"Agent" hooks to install

Path to the directory storing the hooks

The name of the agent as seen in the buildkite dashboard.

The ID of your hook

The token from your Buildkite "Agents" page

Tags for the agent.

The workdir for the agent

Attribute set of buildkite agents

Command that buildkite-agent 3 will execute when it spawns a shell.

Whether to enable this buildkite agent

The buildkite-agent package to use.

Additional packages that should be added to the agent's PATH

The command that should be executed when the hook is triggered.

Groups the user for this buildkite agent should belong to

Whether to enable this Woodpecker-Agent

Extra lines to be added verbatim to the configuration file.

Profile hook scripts.

The woodpecker-agent package to use.

Additional groups for the systemd service.

OpenSSH private key

A run-time path to the key file, which is supposed to be provisioned outside of Nix store.

Add programs to the buildkite-agent environment

Preswitch hook executed before mode switch.

Predetect hook executed before autorandr attempts to run xrandr.

List of hooks to enable when generating the CDI specification

woodpecker-agent config environment variables, for other options read the documentation

Postswitch hook executed after mode switch.

List of hooks to disable when generating the CDI specification

File to load environment variables from

The actual configuration of which hooks will be served

Global hook scripts

woodpecker-agents configurations

Each attribute in this option names an apcupsd event and the string value it contains will be executed in a shell, in response to that event (prior to the default action)

Same as hooks, but these hooks are specified as literal strings instead of Nix values, and hence can include template syntax which might not be representable as JSON

Scripts to run upon the detection of a new certificate

Preswitch hook executed before mode switch.

An attrset of events and commands to run upon each event

Predetect hook executed before autorandr attempts to run xrandr.

Postswitch hook executed after mode switch.

Hooks that will be placed under /var/lib/libvirt/hooks/lxc.d/ and called for lxc domains begin/end events

Hooks that will be placed under /var/lib/libvirt/hooks/qemu.d/ and called for qemu domains begin/end/migrate events

Hooks that will be placed under /var/lib/libvirt/hooks/libxl.d/ and called for libxl-handled xen domains begin/end events

Hooks that will be placed under /var/lib/libvirt/hooks/daemon.d/ and called for daemon start/shutdown/SIGHUP events

Hooks related options.

Hooks that will be placed under /var/lib/libvirt/hooks/network.d/ and called for networks begin/end events

Name of the UKI

A list of custom git hooks that get copied to ~/.gitolite/hooks/common.

Whether to enable matrix-hookshot, a bridge between Matrix and project management services.

The matrix-hookshot package to use.

The name of the user account

The name of this nylon instance.

config.yml configuration as a Nix attribute set

Extra arguments passed to the Celery responsible for webhooks.

The name of the group

Extra arguments passed to the Celery responsible for webhooks.

Name of the zone.

Name of the PPP peer.

Extra arguments passed to the Celery responsible for webhooks.

Extra arguments passed to the Celery responsible for webhooks.

A passkey used to encrypt tokens stored inside the bridge

Extra arguments passed to the Celery responsible for webhooks.

The name of the user account

Content of the celeryconfig.py used by the Celery responsible for webhooks.

The IP webhook should serve hooks on

Packages providing systemd units and hooks.

The name of the system used in the system.build.toplevel derivation

Content of the celeryconfig.py used by the Celery responsible for webhooks.

The Redis connection used for the webhooks worker.

The Redis connection used for the webhooks worker.

Content of the celeryconfig.py used by the Celery responsible for webhooks.

Content of the celeryconfig.py used by the Celery responsible for webhooks.

Shell code that will be run after all other hooks

The Redis connection used for the webhooks worker.

The Redis connection used for the webhooks worker.

Content of the celeryconfig.py used by the Celery responsible for webhooks.

Etcd unique node name.

The Redis connection used for the webhooks worker.

The name of the group

The endpoint name.

The name of this systemd unit, including its extension

The endpoint name.

The URL path prefix to use for served hooks (protocol://yourserver:port/${prefix}/hook-id).

Username for JSON-RPC connections.

Name of the PAM service.

The name of this systemd unit, including its extension

Name i2pd appears in UPnP forwardings list.

Name of the worker

The name of this systemd unit, including its extension

The name of this systemd unit, including its extension

Primary name for use (as a suffix) in:

• systemd service name,
• hardened user name and group,
• systemd *Directory= names,
• desktop application identification,

Primary name for use (as a suffix) in:

• systemd service name,
• hardened user name and group,
• systemd *Directory= names,
• desktop application identification,

Appservice registration file

The token from your Buildkite "Agents" page

Name for the device

Name of modem device, will be searched for in /dev.

