass to the Lite
|
| services.jirafeau.nginxConfig.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.paretosecurity.users.<name>.inviteId | A unique ID that links the agent to Pareto Cloud
|
| services.mosquitto.listeners.*.users.<name>.hashedPassword | Specifies the hashed password for the MQTT User
|
| fileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| services.easytier.instances.<name>.environmentFiles | Environment files for this instance
|
| services.xonotic.settings.sv_termsofservice_url | URL for the Terms of Service for playing on your server.
|
| systemd.network.networks.<name>.flowQueuePIEConfig | Each attribute in this set specifies an option in the
[FlowQueuePIE] section of the unit
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.per_cpu_sas | Enable per-CPU CHILD_SAs
|
| services.postfixadmin.database.username | Username for the postgresql connection
|
| services.firezone.server.provision.accounts.<name>.features.idp_sync | Whether to enable the idp_sync feature for this account.
|
| services.firezone.server.provision.accounts.<name>.features.rest_api | Whether to enable the rest_api feature for this account.
|
| systemd.sockets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| systemd.targets.<name>.startLimitIntervalSec | Configure unit start rate limiting
|
| services.cntlm.domain | Proxy account domain/workgroup name.
|
| services.woodpecker-agents.agents.<name>.environment | woodpecker-agent config environment variables, for other options read the documentation
|
| services.cyrus-imap.user | Cyrus IMAP user name
|
| services.cloudflared.tunnels.<name>.originRequest.originServerName | Hostname that cloudflared should expect from your origin server certificate.
|
| systemd.shutdown | Definition of systemd shutdown executables
|
| programs.openvpn3.netcfg.settings.systemd_resolved | Whether to use systemd-resolved integration
|
| boot.initrd.systemd.contents.<name>.dlopen.features | Features to enable via dlopen ELF notes
|
| systemd.network.networks.<name>.ipv6Prefixes | A list of ipv6Prefix sections to be added to the unit
|
| services.postfix.settings.main.smtpd_tls_chain_files | List of paths to the server private keys and certificates.
The order of items matters and a private key must always be followed by the corresponding certificate.
https://www.postfix.org/postconf.5.html#smtpd_tls_chain_files
|
| systemd.user.targets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.user.sockets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.monica.mail.fromName | Mail "from" name.
|
| services.warpgate.settings.ssh.host_key_verification | Specify host key verification action when connecting to a SSH target with unknown/differing host key.
|
| services.sabnzbd.configFile | Path to config file (deprecated, use settings instead and set this value to null)
|
| services.keepalived.vrrpInstances.<name>.unicastPeers | Do not send VRRP adverts over VRRP multicast group
|
| services.armagetronad.servers.<name>.roundSettings | Armagetron Advanced server per-round configuration
|
| services.syncplay.maxUsernameLength | Maximum number of characters in a username.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.priority | Order of this location block in relation to the others in the vhost
|
| services.cloudflared.tunnels.<name>.originRequest.keepAliveTimeout | Timeout after which an idle keepalive connection can be discarded.
|
| programs.tsmClient.servers.<name>.genPasswd | Whether to enable automatic client password generation
|
| services.anuko-time-tracker.nginx | With this option, you can customize the Nginx virtualHost settings.
|
| networking.nftables.tables.<name>.content | The table content.
|
| networking.wg-quick.interfaces.<name>.dns | The IP addresses of DNS servers to configure.
|
| services.tt-rss.email.fromName | Name for sending outgoing mail
|
| networking.jool.nat64.<name>.framework | The framework to use for attaching Jool's translation to the exist
kernel packet processing rules
|
| services.keycloak.themes | Additional theme packages for Keycloak
|
| services.avahi.hostName | Host name advertised on the LAN
|
| services.nscd.config | Configuration to use for Name Service Cache Daemon
|
| services.murmur.user | The name of an existing user to use to run the service
|
| services.mautrix-meta.instances.<name>.registrationFile | Path to the yaml registration file of the appservice.
|
| services.cloudflared.tunnels.<name>.edgeIPVersion | Specifies the IP address version (IPv4 or IPv6) used to establish a connection between cloudflared and the Cloudflare global network
|
| services.shorewall.configs | This option defines the Shorewall configs
|
| services.limesurvey.nginx.virtualHost.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.matrix-synapse.settings.tls_certificate_path | PEM encoded X509 certificate for TLS
|
| services.peertube.settings.video_transcription.engine_path | Custom engine path for local transcription.
|
| services.doh-server.settings.log_guessed_client_ip | Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
Note: http uri/useragent log cannot be controlled by this config
|
| services.cloudflared.tunnels.<name>.originRequest.proxyAddress | cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP
|
| systemd.network.networks.<name>.dhcpServerConfig | Each attribute in this set specifies an option in the
[DHCPServer] section of the unit
|
| systemd.network.networks.<name>.pfifoHeadDropConfig | Each attribute in this set specifies an option in the
[PFIFOHeadDrop] section of the unit
|
| boot.specialFileSystems.<name>.depends | List of paths that should be mounted before this one
|
| boot.specialFileSystems.<name>.options | Options used to mount the file system
|
| services.ncdns.identity.hostname | The hostname of this ncdns instance, which defaults to the machine
hostname
|
| services.dovecot2.mailboxes.<name>.autoexpunge | To automatically remove all email from the mailbox which is older than the
specified time.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.readPermissions | The read permissions to include for this token
|
| services.zoneminder.hostname | The hostname on which to listen.
|
| services.wyoming.faster-whisper.servers.<name>.useTransformers | Whether to provide the dependencies to allow using transformer models.
|
| security.pam.services.<name>.googleAuthenticator.enable | If set, users with enabled Google Authenticator (created
~/.google_authenticator) will be required
to provide Google Authenticator token to log in.
|
| services.nextcloud-spreed-signaling.settings.backend.connectionsperhost | Maximum number of concurrent backend connections per host
|
| programs.rush.global | The global statement defines global settings.
|
| services.nextcloud.settings.default_phone_region | An ISO 3166-1
country code which replaces automatic phone-number detection
without a country code
|
| networking.interfaces.<name>.mtu | MTU size for packets leaving the interface
|
| networking.wg-quick.interfaces.<name>.preUp | Commands called at the start of the interface setup.
|
| services.matrix-synapse.workers.<name>.worker_log_config | The file for log configuration
|
| services.rke2.autoDeployCharts.<name>.extraFieldDefinitions | Extra HelmChart field definitions that are merged with the rest of the HelmChart
custom resource
|
| services.onlyoffice.hostname | FQDN for the OnlyOffice instance.
|
| networking.bonds.<name>.lacp_rate | DEPRECATED, use driverOptions
|
| services.movim.domain | Fully-qualified domain name (FQDN) for the Movim instance.
|
| services.jirafeau.nginxConfig.serverName | Name of this virtual host
|
| services.newt.blueprint | Blueprint for declarative settings, see Newt Blueprint docs for more information.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.set_mark_out | Netfilter mark applied to packets after the outbound IPsec SA processed
them
|
| security.pam.services.<name>.googleAuthenticator.allowNullOTP | Whether to allow login for accounts that have no OTP set
(i.e., accounts with no OTP configured or no existing
~/.google_authenticator).
|
| services.castopod.database.hostname | Database hostname.
|
| services.longview.apiKey | Longview API key
|
| systemd.network.networks.<name>.networkConfig | Each attribute in this set specifies an option in the
[Network] section of the unit
|
| systemd.network.networks.<name>.ipv6AcceptRAConfig | Each attribute in this set specifies an option in the
[IPv6AcceptRA] section of the unit
|
| services.tayga.tunDevice | Name of the nat64 tun device.
|
| boot.initrd.systemd.contents.<name>.dlopen.usePriority | Priority of dlopen ELF notes to include. "required" is
minimal, "recommended" includes "required", and
"suggested" includes "recommended"
|
| services.taskserver.organisations.<name>.users | A list of user names that belong to the organization.
|
| systemd.sockets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| systemd.targets.<name>.description | Description of this unit used in systemd messages and progress indicators.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.slot | Optional slot number of the token that stores the certificate.
|
| security.auditd.settings.admin_space_left | This is a numeric value in mebibytes (MiB) that tells the audit daemon when to perform a configurable action because the system is running
low on disk space
|
| users.mysql.pam.table | The name of table that maps unique login names to the passwords.
|
| services.rmfakecloud.extraSettings | Extra settings in the form of a set of key-value pairs
|
| services.akkoma.config | Configuration for Akkoma
|
| services.skydns.nameservers | Skydns list of nameservers to forward DNS requests to when not authoritative for a domain.
|
| services.influxdb2.provision.organizations.<name>.auths.<name>.writePermissions | The read permissions to include for this token
|
| networking.bonds.<name>.interfaces | The interfaces to bond together
|
| fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.timekpr.adminUsers | All listed users will become part of the timekpr group so they can manage timekpr settings without requiring sudo.
|
| services.sanoid.datasets.<name>.pruning_script | Script to run after pruning snapshot.
|
| programs.proxychains.proxies.<name>.type | Proxy type.
|
| programs.proxychains.proxies.<name>.port | Proxy port
|
| services.matrix-continuwuity.settings.global.allow_registration | Whether new users can register on this server
|
| services.borgbackup.repos.<name>.authorizedKeysAppendOnly | Public SSH keys that can only be used to append new data (archives) to the repository
|
| services.code-server.host | The host name or IP address the server should listen to.
|
| services.nats.serverName | Name of the NATS server, must be unique if clustered.
|
| systemd.network.networks.<name>.addresses | A list of address sections to be added to the unit
|
| services.pihole-web.hostName | Domain name for the website.
|
| networking.wg-quick.interfaces.<name>.postUp | Commands called after the interface setup.
|
| networking.wlanInterfaces | Creating multiple WLAN interfaces on top of one physical WLAN device (NIC)
|
| services.weblate.smtp.user | SMTP login name.
|
| services.xandikos.nginx.enable | Configure the nginx reverse proxy settings.
|
| services.vikunja.frontendHostname | The Hostname under which the frontend is running.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.start_action | Action to perform after loading the configuration.
- The default of
none loads the connection only, which
then can be manually initiated or used as a responder configuration.
- The value
trap installs a trap policy, which triggers
the tunnel as soon as matching traffic has been detected.
- The value
start initiates the connection actively.
- Since version 5.9.6 two modes above can be combined with
trap|start,
to immediately initiate a connection for which trap policies have been installed
|
| services.gitlab-runner.services.<name>.environmentVariables | Custom environment variables injected to build environment
|
| services.pgbouncer.settings.pgbouncer.max_db_connections | Do not allow more than this many server connections per database (regardless of user)
|
| services.kubernetes.proxy.hostname | Kubernetes proxy hostname override.
|
| boot.binfmt.registrations.<name>.mask | A mask to be ANDed with the byte sequence of the file before matching
|
| networking.wg-quick.interfaces.<name>.type | The type of the interface
|
| services.cloudflared.tunnels.<name>.credentialsFile | Credential file
|
| services.stash.settings.write_image_thumbnails | Write image thumbnails to disk when generating on the fly
|
| services.borgbackup.jobs.<name>.encryption.passphrase | The passphrase the backups are encrypted with
|
| services.bookstack.nginx | With this option, you can customize the nginx virtualHost settings.
|
| services.slskd.settings.remote_file_management | Whether to enable modification of share contents through the web ui.
|
| boot.initrd.luks.devices.<name>.bypassWorkqueues | Whether to bypass dm-crypt's internal read and write workqueues
|
| services.cassandra.jmxRoles.*.username | Username for JMX
|
| fileSystems.<name>.autoFormat | If the device does not currently contain a filesystem (as
determined by blkid), then automatically
format it with the filesystem type specified in
fsType
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.fastcgiParams | FastCGI parameters to override
|
| services.postgresql.systemCallFilter.<name>.priority | Set the priority of the system call filter setting
|
| programs.xfs_quota.projects.<name>.sizeHardLimit | Hard limit of the project size.
|
| programs.proxychains.proxies.<name>.host | Proxy host or IP address.
|
| programs.xfs_quota.projects.<name>.sizeSoftLimit | Soft limit of the project size
|
| networking.wg-quick.interfaces.<name>.preDown | Command called before the interface is taken down.
|
| programs.openvpn3.log-service.settings.log_dbus_details | Add D-Bus details in log file/syslog
|
| services.keter.bundle.appName | The name keter assigns to this bundle
|
| services.guix.publish.user | Name of the user to change once the server is up.
|
| services.woodpecker-agents.agents.<name>.environmentFile | File to load environment variables
from
|
| networking.wireguard.interfaces.<name>.listenPort | 16-bit port for listening
|
| networking.wg-quick.interfaces.<name>.peers | Peers linked to the interface.
|
| services.cloudflared.tunnels.<name>.originRequest.noHappyEyeballs | Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
|
| boot.zfs.devNodes | Name of directory from which to import ZFS device, this is passed to zpool import
as the value of the -d option
|
| containers.<name>.extraVeths.<name>.forwardPorts.*.protocol | The protocol specifier for port forwarding between host and container
|
| services.simplesamlphp.<name>.configureNginx | Configure nginx as a reverse proxy for SimpleSAMLphp.
|
| services.mobilizon.settings.":mobilizon"."Mobilizon.Web.Endpoint".has_reverse_proxy | Whether you use a reverse proxy
|
| programs.xfs_quota.projects.<name>.fileSystem | XFS filesystem hosting the xfs_quota project.
|
| services.invoiceplane.sites.<name>.invoiceTemplates | List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
These templates need to be packaged before use, see example.
|
| services.keepalived.vrrpInstances.<name>.trackInterfaces | List of network interfaces to monitor for health tracking.
|
| services.sanoid.datasets.<name>.script_timeout | Time limit for pre/post/pruning script execution time (<=0 for infinite).
|
| boot.initrd.luks.devices.<name>.fido2.credentials | List of FIDO2 credential IDs
|
| systemd.network.networks.<name>.ipv6PREF64Prefixes | A list of IPv6PREF64Prefix sections to be added to the unit
|
| services.avahi.domainName | Domain name for all advertisements.
|
| services.maubot.settings.server.override_resource_path | Override path from where to load UI resources.
|
| services.grav.systemSettings | Settings written to user/config/system.yaml.
|
| services.taskserver.organisations.<name>.groups | A list of group names that belong to the organization.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.file | Absolute path to the certificate to load
|
| services.biboumi.settings.persistent_by_default | Whether all rooms will be persistent by default:
the value of the “persistent” option in the global configuration of each
user will be “true”, but the value of each individual room will still
default to false
|
| services.mediagoblin.settings.mediagoblin.allow_registration | Whether to enable user self registration
|
| openstack.zfs.datasets.<name>.properties | Properties to set on this dataset.
|
| services.dendrite.settings.federation_api.database.connection_string | Database for the Federation API.
|
| services.longview.apiKeyFile | A file containing the Longview API key
|
| networking.wlanInterfaces.<name>.meshID | MeshID of interface with type mesh.
|
| services.strongswan-swanctl.swanctl.connections.<name>.mediated_by | The name of the connection to mediate this connection through
|
| image.repart.partitions.<name>.nixStorePrefix | The prefix to use for store paths
|
| services.baikal.pool | Name of existing phpfpm pool that is used to run web-application
|
| services.veilid.settings.core.network.detect_address_changes | Should veilid-core detect and notify on network address changes?
|
| services.patroni.scope | Cluster name.
|
| users.users.<name>.openssh.authorizedKeys.keys | A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys
|
| services.mautrix-meta.instances.<name>.environmentFile | File containing environment variables to substitute when copying the configuration
out of Nix store to the services.mautrix-meta.dataDir
|
| services.cyrus-imap.group | Cyrus IMAP group name
|
| services.vmagent.remoteWrite.basicAuthUsername | Basic Auth username used to connect to remote_write endpoint
|
| services.vlagent.remoteWrite.basicAuthUsername | Basic Auth username used to connect to remote_write endpoint
|
| image.repart.partitions.<name>.stripNixStorePrefix | Whether to strip /nix/store/ from the store paths
|
| services.nextjs-ollama-llm-ui.hostname | The hostname under which the Ollama UI interface should be accessible
|
| services.graphite.web.extraConfig | Graphite webapp settings
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_packets | Number of packets processed before initiating CHILD_SA rekeying
|
| networking.wg-quick.interfaces.<name>.postDown | Command called after the interface is taken down.
|
| services.archisteamfarm.bots.<name>.passwordFile | Path to a file containing the password
|
| services.authelia.instances.<name>.secrets.storageEncryptionKeyFile | Path to your storage encryption key.
|
| services.tailscale.serve.services | Services to configure for Tailscale Serve
|
| security.pam.services.<name>.googleAuthenticator.forwardPass | The authentication provides a single field requiring
the user's password followed by the one-time password (OTP).
|
| programs.schroot.profiles.<name>.copyfiles | A list of files to copy into the chroot from the host system.
|
| services.outline.smtp.host | Host name or IP address of the SMTP server.
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.password | |
| services.kanidm.provision.systems.oauth2.<name>.allowInsecureClientDisablePkce | Disable PKCE on this oauth2 resource server to work around insecure clients
that may not support it
|
| services.system76-scheduler.assignments.<name>.matchers | Process matchers.
|
| services.cloudflared.tunnels.<name>.originRequest.connectTimeout | Timeout for establishing a new TCP connection to your origin server
|
| services.mosquitto.listeners.*.users.<name>.hashedPasswordFile | Specifies the path to a file containing the
hashed password for the MQTT user
|
| users.users.<name>.openssh.authorizedKeys.keyFiles | A list of files each containing one OpenSSH public key that should be
added to the user's authorized keys
|
| services.buildkite-agents | Attribute set of buildkite agents
|
| services.murmur.group | The name of an existing group to use to run the service
|
| systemd.network.networks.<name>.ipv6RoutePrefixes | A list of ipv6RoutePrefix sections to be added to the unit
|
| services.bonsaid.configFile | Path to a .json file specifying the state transitions
|
| services.postgresqlWalReceiver.receivers.<name>.directory | Directory to write the output to.
|
| services.pantalaimon-headless.instances.<name>.listenPort | The port where the daemon will listen to client connections for
this homeserver
|
| services.microsocks.authUsername | Optional username to use for authentication.
|
| services.drupal.webserver | Whether to use nginx or caddy for virtual host management
|
| services.strongswan-swanctl.swanctl.connections.<name>.ppk_id | String identifying the Postquantum Preshared Key (PPK) to be used.
|
| networking.wireless.networks.<name>.bssid | If set, this network block is used only when associating with
the AP using the configured BSSID.
|
| security.auditd.plugins.<name>.direction | The option is dictated by the plugin
|
| services.sanoid.templates.<name>.pruning_script | Script to run after pruning snapshot.
|
| networking.wlanInterfaces.<name>.type | The type of the WLAN interface
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.serveraddress | mailserver name or address
|
| services.samba-wsdd.domain | Set domain name (disables workgroup).
|
| security.acme.certs.<name>.credentialFiles | Environment variables suffixed by "_FILE" to set for the cert's service
for your selected dnsProvider
|
| services.prometheus.scrapeConfigs.*.ec2_sd_configs.*.filters.*.name | See this list
for the available filters.
|
| services.davis.database.urlFile | A file containing the database connection url
|
| networking.supplicant.<name>.driver | Force a specific wpa_supplicant driver.
|
| networking.wlanInterfaces.<name>.flags | Flags for interface of type monitor.
|
| services.epmd.enable | Whether to enable socket activation for Erlang Port Mapper Daemon (epmd),
which acts as a name server on all hosts involved in distributed
Erlang computations.
|
| services.hardware.lcd.server.usbGroup | The group to use for settings permissions
|
| services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_emails | List of emails to allow access to this vhost, or null to allow all.
|
| services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_groups | List of groups to allow access to this vhost, or null to allow all.
|
| security.ipa.ipaHostname | Fully-qualified hostname used to identify this host in the IPA domain.
|
| users.mysql.pam.logging.rHostColumn | The name of the column in the log table to which the name of the remote
host that initiates the session is stored
|
| networking.interfaces.<name>.wakeOnLan.enable | Whether to enable wol on this interface.
|
| services.kanidm.provision.systems.oauth2.<name>.enableLocalhostRedirects | Allow localhost redirects
|
| services.bacula-fd.tls.verifyPeer | Verify peer certificate
|
| services.bacula-sd.tls.verifyPeer | Verify peer certificate
|
| services.vault.address | The name of the ip interface to listen to
|
| services.discourse.mail.outgoing.username | The username of the SMTP server.
|
| fileSystems.<name>.autoResize | If set, the filesystem is grown to its maximum size before
being mounted. (This is typically the size of the containing
partition.) This is currently only supported for ext2/3/4
filesystems that are mounted during early boot.
|
| services.strongswan-swanctl.swanctl.connections.<name>.dscp | Differentiated Services Field Codepoint to set on outgoing IKE packets for
this connection
|
| systemd.user.units.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.forgejo.dump.file | Filename to be used for the dump
|
| networking.wireless.networks.<name>.hidden | Set this to true if the SSID of the network is hidden.
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.starttls | set to true for using STARTTLS to start a TLS connection
|
| services.prometheus.exporters.ebpf.names | List of eBPF programs to load
|
| services.tarsnap.archives.<name>.aggressiveNetworking | Upload data over multiple TCP connections, potentially
increasing tarsnap's bandwidth utilisation at the cost
of slowing down all other network traffic
|
| services.tmate-ssh-server.host | External host name
|
| services.tsmBackup.servername | Create a systemd system service
tsm-backup.service that starts
a backup based on the given servername's stanza
|
| services.wstunnel.clients.<name>.upgradeCredentials | Use these credentials to authenticate during the HTTP upgrade request
(Basic authorization type, USER:[PASS]).
Passwords specified here will be world-readable in the Nix store!
To pass a password to the service, point the environmentFile option
to a file containing HTTP_PASSWORD=<your-password-here> and set this
option to <user>:$HTTP_PASSWORD
|
| services.icingaweb2.modules.monitoring.transports.<name>.type | Type of this transport
|
| systemd.network.networks.<name>.routingPolicyRules | A list of routing policy rules sections to be added to the unit
|
| services.limesurvey.nginx.virtualHost.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| security.acme.certs.<name>.environmentFile | Path to an EnvironmentFile for the cert's service containing any required and
optional environment variables for your selected dnsProvider
|
| services.bcg.automaticRenameGenericNodes | Automatically rename generic nodes.
|
| services.bacula-dir.tls.verifyPeer | Verify peer certificate
|
| services.mailman.webSettings | Overrides for the default mailman-web Django settings.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.neo4j.extraServerConfig | Extra configuration for Neo4j Community server
|
| services.sanoid.templates.<name>.script_timeout | Time limit for pre/post/pruning script execution time (<=0 for infinite).
|
| services.sourcehut.settings."hg.sr.ht".clone_bundle_threshold | .hg/store size (in MB) past which the nightly job generates clone bundles.
|
| services.icingaweb2.modules.monitoring.transports.<name>.host | Host for the api or remote transport
|
| security.agnos.settings.accounts.*.private_key_path | Path of the PEM-encoded private key for this account
|
| services.bacula-sd.autochanger.<name>.extraAutochangerConfig | Extra configuration to be passed in Autochanger directive.
|
| services.dendrite.settings.app_service_api.database.connection_string | Database for the Appservice API.
|
| services.factorio.loadLatestSave | Load the latest savegame on startup
|
| services.strongswan-swanctl.swanctl.connections.<name>.vips | List of virtual IPs to request in IKEv2 configuration payloads or IKEv1
Mode Config
|
| networking.vswitches.<name>.openFlowRules | OpenFlow rules to insert into the Open vSwitch
|
| services.trilium-server.nginx.enable | Configure the nginx reverse proxy settings.
|
| services.gdomap.enable | Whether to enable GNUstep Distributed Objects name server.
|
| virtualisation.xen.store.settings.conflict.rateLimitIsAggregate | If the conflict.rateLimitIsAggregate option is true, then after each
tick one point of conflict-credit is given to just one domain: the
one at the front of the queue
|
| services.geoclue2.appConfig | Specify extra settings per application.
|
| services.dendrite.settings.user_api.device_database.connection_string | Database for the User API, devices.
|
| services.discourse.database.username | Discourse database user.
|
| services.icingaweb2.modules.monitoring.transports.<name>.path | Path to the socket for local or remote transports
|
| services.icingaweb2.modules.monitoring.transports.<name>.port | Port to connect to for the api or remote transport
|
| services.mautrix-meta.instances.<name>.serviceDependencies | List of Systemd services to require and wait for when starting the application service.
|
| programs.proxychains.proxies.<name>.enable | Whether to enable this proxy.
|
| systemd.network.netdevs.<name>.wireguardPeers | Each item in this array specifies an option in the
[WireGuardPeer] section of the unit
|
| boot.binfmt.registrations.<name>.offset | The byte offset of the magic number used for recognition.
|
| services.sympa.web.server | The webserver used for the Sympa web interface
|
| services.deye-dummycloud.mqttUsername | MQTT username
|
| services.cyrus-imap.cyrusSettings | Cyrus configuration settings
|
| services.cyrus-imap.imapdSettings | IMAP configuration settings
|
| services.postgresqlWalReceiver.receivers.<name>.compress | Enables gzip compression of write-ahead logs, and specifies the compression level
(0 through 9, 0 being no compression and 9 being best compression)
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.filters.*.name | Name of the filter
|
| containers.<name>.config | A specification of the desired configuration of this
container, as a NixOS module.
|
| containers.<name>.autoStart | Whether the container is automatically started at boot-time.
|
| services.icingaweb2.modules.monitoring.backends.<name>.disabled | Disable this backend
|
| systemd.network.networks.<name>.dhcpServerStaticLeases | A list of DHCPServerStaticLease sections to be added to the unit
|
| services.freshrss.api.enable | Whether to enable API access for mobile apps and third-party clients (Google Reader API and Fever API)
|
| networking.wlanInterfaces.<name>.fourAddr | Whether to enable 4-address mode with type managed.
|
| services.cpupower-gui.enable | Enables dbus/systemd service needed by cpupower-gui
|
| services.rshim.index | Specify the index to create device path /dev/rshim<index>
|
| security.acme.certs.<name>.dnsPropagationCheck | Toggles lego DNS propagation check, which is used alongside DNS-01
challenge to ensure the DNS entries required are available.
|
| services.hardware.bolt.enable | Whether to enable Bolt, a userspace daemon to enable
security levels for Thunderbolt 3 on GNU/Linux
|
| networking.supplicant.<name>.extraCmdArgs | Command line arguments to add when executing wpa_supplicant.
|
| systemd.user.paths.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.vsmartcard-vpcd.hostname | Hostname of a waiting vpicc server vpcd will be connecting to
|
| services.strongswan-swanctl.swanctl.authorities.<name>.cacert | The certificates may use a relative path from the swanctl
x509ca directory or an absolute path
|
| containers.<name>.extraVeths.<name>.forwardPorts.*.containerPort | Target port of container
|
| services.kismet.serverName | The name of the server.
|
| networking.macvlans.<name>.interface | The interface the macvlan will transmit packets through.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.proxyWebsockets | Whether to support proxying websocket connections with HTTP/1.1.
|
| services.dendrite.settings.client_api.registration_disabled | Whether to disable user registration to the server
without the shared secret.
|
| hardware.fw-fanctrl.config.strategies.<name>.speedCurve | How should the speed curve look like
|
| services.rss-bridge.pool | Name of phpfpm pool that is used to run web-application
|
| system.nixos.codeName | The NixOS release code name (e.g. Emu).
|
| services.pantalaimon-headless.instances.<name>.listenAddress | The address where the daemon will listen to client connections
for this homeserver.
|
| services.keycloak.database.username | Username to use when connecting to an external or manually
provisioned database; has no effect when a local database is
automatically provisioned
|
| services.strongswan-swanctl.swanctl.connections.<name>.pull | If the default of yes is used, Mode Config works in pull mode, where the
initiator actively requests a virtual IP
|
| services.nscd.enable | Whether to enable the Name Service Cache Daemon
|
| services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers | Additionally enable the recommended set of pairwise ciphers
|
| networking.wg-quick.interfaces.<name>.mtu | If not specified, the MTU is automatically determined
from the endpoint addresses or the system default route, which is usually
a sane choice
|
| systemd.network.networks.<name>.fairQueueingConfig | Each attribute in this set specifies an option in the
[FairQueueing] section of the unit
|
| security.pam.services.<name>.googleOsLoginAccountVerification | If set, will use the Google OS Login PAM modules
(pam_oslogin_login,
pam_oslogin_admin) to verify possible OS Login
users and set sudoers configuration accordingly
|
| systemd.paths.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.units.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.timers.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.slices.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| users.extraUsers.<name>.openssh.authorizedKeys.keys | A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys
|
| services.rspamd.locals | Local configuration files, written into /etc/rspamd/local.d/{name}.
|
| services.journald.rateLimitBurst | Configures the rate limiting burst limit (number of messages per
interval) that is applied to all messages generated on the system
|
| services.postgresqlWalReceiver.receivers.<name>.slot | Require pg_receivewal to use an existing replication slot (see
Section 26.2.6 of the PostgreSQL manual)
|
| services.zfs.autoReplication.username | Username used by SSH to login to remote host.
|
| containers.<name>.path | As an alternative to specifying
config, you can specify the path to
the evaluated NixOS system configuration, typically a
symlink to a system profile.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.ah_proposals | AH proposals to offer for the CHILD_SA
|
| services.kubernetes.kubelet.hostname | Kubernetes kubelet hostname override.
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.policies_fwd_out | Whether to install outbound FWD IPsec policies or not
|
| services.librenms.user | Name of the LibreNMS user.
|
| services.nextcloud.settings.mail_smtpstreamoptions | This depends on mail_smtpmode
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.resources.*.names | List of resources to host on this listener.
|
| boot.loader.systemd-boot.extraFiles | A set of files to be copied to $BOOT
|
| services.hadoop.hdfs.namenode.restartIfChanged | Automatically restart the service on config change
|
| services.tt-rss.virtualHost | Name of the nginx virtualhost to use and setup
|
| systemd.network.netdevs.<name>.batmanAdvancedConfig | Each attribute in this set specifies an option in the
[BatmanAdvanced] section of the unit
|
| services.nezha-agent.settings.disable_command_execute | Disable executing the command from dashboard.
|
| networking.wg-quick.interfaces.<name>.address | The IP addresses of the interface.
|
| services.headscale.settings.tls_letsencrypt_listen | When HTTP-01 challenge is chosen, letsencrypt must set up a
verification endpoint, and it will be listening on:
:http = port 80.
|
| services.sitespeed-io.runs | A list of run configurations
|
| services.grafana.settings.analytics.feedback_links_enabled | Set to false to remove all feedback links from the UI.
|
| services.bluemap.coreSettings | Settings for the core.conf file, see upstream docs.
|
| users.extraUsers.<name>.openssh.authorizedKeys.keyFiles | A list of files each containing one OpenSSH public key that should be
added to the user's authorized keys
|
| services.postfix.settings.main.smtp_tls_security_level | The client TLS security level.
Use dane with a local DNSSEC validating DNS resolver enabled.
https://www.postfix.org/postconf.5.html#smtp_tls_security_level
|
| services.radicale.rights | Configuration for Radicale's rights file
|
| networking.bridges.<name>.interfaces | The physical network interfaces connected by the bridge.
|
| services.dawarich.smtp.user | SMTP login name.
|
| services.mastodon.smtp.user | SMTP login name.
|
| services.pantalaimon-headless.instances.<name>.extraSettings | Extra configuration options
|
| networking.wireless.networks.<name>.psk | The network's pre-shared key in plaintext defaulting
to being a network without any authentication.
Be aware that this will be written to the Nix store
in plaintext! Use pskRaw with an external
reference to keep it safe.
Mutually exclusive with pskRaw.
|
| programs.tsmClient.servers.<name>.passworddir | Directory that holds the TSM
node's password information.
|
| systemd.network.netdevs.<name>.wireguardConfig | Each attribute in this set specifies an option in the
[WireGuard] section of the unit
|
| containers.<name>.extraVeths | Extra veth-pairs to be created for the container.
|
| services.pretix.nginx.domain | The domain name under which to set up the virtual host.
|
| systemd.paths.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.queries | SQL queries to run.
|
| services.strongswan-swanctl.swanctl.connections.<name>.encap | To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
NAT detection payloads
|
| networking.wlanInterfaces.<name>.mac | MAC address to use for the device
|
| security.pam.services.<name>.googleOsLoginAuthentication | If set, will use the pam_oslogin_login's user
authentication methods to authenticate users using 2FA
|
| services.dendrite.settings.user_api.account_database.connection_string | Database for the User API, accounts.
|
| services.snipe-it.config | Snipe-IT configuration options to set in the
.env file
|
| boot.binfmt.registrations.<name>.interpreter | The interpreter to invoke to run the program
|
| networking.wireless.networks.<name>.ssid | You could use this field to override the network's ssid
|
| services.cloudflared.tunnels.<name>.certificateFile | Account certificate file, necessary to create, delete and manage tunnels
|
| services.strongswan-swanctl.swanctl.connections.<name>.local | Section for a local authentication round
|
| services.grav.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.namecoind.rpc.certificate | Certificate file for securing RPC connections.
|
| systemd.network.networks.<name>.tokenBucketFilterConfig | Each attribute in this set specifies an option in the
[TokenBucketFilter] section of the unit
|
| systemd.network.networks.<name>.heavyHitterFilterConfig | Each attribute in this set specifies an option in the
[HeavyHitterFilter] section of the unit
|
| services.strongswan-swanctl.swanctl.authorities.<name>.crl_uris | List of CRL distribution points (ldap, http, or file URI)
|
| systemd.user.slices.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.user.timers.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.tor.client.onionServices.<name>.clientAuthorizations | Clients' authorizations for a v3 onion service,
as a list of files containing each one private key, in the format:
descriptor:x25519:<base32-private-key>
See torrc manual.
|
| services.cloudlog.extraConfig | Any additional text to be appended to the config.php
configuration file
|
| services.selfoss.pool | Name of existing phpfpm pool that is used to run web-application
|
| virtualisation.kvmgt.vgpus.<name>.uuid | UUID(s) of VGPU device
|
| services.grafana.settings.security.x_content_type_options | Set to false to disable the X-Content-Type-Options response header
|
| networking.interfaces.<name>.ipv6.routes | List of extra IPv6 static routes that will be assigned to the interface.
|
| services.kanidm.provision.systems.oauth2.<name>.supplementaryScopeMaps | Maps kanidm groups to additionally returned oauth scopes
|
| services.mediagoblin.settings.mediagoblin.email_sender_address | Email address which notices are sent from.
|
| containers.<name>.bindMounts | An extra list of directories that is bound to the container.
|
| services.samba.nmbd.enable | Whether to enable Samba's nmbd, which replies to NetBIOS over IP name
service requests
|
| networking.supplicant.<name>.configFile.path | External wpa_supplicant.conf configuration file
|
| boot.binfmt.registrations.<name>.openBinary | Whether to pass the binary to the interpreter as an open
file descriptor, instead of a path.
|
| programs.uwsm.waylandCompositors.<name>.extraArgs | Extra command-line arguments pass to to the compsitor.
|
| services.gammu-smsd.backend.sql.user | User name used for connection to the database
|
| networking.interfaces.<name>.ipv4.routes.*.via | IPv4 address of the next hop.
|
| networking.interfaces.<name>.ipv6.routes.*.via | IPv6 address of the next hop.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.startupSql | A list of SQL statements to execute once after making a connection.
|
| services.dnsdist.dnscrypt.providerName | The name that will be given to this DNSCrypt resolver.
The provider name must start with 2.dnscrypt-cert..
|
| networking.vswitches.<name>.openFlowVersion | Version of OpenFlow protocol to use when communicating with the switch internally (e.g. with openFlowRules).
|
| services.pgbouncer.settings.pgbouncer.max_user_connections | Do not allow more than this many server connections per user (regardless of database)
|
| systemd.shutdownRamfs.contents.<name>.dlopen.features | Features to enable via dlopen ELF notes
|
| systemd.slices.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.timers.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.bitlbee.extraSettings | Will be inserted in the Settings section of the config file.
|
| services.mail.sendmailSetuidWrapper.program | The name of the wrapper program
|
| programs.ssh.knownHosts | The set of system-wide known SSH hosts
|
| services.nomad.extraSettingsPaths | Additional settings paths used to configure nomad
|
| services.influxdb2.provision.organizations.<name>.auths | API tokens to provision for the user in this organization.
|
| services.strongswan-swanctl.swanctl.connections.<name>.version | IKE major version to use for connection.
- 1 uses IKEv1 aka ISAKMP,
- 2 uses IKEv2.