Specifies the Name of the Storage daemon.

The name of the node which is used as an identifier when communicating with the remote nodes in the mesh

The endpoint name.

The endpoint name.

An absolute file path (which should be outside the Nix-store) to a base64-encoded Ed25519 key for signing webhook payloads

Whether to enable Webhook, a server written in Go that allows you to create HTTP endpoints (hooks), which execute configured commands for any person or service that knows the URL .

The name of this systemd unit, including its extension

The name of this systemd unit, including its extension

Name of the redis server

The name of this systemd unit, including its extension

The name of this systemd unit, including its extension

List of Systemd services to require and wait for when starting the application service, such as the Matrix homeserver if it's running on the same host.

The endpoint name.

The endpoint name.

Name of the runner to configure

The client name that must be used by the Director when connecting

The director name used by the system administrator

Mail "from" name.

Packages providing systemd units and hooks.

Database name.

The name of the Helm chart

A system user name for this client instance.

A system user name for this client instance.

The name of the host

Name of the image

The name of this systemd unit, including its extension

The name of this systemd unit, including its extension

Database name.

The name of the Helm chart

Keyboard name.

Agent name, usually same as the hostname

The name of this systemd unit, including its extension

The name of this systemd unit, including its extension

Akkoma frontend name.

The k3s server to connect to

The name of the service to run

Font name, as used by fontconfig.

Mail "reply-to" name.

Name of the redis server

The endpoint name.

The name of the instance.

Whether to enable lifecycled, a daemon for responding to AWS AutoScaling Lifecycle Hooks.

The name to return in service discovery responses for the MUC service itself

The name of this systemd unit, including its extension

The name of this systemd unit, including its extension

Name is referenced in logs

Name of the rule.

Name of the machine when registering it at the central or local api.

The endpoint name.

File path containing the k3s token agents can use to connect to the server

Name of the existing database.

Name of the control, as it appears in alsamixer

Name is used as a suffix for the service name, user, and group

A systemd service name to use (without .service suffix).

A systemd service name to use (without .service suffix).

The name of the service to run

Name of the user to ensure.

File path containing the rke2 token agents can use to connect to the server

The logical name of the Galera cluster

The name of the mailbox.

The name of the server

Enable the generated hooks file to be parsed as a Go template

The endpoint name.

The database name

Database name.

Database name.

Name of the beat

Name of the wiki.

Name of the server.

Server name to be used for this virtual host

Name of the service.

Database name.

The name of an existing user account under which the rsync process should run.

Name of this iscsi initiator

The name of this gateway as shown in firezone

The name of the cookie that the oauth_proxy creates.

Whether to relax the security sandbox to allow running setuid binaries (e.g. sudo) in the dhcpcd hooks.

This primary server will notify all given secondary servers about zone changes

The k3s token agents can use to connect to the server

Name of ICMP pinging job.

Database name.

Database name, only used when the databse is created locally.

Name of the redis server

The endpoint name.

Database name.

Database name.

Database name.

The name of this authentication provider

Database name

The advertised name for zeroconf discovery.

The name of the immich database.

The name of an existing user group under which the rsync process should run.

The rke2 token agents can use to connect to the server

The name of the database to use for Wakapi.

The name of the host in the network as well as the configuration for that host

Database name.

User to run the cgit service as.

The name of this systemd unit, including its extension

name of the virtualhost

The name of the network interface to match against.

The name of this client as shown in firezone

The name of this actor

The name of this group

The name of the device.

The friendly name you give to the network device

The friendly name you give to the network device

The name identifying the runner instance towards the Gitea/Forgejo instance.

When set to something distinct to null NSD is able to collect statistics per zone

Database name.

Database name.

This is the target address is to match against

Port number Go Ethereum will be listening on, both TCP and UDP.

TLS options for virtual host

PostgreSQL database name

The name of this gateway as shown in firezone

APIs to enable over WebSocket

Adapter name that is used in the radicle-ci-broker configuration

Server name.

Database name.

Group to run the cgit service as.

The name of this relay group

Name of the existing database (has no effect if type is "sqlite").

Bind port for ‹name› endpoint.

Name of the local AutoSSH session

The name of this server.

Name of the game as it will appear in the game listing.

Bind port for ‹name› endpoint.

Port number of Go Ethereum HTTP API.