- A connection using the default of 0 accepts both IKEv1 and IKEv2 as
responder, and initiates the connection actively with IKEv2
|
| hardware.fw-fanctrl.config.strategies.<name>.speedCurve.*.temp | Temperature in °C at which the fan speed should be changed
|
| services.strongswan-swanctl.swanctl.pools.<name>.split_exclude | Address or CIDR subnets
StrongSwan default: []
|
| services.strongswan-swanctl.swanctl.pools.<name>.split_include | Address or CIDR subnets
StrongSwan default: []
|
| networking.interfaces.<name>.macAddress | MAC address of the interface
|
| systemd.user.sockets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.user.targets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.teeworlds.game.tournamentMode | Whether to enable tournament mode
|
| services.prometheus.exporters.imap-mailstat.accounts.<name>.serverport | imap port number (at the moment only tls connection is supported)
|
| services.filesender.database.hostname | Database hostname.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.ocsp_uris | List of OCSP URIs
|
| services.flannel.iface | Interface to use (IP or name) for inter-host communication
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote | Section for a remote authentication round
|
| security.wrappers.<name>.permissions | The permissions of the wrapper program
|
| services.kanidm.unix.settings.kanidm.pam_allowed_login_groups | Kanidm groups that are allowed to login using PAM.
|
| services.zoneminder.database.username | Username for accessing the database.
|
| services.spiped.config | Configuration for a secure pipe daemon
|
| services.cloudflared.tunnels.<name>.originRequest.disableChunkedEncoding | Disables chunked transfer encoding
|
| services.minetest-server.config | Settings to add to the minetest config file
|
| services.syncthing.configDir | The path where the settings and keys will exist.
|
| virtualisation.fileSystems.<name>.encrypted.label | Label of the unlocked encrypted device
|
| services.dnsdist.enable | Whether to enable dnsdist domain name server.
|
| services.slurm.controlAddr | Name that ControlMachine should be referred to in establishing a
communications path.
|
| services.unbound.enable | Whether to enable Unbound domain name server.
|
| programs.clash-verge.tunMode | Whether to enable Setcap for TUN Mode
|
| services.librenms.group | Name of the LibreNMS group.
|
| services.stash.settings.preview_segment_duration | Preview segment duration, in seconds
|
| systemd.timers.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.slices.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| networking.vlans | This option allows you to define vlan devices that tag packets
on top of a physical interface
|
| services.davfs2.davUser | When invoked by root the mount.davfs daemon will run as this user
|
| systemd.network.networks.<name>.quickFairQueueingConfig | Each attribute in this set specifies an option in the
[QuickFairQueueing] section of the unit
|
| networking.wg-quick.interfaces.<name>.peers.*.publicKey | The base64 public key to the peer.
|
| systemd.shutdownRamfs.contents.<name>.dlopen.usePriority | Priority of dlopen ELF notes to include. "required" is
minimal, "recommended" includes "required", and
"suggested" includes "recommended"
|
| services.kanidm.serverSettings | Settings for Kanidm, see
the documentation
and example configuration
for possible values.
|
| services.znc.confOptions.userName | The user name used to log in to the ZNC web admin interface.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.interval | How often to run this job, specified in
Go duration format.
|
| hardware.fw-fanctrl.config.strategies.<name>.speedCurve.*.speed | Percent how fast the fan should run at
|
| services.postgresqlWalReceiver.receivers.<name>.statusInterval | Specifies the number of seconds between status packets sent back to the server
|
| services.grafana.settings.security.csrf_additional_headers | List of allowed headers to be set by the user
|
| services.elasticsearch.cluster_name | Elasticsearch name that identifies your cluster for auto-discovery.
|
| networking.wireless.networks.<name>.auth | Use this option to configure advanced authentication methods
like EAP
|
| services.shorewall6.configs | This option defines the Shorewall configs
|
| programs.nix-required-mounts.allowedPatterns.<name>.paths | A list of glob patterns, indicating which paths to expose to the sandbox
|
| services.k3s.autoDeployCharts | Auto deploying Helm charts that are installed by the k3s Helm controller
|
| services.calibre-web.dataDir | Where Calibre-Web stores its data
|
| services.nixops-dns.domain | Fake domain name to resolve to NixOps virtual machines
|
| services.agorakit.mail.fromName | Mail "from" name.
|
| networking.wireless.networks.<name>.extraConfig | Extra configuration lines appended to the network block
|
| networking.wireguard.interfaces.<name>.ips | The IP addresses of the interface.
|
| services.mautrix-meta.instances.<name>.registrationServiceUnit | The registration service that generates the registration file
|
| systemd.user.sockets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.user.targets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| services.freshrss.webserver | Whether to use nginx or caddy for virtual host management
|
| services.dokuwiki.webserver | Whether to use nginx or caddy for virtual host management
|
| services.strongswan-swanctl.swanctl.connections.<name>.mobike | Enables MOBIKE on IKEv2 connections
|
| services.matrix-conduit.settings.global.allow_check_for_updates | Whether to allow Conduit to automatically contact
https://conduit.rs hourly to check for important Conduit news
|
| programs.uwsm.waylandCompositors.<name>.comment | The comment field of the desktop entry file.
|
| services.postfix.settings.main.smtpd_tls_security_level | The server TLS security level
|
| boot.binfmt.registrations.<name>.fixBinary | Whether to open the interpreter file as soon as the
registration is loaded, rather than waiting for a
relevant file to be invoked
|
| services.ircdHybrid.serverName | IRCD server name.
|
| services.icingaweb2.modules.monitoring.transports.<name>.password | Password for the api transport
|
| services.mjolnir.pantalaimon.username | The username to login with.
|
| services.asusd.auraConfigs | The content of /etc/asusd/aura_.ron
|
| networking.interfaces.<name>.virtual | Whether this interface is virtual and should be created by tunctl
|
| services.nixops-dns.enable | Whether to enable the nixops-dns resolution
of NixOps virtual machines via dnsmasq and fake domain name.
|
| services.icingaweb2.modules.monitoring.transports.<name>.instance | Assign a icinga instance to this transport
|
| networking.domain | The system domain name
|
| services.prosody.muc.*.domain | Domain name of the MUC
|
| services.pantalaimon-headless.instances.<name>.homeserver | The URI of the homeserver that the pantalaimon proxy should
forward requests to, without the matrix API path but including
the http(s) schema.
|
| services.grafana.settings.security.content_security_policy | Set to true to add the Content-Security-Policy header to your requests
|
| networking.wg-quick.interfaces.<name>.table | The kernel routing table to add this interface's
associated routes to
|
| services.chhoto-url.settings.custom_landing_directory | The path of a directory which contains a custom landing page.
|
| services.icingaweb2.modules.monitoring.transports.<name>.resource | SSH identity resource for the remote transport
|
| services.jicofo.xmppDomain | Domain name of the XMMP server to which to connect as a component
|
| services.cloudflared.tunnels.<name>.originRequest.keepAliveConnections | Maximum number of idle keepalive connections between Tunnel and your origin
|
| services.chhoto-url.settings.public_mode_expiry_delay | The maximum expiry delay in seconds to force in public mode.
|
| networking.vswitches.<name>.extraOvsctlCmds | Commands to manipulate the Open vSwitch database
|
| services.ceph.global.clusterName | Name of cluster
|
| networking.wg-quick.interfaces.<name>.privateKeyFile | Private key file as generated by wg genkey.
|
| services.mjpg-streamer.user | mjpg-streamer user name.
|
| services.postgresqlWalReceiver.receivers.<name>.environment | Environment variables passed to the service
|
| networking.supplicant.<name>.extraConf | Configuration options for wpa_supplicant.conf
|
| services.prometheus.remoteRead.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.echoip.enableReverseHostnameLookups | Whether to enable reverse hostname lookups.
|
| systemd.targets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| systemd.sockets.<name>.overrideStrategy | Defines how unit configuration is provided for systemd:
asDropinIfExists creates a unit file when no unit file is provided by the package
otherwise it creates a drop-in file named overrides.conf.
asDropin creates a drop-in file named overrides.conf
|
| services.influxdb2.provision.organizations.<name>.buckets | Buckets to provision in this organization.
|
| services.apcupsd.configText | Contents of the runtime configuration file, apcupsd.conf
|
| users.users.<name>.openssh.authorizedPrincipals | A list of verbatim principal names that should be added to the user's
authorized principals.
|
| services.authelia.instances.<name>.environmentVariables | Additional environment variables to provide to authelia
|
| services.jupyter.group | Name of the group used to run the jupyter service
|
| services.rshim.backend | Specify the backend to attach
|
| services.jigasi.xmppDomain | Domain name of the XMMP server to which to connect as a component
|
| services.strongswan-swanctl.swanctl.connections.<name>.mediation | Whether this connection is a mediation connection, that is, whether this
connection is used to mediate other connections using the IKEv2 Mediation
Extension
|
| security.agnos.settings.accounts.*.certificates.*.key_output_file | Output path for the certificate private key
|
| services.influxdb2.provision.organizations.<name>.present | Whether to ensure that this organization is present or absent.
|
| networking.bonds | This option allows you to define bond devices that aggregate multiple,
underlying networking interfaces together
|
| services.portunus.seedSettings | Seed settings for users and groups
|
| services.postgresqlWalReceiver.receivers.<name>.postgresqlPackage | The postgresql package to use.
|
| services.peertube-runner.instancesToRegister.<name>.runnerDescription | Runner description declared to the PeerTube instance.
|
| services.pretalx.nginx.domain | The domain name under which to set up the virtual host.
|
| services.bluemap.webappSettings | Settings for the webapp.conf file, see upstream docs.
|
| services.limesurvey.nginx.virtualHost.serverName | Name of this virtual host
|
| services.doh-server.settings.ecs_allow_non_global_ip | By default, non global IP addresses are never forwarded to upstream servers
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote_addrs | Remote address(es) to use for IKE communication
|
| services.sympa.database.user | Database user
|
| services.resilio.deviceName | Name of the Resilio Sync device.
|
| services.lasuite-docs.domain | Domain name of the docs instance.
|
| services.lasuite-meet.domain | Domain name of the meet instance.
|
| services.freshrss.pool | Name of the php-fpm pool to use and setup
|
| services.mongodb.replSetName | If this instance is part of a replica set, set its name here
|
| containers.<name>.privateNetwork | Whether to give the container its own private virtual
Ethernet interface
|
| systemd.sockets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.targets.<name>.documentation | A list of URIs referencing documentation for this unit or its configuration.
|
| systemd.network.networks.<name>.networkEmulatorConfig | Each attribute in this set specifies an option in the
[NetworkEmulator] section of the unit
|
| networking.wireguard.interfaces.<name>.type | The type of the interface
|
| services.prometheus.exporters.dmarc.imap.username | Login username for the IMAP connection.
|
| services.filesender.settings.storage_filesystem_path | When using storage type filesystem this is the absolute path to the file system where uploaded files are stored until they expire
|
| services.dovecot2.user | Dovecot user name.
|
| services.prometheus.remoteWrite.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.strongswan-swanctl.swanctl.connections.<name>.if_id_in | XFRM interface ID set on inbound policies/SA, can be overridden by child
config, see there for details
|
| services.logstash.extraSettings | Extra Logstash settings in YAML format.
|
| services.mediawiki.extraConfig | Any additional text to be appended to MediaWiki's
LocalSettings.php configuration file
|
| services.thanos.rule.alert.label-drop | Labels by name to drop before sending to alertmanager
|
| networking.interfaces.<name>.wakeOnLan.policy | The Wake-on-LAN policy
to set for the device
|
| services.parsedmarc.provision.localMail.recipientName | The DMARC mail recipient name, i.e. the name part of the
email address which receives DMARC reports
|
| networking.wireguard.interfaces.<name>.peers | Peers linked to the interface.
|
| services.saunafs.masterHost | IP or hostname name of master host.
|
| programs.uwsm.waylandCompositors.<name>.binPath | The wayland-compositor binary path that will be called by UWSM
|
| containers.<name>.extraFlags | Extra flags passed to the systemd-nspawn command
|
| services.strongswan-swanctl.swanctl.connections.<name>.dpd_delay | Interval to check the liveness of a peer actively using IKEv2
INFORMATIONAL exchanges or IKEv1 R_U_THERE messages
|
| services.gnome.at-spi2-core.enable | Whether to enable at-spi2-core, a service for the Assistive Technologies
available on the GNOME platform
|
| services.oink.domains | List of attribute sets containing configuration for each domain
|
| services.ncps.cache.storage.s3.bucket | The name of the S3 bucket.
|
| networking.wg-quick.interfaces.<name>.extraOptions | Extra options to append to the interface section
|
| services.strongswan-swanctl.swanctl.connections.<name>.rand_time | Time range from which to choose a random value to subtract from
rekey/reauth times
|
| networking.wg-quick.interfaces.<name>.privateKey | Base64 private key generated by wg genkey
|
| services.monica.config | monica configuration options to set in the
.env file
|
| services.bitlbee.hostName | Normally, BitlBee gets a hostname using getsockname()
|
| services.dependency-track.oidc.teams.claim | Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
|
| programs.tsmClient.defaultServername | If multiple server stanzas are declared with
programs.tsmClient.servers,
this option may be used to name a default
server stanza that IBM TSM uses in the absence of
a user-defined dsm.opt file
|
| systemd.network.networks.<name>.quickFairQueueingConfigClass | Each attribute in this set specifies an option in the
[QuickFairQueueingClass] section of the unit
|
| services.nginx.resolver | Configures name servers used to resolve names of upstream servers into addresses
|
| services.dawarich.user | User under which dawarich runs
|
| networking.interfaces.<name>.virtualOwner | In case of a virtual device, the user who owns it.
null will not set owner, allowing access to any user.
|
| services.moosefs.masterHost | IP or DNS name of the MooseFS master server.
|
| services.dolibarr.domain | Domain name of your server.
|
| containers.<name>.enableTun | Allows the container to create and setup tunnel interfaces
by granting the NET_ADMIN capability and
enabling access to /dev/net/tun.
|
| services.matrix-synapse.settings.app_service_config_files | A list of application service config file to use
|
| services.avahi.publish.domain | Whether to announce the locally used domain name for browsing by other hosts.
|
| services.icingaweb2.libraryPaths | Libraries to add to the Icingaweb2 library path
|
| containers.<name>.hostBridge | Put the host-side of the veth-pair into the named bridge
|
| services.davis.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.movim.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.slskd.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.tuned.settings.default_instance_priority | Default instance (unit) priority.
|
| networking.wg-quick.interfaces.<name>.autostart | Whether to bring up this interface automatically during boot.
|
| services.strongswan-swanctl.swanctl.connections.<name>.send_cert | Send certificate payloads when using certificate authentication.
- With the default of
ifasked the daemon sends
certificate payloads only if certificate requests have been received.
never disables sending of certificate payloads
altogether,
always causes certificate payloads to be sent
unconditionally whenever certificate authentication is used
|
| networking.wg-quick.interfaces.<name>.configFile | wg-quick .conf file, describing the interface
|
| services.prometheus.exporters.mqtt.mqttUsername | Username which should be used to authenticate against the MQTT broker.
|
| networking.vswitches.<name>.interfaces | The physical network interfaces connected by the vSwitch.
|
| services.kapacitor.defaultDatabase.username | The username to connect to the remote InfluxDB server
|
| services.varnish.listen.*.user | User name who owns the socket file.
|
| services.wakapi.database.user | The name of the user to use for Wakapi.
|
| services.varnish.listen.*.address | If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]").
(VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
followed by the name of an abstract socket ("@myvarnishd") accept connections
on a Unix domain socket
|
| services.mjpg-streamer.group | mjpg-streamer group name.
|
| networking.supplicant.<name>.configFile.writable | Whether the configuration file at configFile.path should be written to by
wpa_supplicant.
|
| services.ghostunnel.servers.<name>.disableAuthentication | Disable client authentication, no client certificate will be required.
|
| networking.sits.<name>.encapsulation.port | Destination port when using UDP encapsulation.
|
| networking.wireguard.interfaces.<name>.preSetup | Commands called at the start of the interface setup.
|
| services.matrix-synapse.workers.<name>.worker_listeners | List of ports that this worker should listen on, their purpose and their configuration.
|
| services.mailman.enablePostfix | Enable Postfix integration
|
| services.kresd.enable | Whether to enable knot-resolver (version 5) domain name server
|
| services.wordpress.webserver | Whether to use apache2 or nginx for virtual host management
|
| services.gitlab.registry.host | GitLab container registry host name.
|
| services.baikal.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.snipe-it.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.strongswan-swanctl.swanctl.connections.<name>.if_id_out | XFRM interface ID set on outbound policies/SA, can be overridden by child
config, see there for details
|
| services.pgpkeyserver-lite.hostname | Which hostname to set the vHost to that is proxying to sks.
|
| services.postgresqlWalReceiver.receivers.<name>.synchronous | Flush the WAL data to disk immediately after it has been received
|
| services.openafsClient.cellName | Cell name.
|
| services.nextcloud.settings.mail_send_plaintext_only | Email will be sent by default with an HTML and a plain text body
|
| containers.<name>.hostAddress | The IPv4 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| users.extraUsers.<name>.openssh.authorizedPrincipals | A list of verbatim principal names that should be added to the user's
authorized principals.
|
| services.bird-lg.frontend.domain | Server name domain suffixes.
|
| systemd.user.generators | Definition of systemd generators; see systemd.generator(5)
|
| services.postgresql.settings.shared_preload_libraries | List of libraries to be preloaded.
|
| services.shellhub-agent.preferredHostname | Set the device preferred hostname
|
| systemd.generators | Definition of systemd generators; see systemd.generator(5)
|
| services.gitlab-runner.configFile | Configuration file for gitlab-runner.
configFile takes precedence over services.
checkInterval and concurrent will be ignored too
|
| services.olivetin.extraConfigFiles | Config files to merge into the settings defined in services.olivetin.settings
|
| services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.esp_proposals | ESP proposals to offer for the CHILD_SA
|
| systemd.network.networks.<name>.controlledDelayConfig | Each attribute in this set specifies an option in the
[ControlledDelay] section of the unit
|
| services.echoip.virtualHost | Name of the nginx virtual host to use and setup
|
| services.powerdns.enable | Whether to enable PowerDNS domain name server.
|
| networking.wireguard.interfaces.<name>.postSetup | Commands called at the end of the interface setup.
|
| services.samba.nsswins | Whether to enable WINS NSS (Name Service Switch) plug-in
|
| networking.interfaces.<name>.ipv4.routes.*.address | IPv4 address of the network.
|
| networking.interfaces.<name>.ipv6.routes.*.address | IPv6 address of the network.
|
| services.prometheus.scrapeConfigs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| networking.fqdn | The fully qualified domain name (FQDN) of this host
|
| services.dovecot2.group | Dovecot group name.
|
| services.misskey.reverseProxy.webserver.nginx.serverName | Name of this virtual host
|
| containers.<name>.hostAddress6 | The IPv6 address assigned to the host interface.
(Not used when hostBridge is set.)
|
| boot.loader.systemd-boot.windows.<name>.efiDeviceHandle | The device handle of the EFI System Partition (ESP) where the Windows bootloader is
located
|
| services.cachix-agent.profile | Profile name, defaults to 'system' (NixOS).
|
| services.weblate.localDomain | The domain name serving your Weblate instance.
|
| systemd.network.networks.<name>.stochasticFairBlueConfig | Each attribute in this set specifies an option in the
[StochasticFairBlue] section of the unit
|
| networking.wireguard.interfaces.<name>.metric | Set the metric of routes related to this Wireguard interface.
|
| programs.zsh.ohMyZsh.theme | Name of the theme to be used by oh-my-zsh.
|
| services.mattermost.environmentFile | Environment file (see systemd.exec(5)
"EnvironmentFile=" section for the syntax) which sets config options
for mattermost (see the Mattermost documentation)
|
| virtualisation.fileSystems.<name>.noCheck | Disable running fsck on this filesystem.
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.type | The type of the listener, usually http.
|
| containers.<name>.tmpfs | Mounts a set of tmpfs file systems into the container
|
| networking.wg-quick.interfaces.<name>.peers.*.endpoint | Endpoint IP or hostname of the peer, followed by a colon,
and then a port number of the peer.
|
| networking.sits.<name>.encapsulation | Configures the type of encapsulation.
|
| programs.tsmClient.servers.<name>.tcpserveraddress | Host/domain name or IP address of the IBM TSM server.
|
| services.warpgate.settings.http.trust_x_forwarded_headers | Trust X-Forwarded-* headers
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.port | The port to listen for HTTP(S) requests on.
|
| services.oidentd.enable | Whether to enable ‘oidentd’, an implementation of the Ident
protocol (RFC 1413)
|
| services.mqtt2influxdb.mqtt.username | Username used to connect to the MQTT server.
|
| services.strongswan-swanctl.swanctl.connections.<name>.over_time | Hard IKE_SA lifetime if rekey/reauth does not complete, as time
|
| programs.foot.theme | Theme name
|
| fileSystems.<name>.overlay.useStage1BaseDirectories | If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot
|
| services.strongswan-swanctl.swanctl.connections.<name>.aggressive | Enables Aggressive Mode instead of Main Mode with Identity
Protection
|
| services.pfix-srsd.configurePostfix | Whether to configure the required settings to use pfix-srsd in the local Postfix instance.
|
| services.bookstack.mail.fromName | Mail "from" name.
|
| services.openldap.mutableConfig | Whether to allow writable on-line configuration
|
| services.peertube-runner.instancesToRegister.<name>.registrationTokenFile | Path to a file containing a registration token for the PeerTube instance
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.tls | Whether to enable TLS on the listener socket.
This option will be ignored for UNIX domain sockets.
|
| users.users.<name>.hashedPassword | Specifies the hashed password for the user
|
| services.netbird.enable | Enables backward-compatible NetBird client service
|
| services.openafsServer.cellName | Cell name, this server will serve.
|
| services.prometheus.exporters.sql.configuration.jobs.<name>.connections | A list of connection strings of the SQL servers to scrape metrics from
|
| systemd.network.networks.<name>.hierarchyTokenBucketConfig | Each attribute in this set specifies an option in the
[HierarchyTokenBucket] section of the unit
|
| networking.wireless.networks.<name>.authProtocols | The list of authentication protocols accepted by this network
|
| services.gitlab-runner.services.<name>.authenticationTokenConfigFile | Absolute path to a file containing environment variables used for
gitlab-runner registrations with runner authentication tokens
|
| services.buffyboard.settings.quirks.ignore_unused_terminals | If true, buffyboard won't automatically update the layout of a new terminal and
draw the keyboard, if the terminal is not opened by any process
|
| services.strongswan-swanctl.swanctl.connections.<name>.unique | Connection uniqueness policy to enforce
|
| services.athens.storage.s3.bucket | Bucket name for the S3 storage backend.
|
| services.varnish.listen.*.group | Group name who owns the socket file.
|
| services.cachix-watch-store.cacheName | Cachix binary cache name
|
| services.smokeping.owner | Real name of the owner of the instance
|
| services.weechat.sessionName | Name of the screen session for weechat.
|
| boot.binfmt.registrations.<name>.preserveArgvZero | Whether to pass the original argv[0] to the interpreter
|
| programs.nix-required-mounts.allowedPatterns.<name>.onFeatures | Which requiredSystemFeatures should trigger relaxation of the sandbox
|
| virtualisation.oci-containers.containers.<name>.login.username | Username for login.
|
| users.users.<name>.password | Specifies the (clear text) password for the user
|
| services.rss-bridge.virtualHost | Name of the nginx or caddy virtualhost to use and setup
|
| services.netatalk.extmap | File name extension mappings
|
| networking.interfaces.<name>.ipv6.addresses | List of IPv6 addresses that will be statically assigned to the interface.
|
| networking.interfaces.<name>.ipv4.addresses | List of IPv4 addresses that will be statically assigned to the interface.
|
| services.gitlab.databaseName | GitLab database name.
|
| virtualisation.fileSystems.<name>.enable | Whether to enable the filesystem mount.
|
| virtualisation.oci-containers.containers.<name>.hostname | The hostname of the container.
|
| hardware.nvidia-container-toolkit.device-name-strategy | Specify the strategy for generating device names,
passed to nvidia-ctk cdi generate
|
| services.jitsi-meet.interfaceConfig | Client-side web-app interface settings that override the defaults in interface_config.js
|
| boot.binfmt.registrations.<name>.magicOrExtension | The magic number or extension to match on.
|
| services.gancio.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.fluidd.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.akkoma.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.matomo.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.monica.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.grafana.settings.analytics.check_for_plugin_updates | When set to false, disables checking for new versions of installed plugins from https://grafana.com
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote_port | Remote UDP port for IKE communication
|
| systemd.network.networks.<name>.trivialLinkEqualizerConfig | Each attribute in this set specifies an option in the
[TrivialLinkEqualizer] section of the unit
|
| services.strongswan-swanctl.swanctl.connections.<name>.local_port | Local UDP port for IKE communication
|
| services.dependency-track.database.username | Username to use when connecting to an external or manually
provisioned database; has no effect when a local database is
automatically provisioned
|
| services.yarr.environmentFile | Environment file for specifying additional settings such as secrets
|
| services.smokeping.user | User that runs smokeping and (optionally) thttpd
|
| services.davfs2.davGroup | The group of the running mount.davfs daemon
|
| networking.interfaces.<name>.ipv4.routes.*.type | Type of the route
|
| networking.interfaces.<name>.ipv6.routes.*.type | Type of the route
|
| services.alerta.databaseName | Name of the database instance to connect to
|
| services.matrix-synapse.settings.url_preview_url_blacklist | Optional list of URL matches that the URL preview spider is
denied from accessing.
|
| services.foundationdb.tls | FoundationDB Transport Security Layer (TLS) settings.
|
| services.akkoma.initDb.enable | Whether to automatically initialise the database on startup
|
| virtualisation.fileSystems.<name>.fsType | Type of the file system
|
| users.mysql.database | The name of the database containing the users
|
| fileSystems.<name>.device | The device as passed to mount
|
| networking.fqdnOrHostName | Either the fully qualified domain name (FQDN), or just the host name if
it does not exist
|
| services.strongswan-swanctl.swanctl.connections.<name>.rekey_time | IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
does not re-check associated credentials
|
| programs.schroot.profiles.<name>.nssdatabases | System databases (as described in /etc/nsswitch.conf on GNU/Linux systems) to copy into the chroot from the host.
|
| users.mysql.pam.logging.table | The name of the table to which logs are written.
|
| services.athens.storage.minio.bucket | Bucket name for the minio storage backend.
|
| services.schleuder.listDefaults | Default settings for lists (list-defaults.yml)
|
| networking.firewall.interfaces.<name>.allowedUDPPorts | List of open UDP ports.
|
| services.prosody.httpFileShare.domain | Domain name for a http_file_share service.
|
| services.strongswan-swanctl.swanctl.pools | Section defining named pools
|
| services.strongswan-swanctl.swanctl.connections.<name>.dpd_timeout | Charon by default uses the normal retransmission mechanism and timeouts to
check the liveness of a peer, as all messages are used for liveness
checking
|
| services.strongswan-swanctl.swanctl.connections.<name>.ppk_required | Whether a Postquantum Preshared Key (PPK) is required for this connection
|
| services.smokeping.hostName | DNS name for the urls generated in the cgi.
|
| networking.bridges | This option allows you to define Ethernet bridge devices
that connect physical networks together
|
| containers.<name>.specialArgs | A set of special arguments to be passed to NixOS modules
|
| services.bird-lg.frontend.servers | Server name prefixes.
|
| services.ddclient.domains | Domain name(s) to synchronize.
|
| services.rke2.autoDeployCharts | Auto deploying Helm charts that are installed by the rke2 Helm controller
|
| services.prosody.uploadHttp.domain | Domain name for the http-upload service
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.path | Unix domain socket path to bind this listener to.
|
| systemd.network.networks.<name>.dhcpPrefixDelegationConfig | Each attribute in this set specifies an option in the
[DHCPPrefixDelegation] section of the unit
|
| networking.firewall.interfaces.<name>.allowedTCPPorts | List of TCP ports on which incoming connections are
accepted.
|
| networking.wireguard.interfaces.<name>.mtu | Set the maximum transmission unit in bytes for the wireguard
interface
|
| services.flexget.systemScheduler | When true, execute the runs via the flexget-runner.timer
|
| networking.openconnect.interfaces.<name>.user | Username to authenticate with.
|
| networking.supplicant.<name>.userControlled.group | Members of this group can control wpa_supplicant.
|
| security.dhparams.params | Diffie-Hellman parameters to generate
|
| services.yggdrasil.configFile | A file which contains JSON or HJSON configuration for yggdrasil
|
| services.tomcat.virtualHosts | List consisting of a virtual host name and a list of web applications to deploy on each virtual host
|
| services.outline.storage.region | AWS S3 region name.
|
| services.librespeed.secrets | Attribute set of filesystem paths
|
| services.veilid.settings.core.protected_store.allow_insecure_fallback | If we can't use system-provided secure storage, should we proceed anyway?
|
| services.victorialogs.basicAuthUsername | Basic Auth username used to protect VictoriaLogs instance by authorization
|
| services.strongswan-swanctl.swanctl.connections.<name>.keyingtries | Number of retransmission sequences to perform during initial
connect
|
| networking.wireguard.interfaces.<name>.peers.*.endpoint | Endpoint IP or hostname of the peer, followed by a colon,
and then a port number of the peer
|
| services.athens.index.mysql.database | Database name for the MySQL database.
|
| services.multipath.overrides | This section defines values for attributes that should override the
device-specific settings for all devices.
|
| services.soju.acceptProxyIP | Allow the specified IPs to act as a proxy
|
| services.avahi.nssmdns4 | Whether to enable the mDNS NSS (Name Service Switch) plug-in for IPv4
|
| networking.interfaces.<name>.ipv4.routes | List of extra IPv4 static routes that will be assigned to the interface.
If the route type is the default unicast, then the scope
is set differently depending on the value of networking.useNetworkd:
the script-based backend sets it to link, while networkd sets
it to global.
If you want consistency between the two implementations,
set the scope of the route manually with
networking.interfaces.eth0.ipv4.routes = [{ options.scope = "global"; }]
for example.
|
| services.pangolin.baseDomain | Your base fully qualified domain name (without any subdomains).
|
| services.vault.storageBackend | The name of the type of storage backend
|
| networking.ipips.<name>.encapsulation.limit | For an IPv6-based tunnel, the maximum number of nested
encapsulation to allow. 0 means no nesting, "none" unlimited.
|
| services.xserver.videoDriver | The name of the video driver for your graphics card
|
| services.grafana.settings.security.strict_transport_security | Set to true if you want to enable HTTP Strict-Transport-Security (HSTS) response header
|
| services.firezone.server.provision.accounts.<name>.features.flow_activities | Whether to enable the flow_activities feature for this account.
|
| services.firezone.server.provision.accounts.<name>.features.traffic_filters | Whether to enable the traffic_filters feature for this account.
|
| networking.wireguard.interfaces.<name>.peers.*.publicKey | The base64 public key of the peer.
|
| systemd.network.networks.<name>.hierarchyTokenBucketClassConfig | Each attribute in this set specifies an option in the
[HierarchyTokenBucketClass] section of the unit
|
| services.ncps.cache.lru.scheduleTimeZone | The name of the timezone to use for the cron schedule
|
| services.synergy.client.screenName | Use the given name instead of the hostname to identify
ourselves to the server.
|
| services.httpd.extraModules | Additional Apache modules to be used
|
| services.postgresql.ensureUsers.*.ensureClauses.login | Grants the user, created by the ensureUser attr, login permissions
|
| services.nextcloud.config.objectstore.s3.hostname | Required for some non-Amazon implementations.
|
| services.consul.interface.bind | The name of the interface to pull the bind_addr from.
|
| services.discourse.admin.fullName | The admin user's full name.
|
| networking.wireguard.interfaces.<name>.fwMark | Mark all wireguard packets originating from
this interface with the given firewall mark
|
| services.factorio.stateDirName | Name of the directory under /var/lib holding the server's data
|
| networking.wg-quick.interfaces.<name>.peers.*.allowedIPs | List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed
|
| services.borgmatic.configurations.<name>.repositories.*.path | Path to the repository
|
| networking.interfaces.<name>.ipv4.routes.*.prefixLength | Subnet mask of the network, specified as the number of
bits in the prefix (24).
|
| networking.interfaces.<name>.ipv6.routes.*.prefixLength | Subnet mask of the network, specified as the number of
bits in the prefix (64).
|
| services.zabbixWeb.httpd.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.<name>
|
| services.zabbixWeb.nginx.virtualHost | Nginx configuration can be done by adapting services.nginx.virtualHosts.<name>
|
| services.xserver.displayManager.lightdm.greeter.package | The LightDM greeter to login via
|
| services.nix-serve.secretKeyFile | The path to the file used for signing derivation data
|
| networking.vswitches.<name>.controllers | Specify the controller targets
|
| services.synergy.server.screenName | Use the given name instead of the hostname to identify
this screen in the configuration.
|
| services.influxdb2.provision.initialSetup.username | Primary username
|
| networking.interfaces.<name>.proxyARP | Turn on proxy_arp for this device
|
| users.extraUsers.<name>.hashedPassword | Specifies the hashed password for the user
|
| services.prometheus.exporters.pihole.piholeHostname | Hostname or address where to find the Pi-Hole webinterface
|
| services.shairport-sync.user | User account name under which to run shairport-sync
|
| virtualisation.fileSystems.<name>.stratis.poolUuid | UUID of the stratis pool that the fs is located in
This is only relevant if you are using stratis.
|
| containers.<name>.macvlans | The list of host interfaces from which macvlans will be
created
|
| services.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| services.heisenbridge.namespaces | Configure the 'namespaces' section of the registration.yml for the bridge and the server
|
| services.unpoller.influxdb.db | Database name
|
| services.slurm.dbdserver.dbdHost | Hostname of the machine where slurmdbd
is running (i.e. name returned by hostname -s).
|
| services.netbird.server.signal.domain | The domain name for the signal service.
|
| fileSystems.<name>.options | Options used to mount the file system
|
| fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| networking.wireguard.interfaces.<name>.table | The kernel routing table to add this interface's
associated routes to
|
| users.mysql.pam.updateTable | The name of the table used for password alteration
|
| services.keyd.keyboards | Configuration for one or more device IDs
|
| services.factorio.extraSettingsFile | File, which is dynamically applied to server-settings.json before
startup
|
| networking.wireguard.interfaces.<name>.preShutdown | Commands called before shutting down the interface.
|
| virtualisation.fileSystems.<name>.label | Label of the device
|
| networking.wireguard.interfaces.<name>.privateKeyFile | Private key file as generated by wg genkey.
|
| networking.sits.<name>.encapsulation.sourcePort | Source port when using UDP encapsulation
|
| services.influxdb2.provision.organizations.<name>.description | Optional description for the organization.
|
| services.borgmatic.configurations.<name>.repositories.*.label | Label to the repository
|
| services.smokeping.linkStyle | DNS name for the urls generated in the cgi.
|
| services.samba-wsdd.workgroup | Set workgroup name (default WORKGROUP).
|
| virtualisation.oci-containers.containers.<name>.serviceName | Systemd service name that manages the container
|
| networking.supplicant.<name>.userControlled.socketDir | Directory of sockets for controlling wpa_supplicant.
|
| services.agorakit.config | Agorakit configuration options to set in the
.env file
|
| services.prometheus.remoteWrite.*.sigv4 | Configures AWS Signature Version 4 settings.
|
| services.paperless.passwordFile | A file containing the superuser password
|
| services.autorandr.matchEdid | Match displays based on edid instead of name
|
| services.corosync.clusterName | Name of the corosync cluster.
|
| services.prefect.databaseName | database name for postgres only
|
| fileSystems.<name>.neededForBoot | If set, this file system will be mounted in the initial ramdisk
|
| services.jigasi.defaultJvbRoomName | Name of the default JVB room that will be joined if no special header is included in SIP invite.
|
| services.cjdns.ETHInterface.bind | Bind to this device for native ethernet operation.
all is a pseudo-name which will try to connect to all devices.
|
| networking.wireguard.interfaces.<name>.postShutdown | Commands called after shutting down the interface.
|
| networking.firewall.interfaces.<name>.allowedUDPPortRanges | Range of open UDP ports.