ACME options for virtual host.

HTTP options for virtual host

A path which will be scanned for repositories.

What port to listen for client requests, default is 1080.

The name of services's user

cgit repository settings, see cgitrc(5)

Rename nodes to different name.

Database name.

Database name.

Database name.

Database name.

Database name.

Database name.

Database name.

Database name.

The type of the device.

The name of the dawarich database.

MySQL database name.

Database name for FreshRSS.

The name of this gateway group

Name of the satellite.

The name of this resource

Override the default TLS port for this virtual host.

The user's home directory.

Format: [AXFR|UDP] <ip-address> <key-name | NOKEY>

Whether to enable cgit.

The nickname of this Tahoe node.

Node name

Name of the modifier.

Set the host address for this virtual host

Blockchain garbage collection mode.

Whether to enable hub instance.

Name of the beat

Whether to enable Go Ethereum Node.

Additional arguments passed to Go Ethereum.

The account name

Name of the font to use for regreet.

Whether to enable ‹name›.

Override the default HTTP port for this virtual host.

The actual zone data

The account UID

The specified name-string gives the system file name of the storage device managed by this storage daemon

Database name.

Database name.

Name of the model to download and use for speech synthesis

Username

VirtualHost to serve cgit on, defaults to the attribute name.

Whether to enable ‹name›.

Table name.

SSID to be used in IEEE 802.11 management frames.

Whether to enable TLS support.

Name of this virtual host

Zone file resource records contain columns of data, separated by whitespace, that define the record.

The user's home directory mode in numeric format

Listed primary servers are allowed to notify this secondary server

Database name.

Database name.

Name of the symlink (relative to /var/lib/rancher/k3s/server/manifests)

DNS full-qualified domain name of a database server

DNS full-qualified domain name of a database server

Name of directory from which to import ZFS device, this is passed to zpool import as the value of the -d option

Discourse database name.

The serial port to which your UPS is connected. /dev/ttyS0 is usually the first port on Linux boxes, for example.

Whether to enable DNSSEC.

Name of Google storage bucket

Name of the theme to use for regreet.

Name of the iSCSI initiator to boot from

Path to the file which contains the actual base64 encoded key

static: Immediately answer any Neighbor Solicitation Messages (if they match the IP rule). iface: Forward the Neighbor Solicitation Message through the specified interface and only respond if a matching Neighbor Advertisement Message is received. auto: Same as iface, but instead of manually specifying the outgoing interface, check for a matching route in /proc/net/ipv6_route.

Name of modem configuration file, will be searched for in config in the spooling area directory.

Replace any existing runner with the same name

Whether to enable Go Ethereum HTTP API.

Directory for the ACME challenge, which is public

Enables HTTP/3 over QUIC on the UDP port for TLS

Members of this group can access the control socket for this interface.

The name of an explicit dtb to be loaded, relative to the dtb base

The user's primary group.

Enables nylon as a running service upon activation.

Database name.

The name of the first admin user.

Whether the SSID is to be interpreted using UTF-8 encoding.

Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).

The cgit package to use.

The geth package to use.

Uhub plugin configuration.

Name of the interface.

Interface to use when method is iface.

Name of the remote read config, which if specified must be unique among remote read configs

The name of the database to create.

The device to update.

Bind address for ‹name› endpoint.

Name of the symlink (relative to /var/lib/rancher/rke2/server/manifests)

Set name to shared memory zone.

The name of this client as shown in firezone

Whether to enable this PPP peer.

Port to bind the TTS server to.

User account under which this pool runs.

Backup type as described in: https://pgbackrest.org/command.html#command-backup/category-command/option-type

Bind address for ‹name› endpoint.

Name of the interface

Database name to use when connecting to an external or manually provisioned database; has no effect when a local database is automatically provisioned

Master=false means slave server

Addresses who may request zone transfers.

Limit retry time for secondary zones.

Whether to enable this RAUC slot.

Name of the remote write config, which if specified must be unique among remote write configs

Local secret key in hexadecimal form.

Each attribute of this option defines a systemd service that runs hans

Root directory for requests.

Environment variables used for this PHP-FPM pool.

The network to connect to

Name of the user to ensure.

Output DPI configuration.

User name under which the buildkite-agent exporter shall be run.

Database name.

Database name.

Name of database.

Database name.

The port on which the tub will listen

The port on which the Web server will listen

Tunnel type.

Name of the icon theme to use for regreet.

The name of the host in the network as well as the configuration for that host

Name of the PostgreSQL database.