|
| services.stash.settings.video_file_naming_algorithm | Hash algorithm to use for generated file naming
|
| services.k3s.charts | Packaged Helm charts that are linked to /var/lib/rancher/k3s/server/static/charts before k3s starts
|
| services.strongswan-swanctl.swanctl.connections.<name>.local_addrs | Local address(es) to use for IKE communication
|
| boot.loader.limine.additionalFiles | A set of files to be copied to /boot
|
| boot.loader.refind.additionalFiles | A set of files to be copied to /boot
|
| networking.wireless.networks.<name>.priority | By default, all networks will get same priority group (0)
|
| systemd.network.networks.<name>.deficitRoundRobinSchedulerConfig | Each attribute in this set specifies an option in the
[DeficitRoundRobinScheduler] section of the unit
|
| networking.wg-quick.interfaces.<name>.generatePrivateKeyFile | Automatically generate a private key with
wg genkey, at the privateKeyFile location.
|
| hardware.fw-fanctrl.config.strategies.<name>.fanSpeedUpdateFrequency | How often the fan speed should be updated in seconds
|
| virtualisation.fileSystems.<name>.mountPoint | Location where the file system will be mounted
|
| virtualisation.interfaces.<name>.vlan | VLAN to which the network interface is connected.
|
| services.strongswan-swanctl.swanctl.connections.<name>.childless | Use childless IKE_SA initiation (allow, prefer, force or never)
|
| containers.<name>.allowedDevices | A list of device nodes to which the containers has access to.
|
| virtualisation.oci-containers.containers.<name>.dependsOn | Define which other containers this one depends on
|
| fonts.fontconfig.localConf | System-wide customization file contents, has higher priority than
defaultFonts settings.
|
| services.clamav.clamonacc.enable | Whether to enable ClamAV on-access scanner
|
| services.matrix-synapse.settings.registration_shared_secret | If set, allows registration by anyone who also has the shared
secret, even if registration is otherwise disabled
|
| services.xserver.displayManager.session | List of sessions supported with the command used to start each
session
|
| users.extraUsers.<name>.password | Specifies the (clear text) password for the user
|
| networking.firewall.interfaces.<name>.allowedTCPPortRanges | A range of TCP ports on which incoming connections are
accepted.
|
| services.prosody.muc.*.tombstoneExpiry | This settings controls how long a tombstone is considered
valid
|
| services.mastodon.user | User under which mastodon runs
|
| services.misskey.reverseProxy.host | The fully qualified domain name to bind to
|
| networking.wireguard.interfaces.<name>.extraOptions | Extra options to append to the interface section
|
| services.syncplay.useACMEHost | If set, use NixOS-generated ACME certificate with the specified name for TLS
|
| services.supybot.plugins | Attribute set of additional plugins that will be symlinked to the
plugin subdirectory
|
| services.cloudlog.database.user | MySQL user name.
|
| services.mattermost.preferNixConfig | If both mutableConfig and this option are set, the Nix configuration
will take precedence over any settings configured in the server
console.
|
| services.lldap.settings.force_ldap_user_pass_reset | Force reset of the admin password
|
| networking.wireguard.interfaces.<name>.privateKey | Base64 private key generated by wg genkey
|
| services.strongswan-swanctl.swanctl.connections.<name>.reauth_time | Time to schedule IKE reauthentication
|
| services.dovecot2.imapsieve.mailbox.*.from | Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox..name when the message originates from the indicated mailbox
|
| containers.<name>.forwardPorts.*.hostPort | Source port of the external interface on host
|
| services.gammu-smsd.backend.sql.database | Database name to store sms data
|
| hardware.fw-fanctrl.config.strategies.<name>.movingAverageInterval | Interval (seconds) of the last temperatures to use to calculate the average temperature
|
| services.bacula-fd.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.bacula-sd.tls.allowedCN | Common name attribute of allowed peer certificates
|
| services.resolved.llmnr | Controls Link-Local Multicast Name Resolution support
(RFC 4795) on the local host
|
| networking.interfaces.<name>.ipv4.routes.*.options | Other route options
|
| networking.interfaces.<name>.ipv6.routes.*.options | Other route options
|
| virtualisation.allInterfaces.<name>.vlan | VLAN to which the network interface is connected.
|
| networking.openconnect.interfaces.<name>.autoStart | Whether this VPN connection should be started automatically.
|
| security.tpm2.tssUser | Name of the tpm device-owner and service user, set if applyUdevRules is
set.
|
| virtualisation.fileSystems.<name>.encrypted.blkDev | Location of the backing encrypted device.
|
| services.strongswan-swanctl.swanctl.connections.<name>.send_certreq | Send certificate request payloads to offer trusted root CA certificates to
the peer
|
| virtualisation.fileSystems.<name>.autoFormat | If the device does not currently contain a filesystem (as
determined by blkid), then automatically
format it with the filesystem type specified in
fsType
|
| services.strongswan-swanctl.swanctl.connections.<name>.proposals | A proposal is a set of algorithms
|
| services.shairport-sync.group | Group account name under which to run shairport-sync
|
| services.rspamd.overrides | Overridden configuration files, written into /etc/rspamd/override.d/{name}.
|
| services.freshrss.virtualHost | Name of the caddy/nginx virtualhost to use and setup.
|
| services.usbrelayd.clientName | Name, your client connects as.
|
| services.bookstack.config | BookStack configuration options to set in the
.env file
|
| services.wgautomesh.settings.upnp_forward_external_port | Public port number to try to redirect to this machine's Wireguard
daemon using UPnP IGD.
|
| services.radicle.httpd.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.resources | List of HTTP resources to serve on this listener.
|
| programs.starship.presets | Presets files to be merged with settings in order.
|
| containers.<name>.timeoutStartSec | Time for the container to start
|
| boot.binfmt.registrations.<name>.recognitionType | Whether to recognize executables by magic number or extension.
|
| services.bacula-dir.tls.allowedCN | Common name attribute of allowed peer certificates
|
| systemd.network.networks.<name>.genericRandomEarlyDetectionConfig | Each attribute in this set specifies an option in the
[GenericRandomEarlyDetection] section of the unit
|
| services.asterisk.useTheseDefaultConfFiles | Sets these config files to the default content
|
| services.dovecot2.imapsieve.mailbox.*.causes | Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox..name when one of the listed IMAPSIEVE causes apply
|
| services.autossh.sessions.*.user | Name of the user the AutoSSH session should run as
|
| networking.sits.<name>.encapsulation.type | Select the encapsulation type:
-
6in4: the IPv6 packets are encapsulated using the
6in4 protocol (formerly known as SIT, RFC 4213);
-
gue: the IPv6 packets are encapsulated in UDP packets
using the Generic UDP Encapsulation (GUE) scheme;
-
foo: the IPv6 packets are encapsulated in UDP packets
using the Foo over UDP (FOU) scheme.
|
| services.miredo.interfaceName | Name of the network tunneling interface.
|
| services.prometheus.exporters.py-air-control.deviceHostname | The hostname of the air purification device from which to scrape the metrics.
|
| services.mqtt2influxdb.influxdb.username | Username for InfluxDB login.
|
| services.pgbouncer.settings.pgbouncer.ignore_startup_parameters | By default, PgBouncer allows only parameters it can keep track of in startup packets:
client_encoding, datestyle, timezone and standard_conforming_strings
|
| services.matrix-continuwuity.settings.global.allow_announcements_check | If enabled, continuwuity will send a simple GET request periodically to
https://continuwuity.org/.well-known/continuwuity/announcements for any new announcements made.
|
| virtualisation.fileSystems.<name>.autoResize | If set, the filesystem is grown to its maximum size before
being mounted. (This is typically the size of the containing
partition.) This is currently only supported for ext2/3/4
filesystems that are mounted during early boot.
|
| networking.wireguard.interfaces.<name>.allowedIPsAsRoutes | Determines whether to add allowed IPs as routes or not.
|
| services.restic.server.privateRepos | Enable private repos
|
| services.mattermost.siteName | Name of this Mattermost site.
|
| services.prometheus.remoteRead.*.basic_auth.username | HTTP username
|
| boot.loader.systemd-boot.extraEntries | Any additional entries you want added to the systemd-boot menu
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.filters.*.name | Name of the filter
|
| networking.vswitches.<name>.supportedOpenFlowVersions | Supported versions to enable on this switch.
|
| services.airsonic.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.cloudlog.virtualHost | Name of the nginx virtualhost to use and setup
|
| virtualisation.oci-containers.containers.<name>.imageFile | Path to an image file to load before running the image
|
| services.coder.database.database | Name of database.
|
| networking.openconnect.interfaces.<name>.gateway | Gateway server to connect to.
|
| services.strongswan-swanctl.swanctl.authorities.<name>.cert_uri_base | Defines the base URI for the Hash and URL feature supported by
IKEv2
|
| networking.interfaces.<name>.tempAddress | When IPv6 is enabled with SLAAC, this option controls the use of
temporary address (aka privacy extensions) on this
interface
|
| services.samba.winbindd.enable | Whether to enable Samba's winbindd, which provides a number of services
to the Name Service Switch capability found in most modern C libraries,
to arbitrary applications via PAM and ntlm_auth and to Samba itself.
|
| services.athens.storage.mongo.defaultDBName | Name of the mongo database.
|
| services.prometheus.exporters.nextcloud.username | Username for connecting to Nextcloud
|
| containers.<name>.restartIfChanged | Whether the container should be restarted during a NixOS
configuration switch if its definition has changed.
|
| networking.ipips.<name>.encapsulation.type | Select the encapsulation type:
-
ipip to create an IPv4 within IPv4 tunnel (RFC 2003).
-
4in6 to create a 4in6 tunnel (RFC 2473);
-
ip6ip6 to create an IPv6 within IPv6 tunnel (RFC 2473);
For encapsulating IPv6 within IPv4 packets, see
the ad-hoc networking.sits option.
|
| services.youtrack.virtualHost | Name of the nginx virtual host to use and setup
|
| systemd.network.networks.<name>.deficitRoundRobinSchedulerClassConfig | Each attribute in this set specifies an option in the
[DeficitRoundRobinSchedulerClass] section of the unit
|
| services.guacamole-server.host | The host name or IP address the server should listen to.
|
| services.caddy.adapter | Name of the config adapter to use
|
| services.grafana.settings.database.locking_attempt_timeout_sec | For mysql, if the migrationLocking feature toggle is set,
specify the time (in seconds) to wait before failing to lock the database for the migrations.
|
| services.komodo-periphery.extraSettings | Extra settings to add to the generated TOML config.
|
| services.portunus.ldap.searchUserName | The login name of the search user
|
| containers.<name>.allowedDevices.*.node | Path to device node
|
| services.nullmailer.config.defaulthost | The content of this attribute is appended to any address that
is missing a host name
|
| services.bluemap.webserverSettings | Settings for the webserver.conf file, usually not required.
See upstream docs.
|
| services.postsrsd.configurePostfix | Whether to configure the required settings to use postsrsd in the local Postfix instance.
|
| containers.<name>.interfaces | The list of interfaces to be moved into the container.
|
| services.unpoller.unifi.defaults.user | Unifi service user name.
|
| services.packagekit.vendorSettings | Additional settings passed straight through to Vendor.conf
|
| services.wiki-js.stateDirectoryName | Name of the directory in /var/lib.
|
| services.jibri.xmppEnvironments.<name>.disableCertificateVerification | Whether to skip validation of the server's certificate.
|
| services.davis.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.movim.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.slskd.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| networking.openconnect.interfaces.<name>.privateKey | Private key to authenticate with.
|
| services.cryptpad.configureNginx | Configure Nginx as a reverse proxy for Cryptpad
|
| containers.<name>.forwardPorts | List of forwarded ports from host to container
|
| services.prometheus.remoteWrite.*.basic_auth.username | HTTP username
|
| services.bitwarden-directory-connector-cli.ldap.username | The user to authenticate as.
|
| services.sanoid.datasets.<name>.pre_snapshot_script | Script to run before taking snapshot.
|
| services.bitwarden-directory-connector-cli.ldap.hostname | The host the LDAP is accessible on.
|
| virtualisation.fileSystems.<name>.overlay.workdir | The path to the workdir
|
| networking.supplicant.<name>.userControlled.enable | Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli
|
| services.tailscale.derper.domain | Domain name under which the derper server is reachable.
|
| boot.isNspawnContainer | Whether the machine is running in an nspawn container
|
| networking.interfaces.<name>.ipv4.addresses.*.address | IPv4 address of the interface
|
| networking.interfaces.<name>.ipv6.addresses.*.address | IPv6 address of the interface
|
| services.borgmatic.configurations.<name>.repositories | A required list of local or remote repositories with paths and
optional labels (which can be used with the --repository flag to
select a repository)
|
| containers.<name>.localAddress | The IPv4 address assigned to the interface in the container
|
| services.snipe-it.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.netbird.useRoutingFeatures | Enables settings required for NetBird's routing features: Network Resources, Network Routes & Exit Nodes
|
| services.mysql.ensureUsers | Ensures that the specified users exist and have at least the ensured permissions
|
| services.httpd.customLogFormat | Defines a custom Apache HTTPD access log format string
|
| services.grafana.settings.security.data_source_proxy_whitelist | Define a whitelist of allowed IP addresses or domains, with ports,
to be used in data source URLs with the Grafana data source proxy
|
| services.agorakit.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.fediwall.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.kanboard.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.librenms.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.dolibarr.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.pixelfed.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.mainsail.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| networking.networkmanager.ensureProfiles.profiles.<name>.connection.id | This is the name that will be displayed by NetworkManager and GUIs.
|
| networking.wg-quick.interfaces.<name>.peers.*.presharedKeyFile | File pointing to preshared key as generated by wg genpsk
|
| systemd.network.networks.<name>.fairQueueingControlledDelayConfig | Each attribute in this set specifies an option in the
[FairQueueingControlledDelay] section of the unit
|
| networking.openconnect.interfaces.<name>.protocol | Protocol to use.
|
| containers.<name>.localAddress6 | The IPv6 address assigned to the interface in the container
|
| services.knot-resolver.enable | Whether to enable knot-resolver (version 6) domain name server
|
| services.privoxy.inspectHttps | Whether to configure Privoxy to inspect HTTPS requests, meaning all
encrypted traffic will be filtered as well
|
| services.minetest-server.world | Name of the world to use
|
| services.stargazer.routes.*.route | Route section name
|
| boot.zfs.forceImportAll | Forcibly import all ZFS pool(s)
|
| services.jitsi-videobridge.xmppConfigs.<name>.disableCertificateVerification | Whether to skip validation of the server's certificate.
|
| services.firezone.server.provision.accounts.<name>.features.internet_resource | Whether to enable the internet_resource feature for this account.
|
| services.firezone.server.provision.accounts.<name>.features.policy_conditions | Whether to enable the policy_conditions feature for this account.
|
| services.rathole.credentialsFile | Path to a TOML file to be merged with the settings
|
| services.slurm.controlMachine | The short hostname of the machine where SLURM control functions are
executed (i.e. the name returned by the command "hostname -s", use "tux001"
rather than "tux001.my.com").
|
| virtualisation.interfaces.<name>.assignIP | Automatically assign an IP address to the network interface using the same scheme as
virtualisation.vlans.
|
| networking.vswitches | This option allows you to define Open vSwitches that connect
physical networks together
|
| services.gitlab.registry.serviceName | GitLab container registry service name.
|
| services.sanoid.templates.<name>.pre_snapshot_script | Script to run before taking snapshot.
|
| virtualisation.fileSystems.<name>.encrypted.enable | The block device is backed by an encrypted one, adds this device as a initrd luks entry.
|
| networking.wg-quick.interfaces.<name>.peers.*.presharedKey | Base64 preshared key generated by wg genpsk
|
| services.tailscale.authKeyFile | A file containing the auth key
|
| users.mysql.pam.logging.msgColumn | The name of the column in the log table to which the description
of the performed operation is stored.
|
| boot.binfmt.registrations.<name>.wrapInterpreterInShell | Whether to wrap the interpreter in a shell script
|
| services.radicle.privateKeyFile | Absolute file path to an SSH private key,
usually generated by rad auth
|
| virtualisation.allInterfaces.<name>.assignIP | Automatically assign an IP address to the network interface using the same scheme as
virtualisation.vlans.
|
| services.strongswan-swanctl.swanctl.connections.<name>.mediation_peer | Identity under which the peer is registered at the mediation server, that
is, the IKE identity the other end of this connection uses as its local
identity on its connection to the mediation server
|
| users.users.<name>.initialHashedPassword | Specifies the initial hashed password for the user, i.e. the
hashed password assigned if the user does not already
exist
|
| networking.interfaces.<name>.ipv4.addresses.*.prefixLength | Subnet mask of the interface, specified as the number of
bits in the prefix (24).
|
| networking.interfaces.<name>.ipv6.addresses.*.prefixLength | Subnet mask of the interface, specified as the number of
bits in the prefix (64).
|
| services.nominatim.enable | Whether to enable nominatim
|
| services.gancio.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.akkoma.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.fluidd.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.matomo.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.monica.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| programs.tsmClient.servers | Server definitions ("stanzas")
for the client system-options file
|
| hardware.cpu.amd.ryzen-smu.enable | Whether to enable ryzen_smu, a linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors
|
| security.ipa.shells | List of shells which binaries should be installed to /bin/
|
| services.postfix-tlspol.configurePostfix | Whether to configure the required settings to use postfix-tlspol in the local Postfix instance.
|
| services.thinkfan.fans.*.query | The query string used to match one or more fans: can be
a fullpath to the temperature file (single fan) or a fullpath
to a driver directory (multiple fans).
When multiple fans match, the query can be restricted using the
name or indices options.
|
| _module.args | Additional arguments passed to each module in addition to ones
like lib, config,
and pkgs, modulesPath
|
| services.samba.usershares.group | Name of the group members of which will be allowed to create usershares
|
| boot.initrd.luks.devices | The encrypted disk that should be opened before the root
filesystem is mounted
|
| services.slurm.dbdserver.storageUser | Database user name.
|
| services.rustus.storage.s3_region | S3 region name.
|
| users.users.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.writefreely.host | The public host name to serve.
|
| services.vault-agent.instances | Attribute set of vault-agent instances
|
| services.roundcube.enable | Whether to enable roundcube
|
| services.xserver.xrandrHeads.*.output | The output name of the monitor, as shown by
xrandr(1) invoked without arguments.
|
| networking.wireguard.interfaces.<name>.peers.*.allowedIPs | List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed
|
| services.nginx.recommendedTlsSettings | Enable recommended TLS settings.
|
| boot.binfmt.registrations.<name>.matchCredentials | Whether to launch with the credentials and security
token of the binary, not the interpreter (e.g. setuid
bit)
|
| services.multipath.devices.*.prio | The name of the path priority routine
|
| services.stash.settings.create_image_clip_from_videos | Create Image Clips from Video extensions when Videos are disabled in Library
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.x_forwarded | Use the X-Forwarded-For (XFF) header as the client IP and not the
actual client IP.
|
| services.foundationdb.locality | FoundationDB locality settings.
|
| services.windmill.database.urlPath | Path to the file containing the database url windmill should connect to
|
| virtualisation.fileSystems.<name>.device | The device as passed to mount
|
| services.xserver.displayManager.sx.enable | Whether to enable the "sx" pseudo-display manager, which allows users
to start manually via the "sx" command from a vt shell
|
| services.cntlm.netbios_hostname | The hostname of your machine.
|
| services.cadvisor.storageDriverDb | Cadvisord storage driver database name.
|
| programs.nix-required-mounts.allowedPatterns.<name>.unsafeFollowSymlinks | Whether to enable Instructs the hook to mount the symlink targets as well, when any of
the paths contain symlinks
|
| services.prometheus.scrapeConfigs.*.basic_auth.username | HTTP username
|
| services.davis.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.slskd.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.portunus.dex.oidcClients | List of OIDC clients
|
| services.movim.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| security.wrappers.<name>.capabilities | A comma-separated list of capability clauses to be given to the
wrapper program
|
| services.zfs.autoSnapshot.flags | Flags to pass to the zfs-auto-snapshot command
|
| services.librenms.environmentFile | File containing env-vars to be substituted into the final config
|
| virtualisation.credentials.<name>.source | Source file on the host containing the credential data.
|
| xdg.portal.config | Sets which portal backend should be used to provide the implementation
for the requested interface
|
| services.ntopng.redis.createInstance | Local Redis instance name
|
| services.strongswan-swanctl.swanctl.connections.<name>.fragmentation | Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
fragmentation)
|
| services.athens.index.postgres.database | Database name for the Postgres database.
|
| services.nextcloud.autoUpdateApps.startAt | When to run the update
|
| services.multipath.pathGroups.*.alias | The name of the multipath device
|
| systemd.mounts.*.wantedBy | Units that want (i.e. depend on) this unit
|
| services.snipe-it.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| users.mysql.pam.logging.timeColumn | The name of the column in the log table to which the timestamp of the
log entry is stored.
|
| services.victoriatraces.basicAuthUsername | Basic Auth username used to protect VictoriaTraces instance by authorization
|
| services.avahi.nssmdns6 | Whether to enable the mDNS NSS (Name Service Switch) plug-in for IPv6
|
| services.anuko-time-tracker.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| virtualisation.fileSystems.<name>.overlay.upperdir | The path to the upperdir
|
| containers.<name>.nixpkgs | A path to the nixpkgs that provide the modules, pkgs and lib for evaluating the container
|
| users.mysql.pam.logging.pidColumn | The name of the column in the log table to which the pid of the
process utilising the pam_mysql authentication
service is stored.
|
| services.postfix.networksStyle | Name of standard way of trusted network specification to use,
leave blank if you specify it explicitly or if you want to use
default (localhost-only).
|
| services.displayManager.dms-greeter.configFiles | List of DankMaterialShell configuration files to copy into the greeter
data directory at /var/lib/dms-greeter
|
| networking.openconnect.interfaces.<name>.passwordFile | File containing the password to authenticate with
|
| services.outline.storage.uploadBucketName | Name of the bucket where uploads should be stored.
|
| virtualisation.fileSystems.<name>.overlay.lowerdir | The list of path(s) to the lowerdir(s)
|
| services.multipath.pathGroups.*.array | The DNS name of the storage array
|
| networking.wireguard.interfaces.<name>.generatePrivateKeyFile | Automatically generate a private key with
wg genkey, at the privateKeyFile location.
|
| services.sanoid.datasets.<name>.post_snapshot_script | Script to run after taking snapshot.
|
| services.firezone.server.provision.accounts.<name>.features.self_hosted_relays | Whether to enable the self_hosted_relays feature for this account.
|
| services.zabbixWeb.nginx.virtualHost.http3 | Whether to enable the HTTP/3 protocol
|
| services.apache-kafka.configFiles.serverProperties | Kafka server.properties configuration file path
|
| hardware.nvidia.nvidiaSettings | Whether to enable nvidia-settings, NVIDIA's GUI configuration tool
.
|
| services.rutorrent.nginx.enable | Whether to enable nginx virtual host management
|
| virtualisation.fileSystems.<name>.options | Options used to mount the file system
|
| virtualisation.fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| virtualisation.credentials.<name>.text | Text content of the credential
|
| networking.supplicant | Interfaces for which to start wpa_supplicant
|
| services.pcscd.ignoreReaderNames | List of reader name patterns for the PCSC daemon to ignore
|
| systemd.network.networks.<name>.stochasticFairnessQueueingConfig | Each attribute in this set specifies an option in the
[StochasticFairnessQueueing] section of the unit
|
| services.vikunja.database.database | Database name.
|
| services.znc.useLegacyConfig | Whether to propagate the legacy options under
services.znc.confOptions.* to the znc config
|
| virtualisation.fileSystems.<name>.neededForBoot | If set, this file system will be mounted in the initial ramdisk
|
| networking.dhcpcd.setHostname | Whether to set the machine hostname based on the information
received from the DHCP server.
The hostname will be changed only if the current one is
the empty string, localhost or nixos
|
| services.openvscode-server.host | The host name or IP address the server should listen to.
|
| services.biboumi.credentialsFile | Path to a configuration file to be merged with the settings
|
| users.extraUsers.<name>.initialHashedPassword | Specifies the initial hashed password for the user, i.e. the
hashed password assigned if the user does not already
exist
|
| services.karakeep.extraEnvironment | Environment variables to pass to Karakaeep
|
| services.icecream.scheduler.netName | Network name for the icecream scheduler
|
| services.prometheus.exporters.artifactory.artiUsername | Username for authentication against JFrog Artifactory API.
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.resources.*.compress | Whether synapse should compress HTTP responses to clients that support it
|
| services.bookstack.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.listmonk.database.mutableSettings | Database settings will be reset to the value set in this module if this is not enabled
|
| services.borgbackup.jobs | Deduplicating backups using BorgBackup
|
| services.pomerium.useACMEHost | If set, use a NixOS-generated ACME certificate with the specified name
|
| services.discourse.backendSettings | Additional settings to put in the
discourse.conf file
|
| users.users.<name>.initialPassword | Specifies the initial password for the user, i.e. the
password assigned if the user does not already exist
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.namespaces.names | Namespace name.
|
| services.gotify.stateDirectoryName | The name of the directory below /var/lib where
gotify stores its runtime data.
|
| services.trilium-server.instanceName | Instance name used to distinguish between different instances
|
| services.lasuite-meet.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| services.veilid.settings.core.protected_store.always_use_insecure_storage | Should we bypass any attempt to use system-provided secure storage?
|
| services.nginx.recommendedGzipSettings | Enable recommended gzip settings
|
| services.akkoma.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.gancio.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.fluidd.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.monica.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.matomo.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.sanoid.templates.<name>.post_snapshot_script | Script to run after taking snapshot.
|
| i18n.inputMethod.fcitx5.plasma6Support | Use qt6 versions of fcitx5 packages
|
| networking.wireguard.interfaces.<name>.socketNamespace | The pre-existing network namespace in which the
WireGuard interface is created, and which retains the socket even if the
interface is moved via interfaceNamespace
|
| users.mysql.pam.passwordColumn | The name of the column that contains a (encrypted) password string.
|
| services.outline.oidcAuthentication.usernameClaim | Specify which claims to derive user information from
|
| services.sunshine.applications | Configuration for applications to be exposed to Moonlight
|
| services.stargazer.routes | Routes that Stargazer should server
|
| services.buildbot-worker.adminMessage | Name of the administrator of this worker
|
| services.thanos.rule.web.prefix-header | Name of HTTP request header used for dynamic prefixing of UI links and
redirects
|
| users.extraUsers.<name>.hashedPasswordFile | The full path to a file that contains the hash of the user's
password
|
| services.cassandra.clusterName | The name of the cluster
|
| services.nextcloud.configureRedis | Whether to configure Nextcloud to use the recommended Redis settings for small instances.
The Nextcloud system check recommends to configure either Redis or Memcache for file lock caching.
The notify_push app requires Redis to be configured
|
| services.prometheus.alertmanagerGotify.metrics.username | The username used to access your metrics.
|
| services.nagios.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.moodle.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.linux-enable-ir-emitter.device | IR camera device to depend on
|
| services.radicle.httpd.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.lavalink.plugins.*.configName | The name of the plugin to use as the key for the plugin configuration.
|
| containers.<name>.forwardPorts.*.protocol | The protocol specifier for port forwarding between host and container
|
| services.rke2.charts | Packaged Helm charts that are linked to /var/lib/rancher/rke2/server/static/charts before rke2 starts
|
| services.nginx.recommendedZstdSettings | Enable recommended zstd settings
|
| security.agnos.settings.accounts.*.certificates.*.fullchain_output_file | Output path for the full chain including the acquired certificate
|
| virtualisation.oci-containers.containers.<name>.cmd | Commandline arguments to pass to the image's entrypoint.
|
| console.font | The font used for the virtual consoles
|
| services.dependency-track.nginx.domain | The domain name under which to set up the virtual host.
|
| services.prometheus.remoteRead.*.url | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.crossfire-server.configFiles | Text to append to the corresponding configuration files
|
| networking.openconnect.interfaces.<name>.extraOptions | Extra config to be appended to the interface config
|
| services.nginx.recommendedUwsgiSettings | Whether to enable recommended uwsgi settings if a vhost does not specify the option manually.
|
| services.nginx.recommendedProxySettings | Whether to enable recommended proxy settings if a vhost does not specify the option manually.
|
| programs.captive-browser.enable | Whether to enable captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings.
|
| services.cloudflare-ddns.wafLists | List of WAF IP Lists to manage, in the format account-id/list-name.
(Experimental feature as of cloudflare-ddns 1.14.0).
|
| services.traefik.environmentFiles | Files to load as an environment file just before Traefik starts
|
| services.icingaweb2.pool | Name of existing PHP-FPM pool that is used to run Icingaweb2
|
| services.dendrite.settings.global.trusted_third_party_id_servers | Lists of domains that the server will trust as identity
servers to verify third party identifiers such as phone
numbers and email addresses
|
| services.grafana.settings.security.disable_initial_admin_creation | Disable creation of admin user on first start of Grafana.
|
| services.rosenpass.defaultDevice | Name of the network interface to use for all peers by default.
|
| virtualisation.sharedDirectories.<name>.target | The mount point of the directory inside the virtual machine
|
| virtualisation.sharedDirectories.<name>.source | The path of the directory to share, can be a shell variable
|
| virtualisation.oci-containers.containers.<name>.podman.user | The user under which the container should run.
|
| virtualisation.fileSystems.<name>.encrypted.keyFile | Path to a keyfile used to unlock the backing encrypted
device
|
| services.libreswan.policies | A set of policies to apply to the IPsec connections.
The policy name must match the one of connection it needs to apply to.
|
| services.mattermost.mutableConfig | Whether the Mattermost config.json is writeable by Mattermost
|
| services.nextcloud-spreed-signaling.backends | A list of backends from which clients are allowed to connect from
|
| services.printing.cups-pdf.instances | Permits to raise one or more cups-pdf instances
|
| services.jirafeau.nginxConfig.http3 | Whether to enable the HTTP/3 protocol
|
| virtualisation.oci-containers.containers.<name>.image | OCI image to run.
|
| services.mautrix-meta.instances | Configuration of multiple mautrix-meta instances.
services.mautrix-meta.instances.facebook and services.mautrix-meta.instances.instagram
come preconfigured with network.mode, appservice.id, bot username, display name and avatar.
|
| services.multipath.devices.*.vendor | Regular expression to match the vendor name
|
| networking.wireguard.interfaces.<name>.peers.*.presharedKeyFile | File pointing to preshared key as generated by wg genpsk
|
| virtualisation.oci-containers.containers.<name>.user | Override the username or UID (and optionally groupname or GID) used
in the container.
|
| programs.zsh.enable | Whether to configure zsh as an interactive shell
|
| services.prometheus.alertmanagerGotify.metrics.namespace | The namescape of the metrics.
|
| services.thanos.query.web.prefix-header | Name of HTTP request header used for dynamic prefixing of UI links and
redirects
|
| services.zabbixWeb.httpd.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| virtualisation.oci-containers.containers.<name>.pull | Image pull policy for the container
|
| services.matrix-synapse.settings.url_preview_ip_range_blacklist | List of IP address CIDR ranges that the URL preview spider is denied
from accessing.
|
| services.nullmailer.config.defaultdomain | The content of this attribute is appended to any host name that
does not contain a period (except localhost), including defaulthost
and idhost
|
| services.matrix-synapse.settings.url_preview_ip_range_whitelist | List of IP address CIDR ranges that the URL preview spider is allowed
to access even if they are specified in url_preview_ip_range_blacklist.
|
| services.opencloud.environment | Extra environment variables to set for the service
|
| services.sanoid.datasets.<name>.process_children_only | Whether to only snapshot child datasets if recursing.
|
| services.victoriametrics.basicAuthUsername | Basic Auth username used to protect VictoriaMetrics instance by authorization
|
| boot.iscsi-initiator.target | Name of the iSCSI target to boot from.
|
| services.headscale.settings.tls_letsencrypt_challenge_type | Type of ACME challenge to use, currently supported types:
HTTP-01 or TLS-ALPN-01.
|
| services.oauth2-proxy.nginx.virtualHosts.<name>.allowed_email_domains | List of email domains to allow access to this vhost, or null to allow all.
|
| networking.wireguard.interfaces.<name>.peers.*.presharedKey | Base64 preshared key generated by wg genpsk
|
| services.lldap.environment | Environment variables passed to the service
|
| networking.openconnect.interfaces.<name>.certificate | Certificate to authenticate with.
|
| services.prometheus.remoteWrite.*.url | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.xserver.displayManager.lightdm.greeters.gtk.indicators | List of allowed indicator modules to use for the lightdm gtk
greeter panel
|
| users.extraUsers.<name>.initialPassword | Specifies the initial password for the user, i.e. the
password assigned if the user does not already exist
|
| services.kanboard.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.librenms.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.dolibarr.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.fediwall.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.agorakit.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.pixelfed.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.mainsail.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.pgbackrest.repos | An attribute set of repositories as described in:
https://pgbackrest.org/configuration.html#section-repository
Each repository defaults to set repo-host to the attribute's name
|
| services.opencloud.environmentFile | An environment file as defined in systemd.exec(5)
|
| services.calibre-web.options.reverseProxyAuth.header | Auth proxy header name.
|
| services.librenms.database.database | Name of the database on the MySQL/MariaDB server.
|
| virtualisation.oci-containers.containers.<name>.labels | Labels to attach to the container at runtime.
|
| services.radicle.httpd.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.matrix-synapse.workers.<name>.worker_listeners.*.bind_addresses | IP addresses to bind the listener to.
|
| virtualisation.credentials.<name>.mechanism | The mechanism used to pass the credential to the VM.
|
| services.subsonic.listenAddress | The host name or IP address on which to bind Subsonic
|
| services.datadog-agent.checks | Configuration for all Datadog checks
|
| services.prometheus.exporters.pve.user | User name under which the pve exporter shall be run.
|
| services.prometheus.exporters.nut.user | User name under which the nut exporter shall be run.
|
| services.prometheus.exporters.kea.user | User name under which the kea exporter shall be run.
|
| services.prometheus.exporters.sql.user | User name under which the sql exporter shall be run.
|
| services.prometheus.exporters.zfs.user | User name under which the zfs exporter shall be run.
|
| services.prometheus.exporters.lnd.user | User name under which the lnd exporter shall be run.
|
| services.nginx.recommendedBrotliSettings | Enable recommended brotli settings
|
| services.prometheus.remoteRead.*.tls_config | Configures the remote read request's TLS settings.
|
| services.limesurvey.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.<name>
|
| services.limesurvey.httpd.virtualHost | Apache configuration can be done by adapting services.httpd.virtualHosts.<name>
|
| services.limesurvey.nginx.virtualHost | Nginx configuration can be done by adapting services.nginx.virtualHosts.<name>
|
| services.thinkfan.sensors.*.query | The query string used to match one or more sensors: can be
a fullpath to the temperature file (single sensor) or a fullpath
to a driver directory (multiple sensors).