The name of the Linkwarden database.

These lines go to the end of cgitrc verbatim.

Shell commands executed to stop the service.

The name of the Grafana database.

Output resolution.

Output framerate.

The group GID

Local Mattermost database name.

Levels (minimum value for logged events): 0 = verbose debugging 1 = debugging 2 = informational messages 3 = notification 4 = warning

pppd configuration for this peer, see the pppd(8) man page.

Adds index directive.

Alias directory for requests.

Enable logging, default is no logging.

Verify peer certificate

Verify peer certificate

Location of hardware kiss tnc for this interface.

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

Specifies the MAC addresses to deny if macAcl is set to "deny" or "radius"

Output video display controller.

Tunnel type.

Text of the file.

Keyset used for tunnel identity.

Group account under which this pool runs.

Port number of Go Ethereum metrics service.

Listen address of Go Ethereum HTTP API.

Name of the homebridge UI platform

Password HMAC-SHA-256 for JSON-RPC connections

Marks the server as a backup server

Start the specified units when this unit is started.

Adds DirectoryIndex directive

Alias directory for requests

Name of the MySQL database that holds EPGStation's data.

Name of the beat

Isolate traffic between stations (clients) and prevent them from communicating with each other.

Port number of Go Ethereum Auth RPC API.

Whether to offload computation onto a CUDA compatible GPU.

Remote public key in hexadecimal form.

A system group name for this client instance.

A system group name for this client instance.

Adds try_files directive.

A program name specifying a Postfix service/daemon process

A systemd service name to use (without .service suffix).

A systemd service name to use (without .service suffix).

Source directories.

Keyset used for tunnel identity.

Vertical scaling factor/pixels.

Horizontal scaling factor/pixels.

The domain name to collect stats for.

The serial port speed of this interface.

Output gamma configuration.

Instance name.

Shell commands executed to stop the service.

Specifies the MAC addresses to allow if macAcl is set to "allow" or "radius"

Units that want (i.e. depend on) this unit

Packages added to the service's PATH environment variable

If the specified units are started at the same time as this unit, delay this unit until they have started.

The location of the Drupal files directory.

Service port

Specify the log file name

Controls how long a valid or invalid entry remains in the cache, in milliseconds.

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

The user's home directory.

A system group name for this client instance.

A system group name for this client instance.

The user as which to run bitcoind.

Blockchain sync mode.

Maximum peers to connect to.

Server name to verify the hostname on the returned gRPC certificates

Units that want (i.e. depend on) this unit

Shell commands executed after the service's main process has exited.

The user's home directory mode in numeric format

Adds a return directive, for e.g. redirections.

The location of the Drupal site state directory.

Start the specified units when this unit is started.

add will additionally listen for TLS connections. only will disable TLS connections. force will redirect non-TLS traffic to the TLS connection.

The path to repo in local machine

DNS full-qualified domain name of a database server

Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.

When to run the job.

Contents of the PAM service file.

Path to world folder containing the dimension to render

List of servers for inclusion in stub and secondary zones.

The IP interface to bind to. null means "all interfaces".

Enable unlocking and mounting of encrypted ZFS home dataset at login.

Specify the program to run to talk to this UPS. apcsmart, bestups, and sec are some examples.

Name of this virtual host

Override the default port on which to listen for connections.

Name of the tun device

Shell commands executed before the service's main process is started.

GVPE node name

Whether to enable the output.

Output rotate configuration.

Which local IP to bind the UDP socket to.

How to name the created archives

Adds DirectoryIndex directive

Alias directory for requests

Whether to ask Let’s Encrypt to sign a certificate for this virtual host

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

Limit retry time for secondary zones

cgit configuration, see cgitrc(5)

Configuration of uhub

Drive name without the full path.

Packages added to the service's PATH environment variable

The address on which to accept FastCGI requests.

Each attribute of this option defines a systemd service that runs iodine

Specifies the number of retries for failed notifies

If the specified units are started at the same time as this unit, delay this unit until they have started.

The port on which the SFTP server will listen

The data directory for bitcoind.

The account UID

Guaranteed minimum hops for ‹name› tunnels.

The kimai package to use.

The tahoelafs package to use.

Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.

Whether to enable Drupal web application.

Extra arguments to pass to the server commandline.

Whether to enable Coqui TTS server.

When or how often the backup should run

Override the default port on which to listen for JSON-RPC connections.

Shell commands executed after the service's main process has exited.