When multiple sensors match, the query can be restricted using the
name or indices options.
|
| services.mastodon.configureNginx | Configure nginx as a reverse proxy for mastodon
|
| services.consul.interface.advertise | The name of the interface to pull the advertise_addr from.
|
| networking.bonds.<name>.xmit_hash_policy | DEPRECATED, use driverOptions
|
| security.tpm2.fapi.profileName | Name of the default cryptographic profile chosen from the profile_dir directory.
|
| virtualisation.oci-containers.containers.<name>.devices | List of devices to attach to this container.
|
| services.firezone.server.provision.accounts.<name>.features.multi_site_resources | Whether to enable the multi_site_resources feature for this account.
|
| networking.wireguard.interfaces.<name>.interfaceNamespace | The pre-existing network namespace the WireGuard
interface is moved to
|
| containers.<name>.forwardPorts.*.containerPort | Target port of container
|
| services.weblate.configurePostgresql | Whether to enable and configure a local PostgreSQL server by creating a user and database for weblate
|
| services.multipath.devices.*.product | Regular expression to match the product name
|
| services.onlyoffice.postgresName | The name of database OnlyOffice should use.
|
| services.prometheus.exporters.snmp.user | User name under which the snmp exporter shall be run.
|
| services.prometheus.exporters.bind.user | User name under which the bind exporter shall be run.
|
| services.prometheus.exporters.ipmi.user | User name under which the ipmi exporter shall be run.
|
| services.prometheus.exporters.flow.user | User name under which the flow exporter shall be run.
|
| services.prometheus.exporters.nats.user | User name under which the nats exporter shall be run.
|
| services.prometheus.exporters.mail.user | User name under which the mail exporter shall be run.
|
| services.prometheus.exporters.ping.user | User name under which the ping exporter shall be run.
|
| services.prometheus.exporters.bird.user | User name under which the bird exporter shall be run.
|
| services.prometheus.exporters.ebpf.user | User name under which the ebpf exporter shall be run.
|
| services.prometheus.exporters.json.user | User name under which the json exporter shall be run.
|
| services.prometheus.exporters.mqtt.user | User name under which the mqtt exporter shall be run.
|
| services.prometheus.exporters.node.user | User name under which the node exporter shall be run.
|
| services.prometheus.exporters.knot.user | User name under which the knot exporter shall be run.
|
| services.rsnapshot.extraConfig | rsnapshot configuration option in addition to the defaults from
rsnapshot and this module
|
| virtualisation.oci-containers.containers.<name>.workdir | Override the default working directory for the container.
|
| networking.nameservers | The list of nameservers
|
| services.librenms.distributedPoller.enable | Configure this LibreNMS instance as a distributed poller
|
| virtualisation.oci-containers.containers.<name>.autoStart | When enabled, the container is automatically started on boot
|
| services.prometheus.exporters.php-fpm.user | User name under which the php-fpm exporter shall be run.
|
| services.prometheus.remoteWrite.*.tls_config | Configures the remote write request's TLS settings.
|
| virtualisation.oci-containers.containers.<name>.login.registry | Registry where to login to.
|
| services.tailscale.useRoutingFeatures | Enables settings required for Tailscale's routing features like subnet routers and exit nodes
|
| boot.initrd.secrets | Secrets to append to the initrd
|
| services.stash.settings.show_one_time_moved_notification | Whether a small notification to inform the user that Stash will no longer show a terminal window, and instead will be available in the tray
|
| services.tabby.model | Specify the model that tabby will use to generate completions
|
| services.zabbixWeb.nginx.virtualHost.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.nominatim.database.superUser | Postgresql database superuser used to create Nominatim database and
import data
|
| services._3proxy.resolution | Use this option to configure name resolution and DNS caching.
|
| services.athens.singleFlight.redisSentinel.masterName | Name of the sentinel master server.
|
| services.anuko-time-tracker.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| environment.wvdial.pppDefaults | Default ppp settings for wvdial.
|
| services.athens.storage.azureblob.accountName | Account name for the Azure Blob storage backend.
|
| services.agorakit.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.librenms.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.kanboard.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.dolibarr.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.fediwall.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.pixelfed.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.mainsail.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.nginx.experimentalZstdSettings | Enable alpha quality zstd module with recommended settings
|
| services.munin-node.extraPlugins | Additional Munin plugins to activate
|
| virtualisation.oci-containers.containers.<name>.autoRemoveOnStop | Automatically remove the container when it is stopped or killed
|
| boot.kernelPatches | A list of additional patches to apply to the kernel
|
| services.prometheus.exporters.frr.user | User name under which the frr exporter shall be run
|
| services.homebridge.uiSettings.log.service | Name of the systemd service to log to
|
| services.prometheus.exporters.zfs.pools | Name of the pool(s) to collect, repeat for multiple pools (default: all pools).
|
| virtualisation.oci-containers.containers.<name>.networks | Networks to attach the container to
|
| services.prometheus.exporters.nginx.user | User name under which the nginx exporter shall be run.
|
| services.prometheus.exporters.kafka.user | User name under which the kafka exporter shall be run.
|
| services.prometheus.exporters.redis.user | User name under which the redis exporter shall be run.
|
| services.prometheus.exporters.fritz.user | User name under which the fritz exporter shall be run.
|
| services.prometheus.exporters.idrac.user | User name under which the idrac exporter shall be run.
|
| services.prometheus.exporters.jitsi.user | User name under which the jitsi exporter shall be run.
|
| services.prometheus.exporters.dmarc.user | User name under which the dmarc exporter shall be run.
|
| services.prometheus.exporters.v2ray.user | User name under which the v2ray exporter shall be run.
|
| services.nghttpx.backends.*.params.affinity | If "ip" is given, client IP based session affinity is
enabled
|
| programs.chromium.initialPrefs | Initial preferences are used to configure the browser for the first run
|
| services.nghttpx.frontends.*.params.sni-fwd | When performing a match to select a backend server, SNI host
name received from the client is used instead of the request
host
|
| services.tailscale.interfaceName | The interface name for tunnel traffic
|
| systemd.network.networks.<name>.enhancedTransmissionSelectionConfig | Each attribute in this set specifies an option in the
[EnhancedTransmissionSelection] section of the unit
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".url.host | Domain name of the instance.
|
| services.airsonic.listenAddress | The host name or IP address on which to bind Airsonic
|
| virtualisation.oci-containers.containers.<name>.login.passwordFile | Path to file containing password.
|
| services.dysnomia.extraContainerProperties | An attribute set providing additional container settings in addition to the default properties
|
| services.dnscrypt-proxy2.upstreamDefaults | Whether to base the config declared in services.dnscrypt-proxy2.settings on the upstream example config (https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml)
Disable this if you want to declare your dnscrypt config from scratch.
|
| services.bookstack.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.documize.stateDirectoryName | The name of the directory below /var/lib/private
where documize runs in and stores, for example, backups.
|
| virtualisation.oci-containers.containers.<name>.extraOptions | Extra options for podman run.
|
| hardware.nvidia-container-toolkit.enable-hooks | List of hooks to enable when generating the CDI specification
|
| hardware.display.edid.linuxhw | Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID
Attribute names will be mapped to EDID filenames <NAME>.bin
|
| services.qbittorrent.serverConfig | Free-form settings mapped to the qBittorrent.conf file in the profile
|
| boot.zfs.extraPools | Name or GUID of extra ZFS pools that you wish to import during boot
|
| services.maubot.settings.plugin_databases.postgres_max_conns_per_plugin | Maximum number of connections per plugin instance.
|
| services.mjolnir.pantalaimon | pantalaimon options (enables E2E Encryption support)
|
| programs.regreet.font.package | The package that provides the font given in the name option.
|
| services.crowdsec-firewall-bouncer.createRulesets | Whether to have the module create the appropriate firewall configuration
based on the bouncer settings
|
| services.borgmatic.configurations.<name>.source_directories | List of source directories and files to backup
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.grafana.settings.users.user_invite_max_lifetime_duration | The duration in time a user invitation remains valid before expiring
|
| services.prometheus.exporters.statsd.user | User name under which the statsd exporter shall be run.
|
| services.prometheus.exporters.dnssec.user | User name under which the dnssec exporter shall be run.
|
| services.prometheus.exporters.script.user | User name under which the script exporter shall be run.
|
| services.prometheus.exporters.mysqld.user | User name under which the mysqld exporter shall be run.
|
| services.prometheus.exporters.deluge.user | User name under which the deluge exporter shall be run.
|
| services.prometheus.exporters.domain.user | User name under which the domain exporter shall be run.
|
| services.prometheus.exporters.fastly.user | User name under which the fastly exporter shall be run.
|
| services.prometheus.exporters.restic.user | User name under which the restic exporter shall be run.
|
| services.prometheus.exporters.pihole.user | User name under which the pihole exporter shall be run.
|
| services.prometheus.exporters.shelly.user | User name under which the shelly exporter shall be run.
|
| services.prometheus.exporters.rspamd.user | User name under which the rspamd exporter shall be run.
|
| services.prometheus.exporters.tibber.user | User name under which the tibber exporter shall be run.
|
| services.zabbixWeb.nginx.virtualHost.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.consul-template.instances | Attribute set of consul-template instances
|
| virtualisation.oci-containers.containers.<name>.preRunExtraOptions | Extra options for podman that go before the run argument.
|
| services.anuko-time-tracker.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| networking.wg-quick.interfaces.<name>.peers.*.persistentKeepalive | This is optional and is by default off, because most
users will not need it
|
| services.icingaweb2.virtualHost | Name of the nginx virtualhost to use and setup
|
| services.grafana.settings.security.strict_transport_security_preload | Set to true to enable HSTS preloading option
|
| services.prometheus.scrapeConfigs.*.tls_config | Configures the scrape request's TLS settings.
|
| services.postgresqlBackup.backupAll | Backup all databases using pg_dumpall
|
| services.matrix-tuwunel.stateDirectory | The name of the directory under /var/lib/ where the database will be stored
|
| services.bitwarden-directory-connector-cli.ldap | Options to configure the LDAP connection
|
| services.bitwarden-directory-connector-cli.sync | Options to configure what gets synced
|
| services.jirafeau.nginxConfig.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services._3proxy.resolution.nscache | Set name cache size for IPv4.
|
| hardware.nvidia-container-toolkit.disable-hooks | List of hooks to disable when generating the CDI specification
|
| networking.wireguard.interfaces.<name>.dynamicEndpointRefreshSeconds | Periodically refresh the endpoint hostname or address for all peers
|
| virtualisation.fileSystems.<name>.overlay.useStage1BaseDirectories | If enabled, lowerdir, upperdir and workdir will be prefixed with /sysroot
|
| services.prometheus.exporters.nvidia-gpu.user | User name under which the nvidia-gpu exporter shall be run.
|
| services.archisteamfarm.ipcSettings | Settings to write to IPC.config
|
| services.bookstack.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.headscale.settings.ephemeral_node_inactivity_timeout | Time before an inactive ephemeral node is deleted.
|
| virtualisation.oci-containers.containers.<name>.log-driver | Logging driver for the container
|
| programs.regreet.theme.package | The package that provides the theme given in the name option.
|
| services.prometheus.scrapeConfigs.*.label_name_length_limit | Per-scrape limit on length of labels name that will be accepted for a sample
|
| virtualisation.oci-containers.containers.<name>.volumes | List of volumes to attach to this container
|
| services.mediawiki.httpd.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.unpoller.unifi.controllers.*.user | Unifi service user name.
|
| hardware.openrazer.batteryNotifier | Settings for device battery notifications.
|
| services.prometheus.scrapeConfigs.*.azure_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.exporters.systemd.user | User name under which the systemd exporter shall be run.
|
| services.prometheus.exporters.bitcoin.user | User name under which the bitcoin exporter shall be run.
|
| services.prometheus.exporters.varnish.user | User name under which the varnish exporter shall be run.
|
| services.prometheus.exporters.apcupsd.user | User name under which the apcupsd exporter shall be run.
|
| services.prometheus.exporters.ecoflow.user | User name under which the ecoflow exporter shall be run.
|
| services.prometheus.exporters.dovecot.user | User name under which the dovecot exporter shall be run.
|
| services.prometheus.exporters.process.user | User name under which the process exporter shall be run.
|
| services.prometheus.exporters.dnsmasq.user | User name under which the dnsmasq exporter shall be run.
|
| services.prometheus.exporters.libvirt.user | User name under which the libvirt exporter shall be run.
|
| services.prometheus.exporters.sabnzbd.user | User name under which the sabnzbd exporter shall be run.
|
| services.prometheus.exporters.mongodb.user | User name under which the mongodb exporter shall be run.
|
| services.prometheus.exporters.postfix.user | User name under which the postfix exporter shall be run.
|
| services.prometheus.exporters.klipper.user | User name under which the klipper exporter shall be run.
|
| services.prometheus.exporters.unbound.user | User name under which the unbound exporter shall be run.
|
| virtualisation.oci-containers.containers.<name>.privileged | Give extended privileges to the container
|
| virtualisation.oci-containers.containers.<name>.entrypoint | Override the default entrypoint of the image.
|
| services.prometheus.exporters.bitcoin.rpcUser | RPC user name.
|
| services.limesurvey.nginx.virtualHost.http3 | Whether to enable the HTTP/3 protocol
|
| services.nginx.recommendedOptimisation | Enable recommended optimisation settings.
|
| services.prometheus.scrapeConfigs.*.dns_sd_configs.*.names | A list of DNS SRV record names to be queried.
|
| containers.<name>.allowedDevices.*.modifier | Device node access modifier
|
| networking.networkmanager.ensureProfiles.profiles.<name>.connection.type | The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.
|
| services.jirafeau.nginxConfig.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| virtualisation.oci-containers.containers.<name>.podman.sdnotify | Determines how podman should notify systemd that the unit is ready
|
| systemd.automounts.*.wantedBy | Units that want (i.e. depend on) this unit
|
| services.prometheus.exporters.ecoflow.ecoflowDevicesPrettyNamesFile | File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...}
The key/value map of custom names for your devices
|
| i18n.extraLocaleSettings | A set of additional system-wide locale settings other than LANG
which can be configured with i18n.defaultLocale
|
| services.stash.settings.dangerous_allow_public_without_auth | Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/
|
| services.postgresql.ensureUsers | Ensures that the specified users exist
|
| services.athens.storage.azureblob.containerName | Container name for the Azure Blob storage backend.
|
| networking.hostName | The name of the machine
|
| services._3proxy.resolution.nscache6 | Set name cache size for IPv6.
|
| image.repart.verityStore.partitionIds.esp | Specify the attribute name of the ESP.
|
| services.tarsnap.keyfile | The keyfile which associates this machine with your tarsnap
account
|
| services._3proxy.resolution.nserver | List of nameservers to use
|
| services.prometheus.exporters.py-air-control.user | User name under which the py-air-control exporter shall be run.
|
| services.postfixadmin.enable | Whether to enable postfixadmin
|
| services.firefox-syncserver.database.host | Database host name. localhost is treated specially and inserts
systemd dependencies, other hostnames or IP addresses of the local machine do not.
|
| services.sourcehut.hg.postgresql.database | PostgreSQL database name for the hg.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.misskey.reverseProxy.webserver.nginx.http3 | Whether to enable the HTTP/3 protocol
|
| services.nullmailer.config.remotes | A list of remote servers to which to send each message
|
| virtualisation.oci-containers.containers.<name>.environment | Environment variables to set for this container.
|
| networking.wireguard.interfaces.<name>.peers.*.dynamicEndpointRefreshSeconds | Periodically re-execute the wg utility every
this many seconds in order to let WireGuard notice DNS / hostname
changes
|
| systemd.network.config.routeTables | Defines route table names as an attrset of name to number
|
| programs.regreet.iconTheme.package | The package that provides the icon theme given in the name option.
|
| services.sourcehut.man.postgresql.database | PostgreSQL database name for the man.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.git.postgresql.database | PostgreSQL database name for the git.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.hub.postgresql.database | PostgreSQL database name for the hub.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.prometheus.exporters.influxdb.user | User name under which the influxdb exporter shall be run.
|
| services.prometheus.exporters.opnsense.user | User name under which the opensense exporter shall be run.
|
| services.prometheus.exporters.smartctl.user | User name under which the smartctl exporter shall be run.
|
| services.prometheus.exporters.fritzbox.user | User name under which the fritzbox exporter shall be run.
|
| services.prometheus.exporters.mikrotik.user | User name under which the mikrotik exporter shall be run.
|
| services.prometheus.exporters.nginxlog.user | User name under which the nginxlog exporter shall be run.
|
| services.prometheus.exporters.postgres.user | User name under which the postgres exporter shall be run.
|
| services.prometheus.exporters.unpoller.user | User name under which the unpoller exporter shall be run.
|
| services.prometheus.exporters.graphite.user | User name under which the graphite exporter shall be run.
|
| services.prometheus.exporters.blackbox.user | User name under which the blackbox exporter shall be run.
|
| services.prometheus.exporters.keylight.user | User name under which the keylight exporter shall be run.
|
| services.prometheus.exporters.collectd.user | User name under which the collectd exporter shall be run.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.triton_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.certspotter.watchlist | Domain names to watch
|
| services.fluent-bit.configurationFile | Fluent Bit configuration
|
| services.prometheus.exporters.chrony.user | User name under which the chrony exporter shall be run
|
| services.miniupnpd.externalInterface | Name of the external interface.
|
| services.limesurvey.httpd.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.grafana.settings.security.content_security_policy_report_only | Set to true to add the Content-Security-Policy-Report-Only header to your requests
|
| services.limesurvey.virtualHost.servedFiles | This option provides a simple way to serve individual, static files.
This option has been deprecated and will be removed in a future
version of NixOS
|
| services.prometheus.exporters.rtl_433.user | User name under which the rtl_433 exporter shall be run.
|
| virtualisation.oci-containers.containers.<name>.imageStream | Path to a script that streams the desired image on standard output
|
| services.transmission.credentialsFile | Path to a JSON file to be merged with the settings
|
| services.pipewire.wireplumber.extraScripts | Additional scripts for WirePlumber to be used by configuration files
|
| services.sourcehut.todo.postgresql.database | PostgreSQL database name for the todo.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.meta.postgresql.database | PostgreSQL database name for the meta.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| networking.wireguard.interfaces.<name>.peers.*.persistentKeepalive | This is optional and is by default off, because most
users will not need it
|
| services.prometheus.exporters.postfix.systemd.unit | Name of the postfix systemd unit.
|
| services.pds.environmentFiles | File to load environment variables from
|
| virtualisation.oci-containers.containers.<name>.environmentFiles | Environment files for this container.
|
| services.sanoid.datasets.<name>.no_inconsistent_snapshot | Whether to take a snapshot if the pre script fails
|
| services.journaldriver.logName | Configures the name of the target log in Stackdriver Logging
|
| services.nextcloud-spreed-signaling.hostName | The host name to bind the nginx virtual host to, if
config.services.nextcloud-spreed-signaling.configureNginx is set to true.
|
| containers.<name>.ephemeral | Runs container in ephemeral mode with the empty root filesystem at boot
|
| services.gmediarender.friendlyName | A "friendly name" for identifying the endpoint.
|
| services.grafana.settings.security.disable_brute_force_login_protection | Set to true to disable brute force login protection.
|
| networking.wireguard.interfaces.<name>.peers.*.dynamicEndpointRefreshRestartSeconds | When the dynamic endpoint refresh that is configured via
dynamicEndpointRefreshSeconds exits (likely due to a failure),
restart that service after this many seconds
|
| virtualisation.appvm.enable | This enables AppVMs and related virtualisation settings.
|
| services.archisteamfarm.bots | Bots name and configuration.
|
| services.grafana.settings.security.strict_transport_security_subdomains | Set to true to enable HSTS includeSubDomains option
|
| services.cassandra.listenAddress | Address or interface to bind to and tell other Cassandra nodes
to connect to
|
| services.prometheus.exporters.imap-mailstat.user | User name under which the imap-mailstat exporter shall be run.
|
| users.mysql.pam.statusColumn | The name of the column or an SQL expression that indicates the status of
the user
|
| services.nextcloud.config.objectstore.s3.bucket | The name of the S3 bucket.
|
| services.sourcehut.lists.postgresql.database | PostgreSQL database name for the lists.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.paste.postgresql.database | PostgreSQL database name for the paste.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.sourcehut.pages.postgresql.database | PostgreSQL database name for the pages.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.prometheus.exporters.ecoflow.scrapingInterval | Scrapping interval in seconds
|
| services.xserver.desktopManager.surf-display.screensaverSettings | Screensaver settings, see man 1 xset for possible options.