Name of the voice model to use

Optional PKCS#11 module name.

Basic Auth protection for a vhost

Name of the homebridge

Location of bitcoind pid file.

Specifies the BSSID for this BSS

Text of the file.

Shell commands executed as the service's main process.

Label for this destination

Configuration for this host

List of address ranges allowed to query this zone

The name of the database to store data in.

The packaged Helm chart

Guaranteed minimum hops for ‹name› tunnels.

The group as which to run bitcoind.

Name of the cursor theme to use for regreet.

IP of the Redis master

Text of this systemd unit.

The database name.

As which user the backup should run.

Shell commands executed after the service's main process is started.

Shell commands executed when the service's main process is reloaded.

Extra zone config to be appended at the end of the zone section.

Shell commands executed before the service's main process is started.

Domain name

Name of a file containing the spiped key

Whether to enable SFTP service.

Whether to enable proxy for this bucket

Set maximum cache size

If the specified units are started at the same time as this unit, delay them until this unit has started.

The TCP port to accept connections

Optional PKCS#11 module name.

If set, root doesn't need to authenticate (e.g. for the useradd service).

Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.

Root directory for requests.

Output scaling method.

Name shown in the website title and on the front page.

These lines go to the end of the location verbatim.

These lines go to the end of the location verbatim.

List of virtual hostnames from which to accept requests.

IP address of server running hans

The location for users to install Drupal themes.

Limit refresh time for secondary zones.

Limit on the number of simultaneous connections allowed.

Whether to operate in tun (IP) or tap (Ethernet) mode.

Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.

Whether output should be marked as primary

A program name specifying a Postfix service/daemon process

File or block device to export.

The database engine name

Whether to show the message of the day.

Database name to connect to

Run the rsync process with an inhibition lock taken; see systemd-inhibit(1) for a list of possible operations.

Whether to enable Go Ethereum prometheus metrics.

RPC user information for JSON-RPC connections.

IP and port to which this redis instance acts as a slave.

Shell commands executed as the service's main process.

The user's primary group.

Extra lines to add to the tinc service configuration file

Legacy RSA public key of the host in PEM format, including start and end markers

Key / certificate pairs for the virtual host.

Key policy for zone signing keys

Key policy for key signing keys

An existing Let’s Encrypt certificate to use for this virtual host

Location to serve cgit under.

Path of the source file.

Settings for this slot.

Address to which spiped should connect.

Specifies a file containing the MAC addresses to deny if macAcl is set to "deny" or "radius"

Name of this overlay

Extra configuration to be appended to awstats.${name}.conf.

If set, the OATH Toolkit will be used.

Whether to enable Go Ethereum Auth RPC API.

Shell commands executed after the service's main process is started.

Shell commands executed when the service's main process is reloaded.

Station MAC address -based authentication

Options for the Kimai PHP pool

Aliases of that unit.

Alias directory for requests.

Adds index directive.

Path to the unix socket file on which to accept FastCGI requests.

If the specified units are started at the same time as this unit, delay them until this unit has started.

Override the default database cache size in MiB.

Name that will be shown to the user.

port of the Redis master

Lines which would be added inside ups.conf for handling this UPS.

Name of the class implementing the check

The drupal package to use.

Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED address range 192.0.2.0/24, 1.2.3.4&255.255.0.0, 3.0.2.20-3.0.2.40

Common name attribute of allowed peer certificates

Common name attribute of allowed peer certificates

Optional PKCS#11 module name.

Whether to enable the HTTP/3 protocol

Desktop IDs (without the .desktop extension) of whitelisted agents.

Shell commands executed when the instance is starting.

The name of the module

Source ZFS dataset

Default window size for this interface.

Path to plugin file.

Keep this unit running as long as the listed units are running

When or how often the backup should run

Optional slot number of the token that stores the certificate.

Guaranteed minimum hops for ‹name› tunnels.

Adds try_files directive.

Address to bind on for UI connections

Environment variables to set for the kernel.

Enable logging to the system logger.

Whether to enable Redis server.

Number of worker instances to run

The path of the web root directory.

Path to the certificate authority certificate.

The subnets which this tinc daemon will serve

Dataset name to send snapshots to.

Maximum number of items to keep in slow log.

The name of this systemd unit, including its extension

If set, the OTPW system will be used (if ~/.otpw exists).

The type of this worker

The packaged Helm chart

Basic Auth password file for a vhost

Whether to enable Enables the axport interface.

Default maximum packet size for this interface.