|
| services.prometheus.alertmanager-ntfy.extraConfigFiles | Config files to merge into the settings defined in services.prometheus.alertmanager-ntfy.settings
|
| programs.ryzen-monitor-ng.enable | Whether to enable ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver
|
| services.influxdb2.provision.initialSetup.bucket | Primary bucket name
|
| services.sanoid.templates.<name>.no_inconsistent_snapshot | Whether to take a snapshot if the pre script fails
|
| virtualisation.oci-containers.containers.<name>.ports | Network ports to publish from the container to the outer host
|
| image.repart.verityStore.partitionIds.store | Specify the attribute name of the store partition.
|
| services.home-assistant.extraComponents | List of components that have their dependencies included in the package
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.exporters.surfboard.user | User name under which the surfboard exporter shall be run.
|
| services.prometheus.exporters.tailscale.user | User name under which the tailscale exporter shall be run.
|
| services.prometheus.exporters.wireguard.user | User name under which the wireguard exporter shall be run.
|
| services.prometheus.exporters.rasdaemon.user | User name under which the rasdaemon exporter shall be run.
|
| services.prometheus.exporters.borgmatic.user | User name under which the borgmatic exporter shall be run.
|
| services.prometheus.exporters.smokeping.user | User name under which the smokeping exporter shall be run.
|
| services.prometheus.exporters.pgbouncer.user | User name under which the pgbouncer exporter shall be run.
|
| services.prometheus.exporters.nextcloud.user | User name under which the nextcloud exporter shall be run.
|
| services.prometheus.exporters.postfix.systemd.slice | Name of the postfix systemd slice
|
| services.prometheus.exporters.mongodb.collectAll | Enable all collectors
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.name_filter | Specify a name filter (works as a LIKE) to apply on the server listing request.
|
| services.prometheus.exporters.junos-czerwonk.user | User name under which the junos-czerwonk exporter shall be run.
|
| containers.<name>.privateUsers | Whether to give the container its own private UIDs/GIDs space (user namespacing)
|
| virtualisation.sharedDirectories.<name>.securityModel | The security model to use for this share:
passthrough: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root)
mapped-xattr: some of the file attributes like uid, gid, mode bits and link target are stored as file attributes
mapped-file: the attributes are stored in the hidden .virtfs_metadata directory
|
| services.prometheus.exporters.mailman3.user | User name under which the mailman3 exporter shall be run.
|
| services.limesurvey.nginx.virtualHost.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| nixpkgs.flake.source | The path to the nixpkgs sources used to build the system
|
| services.sourcehut.builds.postgresql.database | PostgreSQL database name for the builds.sr.ht service,
used if services.sourcehut.postgresql.enable is true.
|
| services.pgmanage.connections | pgmanage requires at least one PostgreSQL server be defined
|
| services.umami.createPostgresqlDatabase | Whether to automatically create the database for Umami using PostgreSQL
|
| users.ldap.daemon.rootpwmoddn | The distinguished name to use to bind to the LDAP server
when the root user tries to modify a user's password.
|
| programs.regreet.cursorTheme.package | The package that provides the cursor theme given in the name option.
|
| services.journaldriver.logStream | Configures the name of the Stackdriver Logging log stream into
which to write journald entries
|
| services.nullmailer.config.adminaddr | If set, all recipients to users at either "localhost" (the literal string)
or the canonical host name (from the me control attribute) are remapped to this address
|
| services.foundationdb.tls.allowedPeers | "Peer verification string"
|
| specialisation.<name>.inheritParentConfig | Include the entire system's configuration
|
| services.misskey.reverseProxy.webserver.nginx.http3_hq | Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests
|
| services.zfs.autoReplication.localFilesystem | Local ZFS filesystem from which snapshots should be sent
|
| services.limesurvey.nginx.virtualHost.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| swapDevices.*.encrypted.label | Label of the unlocked encrypted device
|
| services.prometheus.scrapeConfigs.*.scaleway_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.exporters.buildkite-agent.user | User name under which the buildkite-agent exporter shall be run.
|
| virtualisation.lxc.bridgeConfig | This is the config file for override lxc-net bridge default settings.
|
| services.icingaweb2.modulePackages | Name-package attrset of Icingaweb 2 modules packages to enable
|
| services.prometheus.exporters.scaphandre.user | User name under which the scaphandre exporter shall be run.
|
| services.prometheus.exporters.storagebox.user | User name under which the storagebox exporter shall be run.
|
| services.glance.environmentFile | Path to an environment file as defined in systemd.exec(5)
|
| services.crowdsec-firewall-bouncer.secrets.apiKeyPath | Path to the API key to authenticate with a local CrowdSec API
|
| networking.ucarp.upscript | Command to run after become master, the interface name, virtual address
and optional extra parameters are passed as arguments.
|
| security.doas.extraRules.*.setEnv | Keep or set the specified variables
|
| containers | A set of NixOS system configurations to be run as lightweight
containers
|
| containers.<name>.networkNamespace | Takes the path to a file representing a kernel network namespace that the container
shall run in
|
| services.misskey.reverseProxy.webserver.nginx.acmeFallbackHost | Host which to proxy requests to if ACME challenge is not found
|
| services.rutorrent.nginx.exposeInsecureRPC2mount | If you do not enable one of the rpc or httprpc plugins you need to expose an RPC mount through scgi using this option
|
| services.pufferpanel.enable | Whether to enable PufferPanel game management server
|
| services.desktopManager.gnome.flashback.customSessions.*.wmLabel | The name of the window manager to show in the session chooser.
|
| services.prometheus.exporters.exportarr-lidarr.user | User name under which the exportarr-lidarr exporter shall be run.
|
| services.prometheus.exporters.exportarr-sonarr.user | User name under which the exportarr-sonarr exporter shall be run.
|
| services.prometheus.exporters.exportarr-radarr.user | User name under which the exportarr-radarr exporter shall be run.
|
| services.prometheus.exporters.exportarr-bazarr.user | User name under which the exportarr-bazarr exporter shall be run.
|
| services.dependency-track.database.databaseName | Database name to use when connecting to an external or
manually provisioned database; has no effect when a local
database is automatically provisioned
|
| hardware.display.edid.modelines | Attribute set of XFree86 Modelines automatically converted
and exposed as edid/<name>.bin files in initrd
|
| boot.loader.systemd-boot.windows | Make Windows bootable from systemd-boot
|
| hardware.firmware | List of packages containing firmware files
|
| services.yggdrasil.denyDhcpcdInterfaces | Disable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.sanoid.datasets.<name>.force_post_snapshot_script | Whether to run the post script if the pre script fails
|
| services.bluesky-pds.environmentFiles | File to load environment variables from
|
| system.nixos.label | NixOS version name to be used in the names of generated
outputs and boot labels
|
| services.mosquitto.listeners.*.omitPasswordAuth | Omits password checking, allowing anyone to log in with any user name unless
other mandatory authentication methods (eg TLS client certificates) are configured.
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.username | Credentials are used to authenticate the requests to Uyuni API.
|
| services.matrix-alertmanager.matrixRooms | Combination of Alertmanager receiver(s) and rooms for the bot to join
|
| services.prometheus.exporters.exportarr-readarr.user | User name under which the exportarr-readarr exporter shall be run.
|
| services.prometheus.exporters.artifactory.user | User name under which the artifactory exporter shall be run.
|
| programs.kubeswitch.commandName | The name of the command to use
|
| services.sanoid.templates.<name>.force_post_snapshot_script | Whether to run the post script if the pre script fails
|
| services.prometheus.exporters.mqtt.prometheusPrefix | Prefix added to the metric name.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowCN | Allow client if common name appears in the list.
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.kuma_sd_configs.*.basic_auth.username | HTTP username
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowOU | Allow client if organizational unit name appears in the list.
|
| services.mqtt2influxdb.influxdb.database | Name of the InfluxDB database.
|
| hardware.trackpoint.device | The device name of the trackpoint
|
| programs.captive-browser.browser | The shell (/bin/sh) command executed once the proxy starts
|
| services.xserver.desktopManager.gnome.flashback.customSessions.*.wmLabel | The name of the window manager to show in the session chooser.
|
| image.repart.verityStore.partitionIds.store-verity | Specify the attribute name of the store's dm-verity hash partition.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowDNS | Allow client if DNS subject alternative name appears in the list.
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.allowURI | Allow client if URI subject alternative name appears in the list.
|
| services.postgresql.ensureUsers.*.ensureDBOwnership | Grants the user ownership to a database with the same name
|
| services.datadog-agent.extraIntegrations | Extra integrations from the Datadog core-integrations
repository that should be built and included
|
| services.grafana.settings.security.strict_transport_security_max_age_seconds | Sets how long a browser should cache HSTS in seconds
|
| containers.<name>.additionalCapabilities | Grant additional capabilities to the container
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.prometheus.exporters.exportarr-prowlarr.user | User name under which the exportarr-prowlarr exporter shall be run.
|
| boot.loader.grub.fsIdentifier | Determines how GRUB will identify devices when generating the
configuration file
|
| virtualisation.graphics | Whether to run QEMU with a graphics window, or in nographic mode
|
| services.chatgpt-retrieval-plugin.qdrantCollection | name of the qdrant collection used to store documents.
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.username | Consul username
|
| services.prometheus.scrapeConfigs.*.uyuni_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.exporters.modemmanager.user | User name under which the modemmanager exporter shall be run.
|
| services.multipath.devices.*.user_friendly_names | If set to "yes", using the bindings file /etc/multipath/bindings
to assign a persistent and unique alias to the multipath, in the
form of mpath
|
| services.crowdsec-firewall-bouncer.registerBouncer.bouncerName | Name to register the bouncer as to the CrowdSec API
|
| services.strongswan-swanctl.swanctl.connections | Section defining IKE connection configurations, each in its own subsection
with an arbitrary yet unique name
|
| services.outline.oidcAuthentication.displayName | Display name for OIDC authentication.
|
| programs.msmtp.accounts | Named accounts and their respective configurations
|
| services.journaldriver.googleCloudProject | Configures the name of the Google Cloud project to which to
forward journald logs
|
| services.strongswan-swanctl.swanctl.authorities | Section defining complementary attributes of certification authorities, each
in its own subsection with an arbitrary yet unique name
|
| services.mosquitto.listeners.*.authPlugins.*.denySpecialChars | Automatically disallow all clients using #
or + in their name/id.
|
| services.taskserver.organisations | An attribute set where the keys name the organisation and the values
are a set of lists of users and
groups.
|
| services.prometheus.exporters.restic.rcloneConfig | Configuration for the rclone remote being used for backup
|
| users.ldap.bind.distinguishedName | The distinguished name to bind to the LDAP server with
|
| boot.loader.grub.configurationName | GRUB entry name instead of default.
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.postgresql.ensureUsers.*.ensureClauses.inherit | Grants the user created inherit permissions
|
| services.transmission.performanceNetParameters | Whether to enable tweaking of kernel parameters
to open many more connections at the same time
|
| networking.wireless.userControlled.enable | Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli
|
| networking.wireless.userControlled | Allow users of the wpa_supplicant group to control wpa_supplicant
through wpa_gui or wpa_cli
|
| networking.ucarp.downscript | Command to run after become backup, the interface name, virtual address
and optional extra parameters are passed as arguments.
|
| virtualisation.rosetta.enable | Whether to enable Rosetta support
|
| services.prometheus.scrapeConfigs.*.eureka_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.linode_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.docker_sd_configs.*.basic_auth.username | HTTP username
|
| virtualisation.libvirtd.onBoot | Specifies the action to be done to / on the guests when the host boots
|
| hardware.nvidia.prime.offload.offloadCmdMainProgram | Specifies the CLI name of the hardware.nvidia.prime.offload.enableOffloadCmd
convenience script for offloading programs to an nvidia device.
|
| networking.nat.externalInterface | The name of the external network interface.
|
| programs.pay-respects.runtimeRules | List of rules to be added to /etc/xdg/pay-respects/rules.
pay-respects will read the contents of these generated rules to recommend command corrections
|
| services.prometheus.exporters.unpoller.controllers.*.user | Unifi service user name.
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.tls_config.server_name | ServerName extension to indicate the name of the server.
http://tools.ietf.org/html/rfc4366#section-3.1
|
| services.postgresql.ensureUsers.*.ensureClauses.createdb | Grants the user, created by the ensureUser attr, createdb permissions
|
| boot.loader.grub.mirroredBoots.*.efiBootloaderId | The id of the bootloader to store in efi nvram
|
| boot.initrd.compressor | The compressor to use on the initrd image
|
| services.bitwarden-directory-connector-cli.sync.groupNameAttribute | Attribute for a name of group.
|
| specialisation.<name>.configuration | Arbitrary NixOS configuration
|
| services.mautrix-telegram.environmentFile | File containing environment variables to be passed to the mautrix-telegram service,
in which secret tokens can be specified securely by defining values for e.g.
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN,
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN,
MAUTRIX_TELEGRAM_TELEGRAM_API_ID,
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH and optionally
MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN
|
| services.mqtt2influxdb.points.*.measurement | Name of the measurement
|
| services.prometheus.scrapeConfigs.*.hetzner_sd_configs.*.basic_auth.username | HTTP username
|
| virtualisation.containerd.configFile | Path to containerd config file
|
| services.prometheus.exporters.wireguard.wireguardConfig | Path to the Wireguard Config to
add the peer's name to the stats of a peer
|
| services.changedetection-io.environmentFile | Securely pass environment variables to changedetection-io
|
| services.influxdb2.provision.initialSetup.organization | Primary organization name
|
| services.prometheus.exporters.mqtt.zigbee2MqttAvailability | Whether to enable Normalize sensor name for device availability metric added by Zigbee2MQTT..
|
| services.stash.settings.security_tripwire_accessed_from_public_internet | Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/
|
| services.postgresql.ensureUsers.*.ensureClauses.bypassrls | Grants the user, created by the ensureUser attr, replication permissions
|
| networking.networkmanager.enable | Whether to use NetworkManager to obtain an IP address and other
configuration for all network interfaces that are not manually
configured
|
| services.postgresql.ensureUsers.*.ensureClauses.superuser | Grants the user, created by the ensureUser attr, superuser permissions
|
| services.prometheus.scrapeConfigs.*.marathon_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.puppetdb_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.exporters.pgbouncer.connectionEnvFile | File that must contain the environment variable
PGBOUNCER_EXPORTER_CONNECTION_STRING which is set to the connection
string used by pgbouncer
|
| networking.dhcpcd.denyInterfaces | Disable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| security.tpm2.tctiEnvironment.tabrmdConf | Configuration part of the tabrmd TCTI, like the D-Bus bus name
|
| boot.loader.systemd-boot.sortKey | The sort key used for the NixOS bootloader entries
|
| programs.opengamepadui.powerstation.enable | Whether to enable Run PowerStation service for TDP control and performance settings.
.
|
| services.prometheus.scrapeConfigs.*.http_sd_configs.*.tls_config | Configures the scrape request's TLS settings.
|
| networking.dhcpcd.allowInterfaces | Enable the DHCP client for any interface whose name matches
any of the shell glob patterns in this list
|
| services.prometheus.exporters.pgbouncer.connectionString | Connection string for accessing pgBouncer
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.username | username is required if using Identity V2 API
|
| qt.platformTheme | Selects the platform theme to use for Qt applications
|
| hardware.printers.ensurePrinters | Will regularly ensure that the given CUPS printers are configured as declared here
|
| security.tpm2.tctiEnvironment.interface | The name of the TPM command transmission interface (TCTI) library to
use.
|
| services.postgresql.ensureUsers.*.ensureClauses.createrole | Grants the user, created by the ensureUser attr, createrole permissions
|
| services.postgresql.ensureUsers.*.ensureClauses.replication | Grants the user, created by the ensureUser attr, replication permissions
|
| hardware.block.defaultSchedulerExclude | Device name pattern to exclude from default scheduler assignment
through config.hardware.block.defaultScheduler and
config.hardware.block.defaultSchedulerRotational
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.domain_name | At most one of domain_id and domain_name must be provided if using username
with Identity V3
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.basic_auth.username | HTTP username
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.namespaces | Optional namespace discovery
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.project_name | The project_id and project_name fields are optional for the Identity V2 API
|
| services.prometheus.scrapeConfigs.*.consul_sd_configs.*.tls_config | Configures the Consul request's TLS settings.
|
| services.prometheus.scrapeConfigs.*.dockerswarm_sd_configs.*.basic_auth.username | HTTP username
|
| virtualisation.lxd.recommendedSysctlSettings | Enables various settings to avoid common pitfalls when
running containers requiring many file operations
|
| virtualisation.libvirtd.nss.enableGuest | This option enables the newer libvirt_guest NSS module
|
| virtualisation.rosetta.mountTag | The VirtioFS mount tag for the Rosetta runtime, exposed by the host's virtualisation software
|
| services.prometheus.scrapeConfigs.*.digitalocean_sd_configs.*.basic_auth.username | HTTP username
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchType | NetworkManager connection type
The NetworkManager configuration settings reference roughly corresponds to connection types
|
| hardware.block.scheduler | Assign block I/O scheduler by device name pattern
|
| system.replaceDependencies.replacements | List of packages to override without doing a full rebuild
|
| security.apparmor.killUnconfinedConfinables | Whether to enable killing of processes which have an AppArmor profile enabled
(in security.apparmor.policies)
but are not confined (because AppArmor can only confine new processes)
|
| networking.networkmanager.unmanaged | List of interfaces that will not be managed by NetworkManager
|
| virtualisation.sharedDirectories | An attributes set of directories that will be shared with the
virtual machine using VirtFS (9P filesystem over VirtIO)
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchIface | interface name of the NetworkManager connection
|
| networking.networkmanager.appendNameservers | A list of name servers that should be appended
to the ones configured in NetworkManager or received by DHCP.
|
| networking.networkmanager.insertNameservers | A list of name servers that should be inserted before
the ones configured in NetworkManager or received by DHCP.
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchId | connection id used by NetworkManager
|
| networking.networkmanager.ensureProfiles.secrets.entries.*.matchSetting | name of the setting section for which secrets are requested
|
| services.prometheus.scrapeConfigs.*.openstack_sd_configs.*.application_credential_name | The application_credential_id or application_credential_name fields are
required if using an application credential to authenticate
|