Specifies a file containing the MAC addresses to allow if macAcl is set to "allow" or "radius"

Output position

Authentication algorithm for this key.

Local UDP port.

TCP Port to bind on for UI connections

Public address for p2p connections from peers (if TCP is used)

Whether users can log in with passwords defined in /etc/shadow.

Specify the server verbosity level, options: debug, verbose, notice, warning.

These lines go to the end of the location verbatim.

Guaranteed minimum hops for ‹name› tunnels.

Whether to enable helper service.

Name of the runner group to add this runner to (defaults to the default runner group)

Path to file containing local secret key in binary or hexadecimal form.

The name of the Stash Box

Specifies if TLS should be enabled

Specifies if TLS should be enabled

The specified name-string names the type of media supported by this device, for example, DLT7000

Event type.

Aliases of that unit.

The address of the proxy.

Whether to enable this PAM service.

Path or reference to the host key.

Domain part of the web interface URL (no web interface for this domain if null)

Turns on or off the router flag for Neighbor Advertisement Messages.

Whether to enable watching for repo.

Optional url of remote repository

Optional branch in remote repository

Whether to enable Bitcoin daemon.

Automatically start this unit at the given date/time, which must be in the format described in systemd.time(7)

Output scale configuration

Language of the environment

Name shown in the server list.

Optional slot number of the token that stores the certificate.

The type of log being collected.

The name of the user for this authelia instance.

The name the camera will show up as.

Page or namespace to restrict

The location of the Drupal config sync directory.

Name of symlink

Domain to fetch certificate for (defaults to the entry name).

DNS server to use as an intermediate relay to the iodined server

The specified name-string must be the generic SCSI device name of the autochanger that corresponds to the normal read/write Archive Device specified in the Device resource

Enable PAM mount (pam_mount) system to mount filesystems on user login.

Keep this unit running as long as the listed units are running

Name used to derive peer unit name.

Adds a return directive, for e.g. redirections.

Absolute path to the certificate to load

The name of your network of sr.ht-based sites.

Errbot backend name.

Hostname alias(es).

Username for this DDNS provider.

Order of this location block in relation to the others in the vhost

Order of this location block in relation to the others in the vhost

Text of the file.

The name of private PKCS #8 key file for this policy to be found in the baseDirectory, or the absolute path to the key file

Command and arguments to start the kernel.

TLS Options for the Director in this Configuration.

Bind address to be used for this server.

TLS Options for the Director in this Configuration.

Port the NetBird client listens on.

Port the NetBird client listens on.

The group GID

If set, keys listed in ~/.ssh/authorized_keys and ~/.eid/authorized_certificates can be used to log in with the associated PKCS#11 tokens.

This is a rule that the target address is to match against

Device identifiers, as shown by keyd(1).

If given, sets the SO_MARK option on the TCP socket.

If given, sets the SO_MARK option on the TCP socket.

PostgreSQL host for operating remotely.

Whether this file locals should be generated

Key size in bits

Key size in bits

The path to the user's shell

Keeps the specified running while this unit is running

Determines how multiple values are joined to create the claim value

Text of this systemd unit.

APIs to enable over WebSocket

Path to the host certificate.

Custom name of this poller.

The location for users to install Drupal modules.

I2P nodes that are allowed to connect to this service.

Shell commands executed when the instance is shutting down.

URL where this inbox can be accessed over HTTP.

Attrset to be transformed into YAML for host config

Port to bind on for p2p connections from peers (both TCP and UDP)

Address to bind on for p2p connections from peers (both TCP and UDP)

Name of the class implementing the check

The username to store inside the credentials file.

Disables scan for overlapping BSSs in HT40+/- mode

Public URL of the API address of the reverse proxy/tls terminator

Options for the Drupal PHP pool

User account under which this instance of redis-server runs.

Owner's name.

A list of host names and/or IP numbers used for accessing the host's ssh service

Listen for any Neighbor Solicitation messages on this interface, and respond to them according to a set of rules

Automatically start this unit at the given date/time, which must be in the format described in systemd.time(7)

DDNS server name.

Adds uwsgi_pass directive and sets recommended proxy headers if recommendedUwsgiSettings is enabled.

Adds proxy_pass directive and sets recommended proxy headers if recommendedProxySettings is enabled.

The flake reference from is rewritten to

If set to false, the user account will not be created

Manually specify the hostname

The name of a .desktop file in the directory specified in the 'package' option.

Listen address of Go Ethereum metrics service.

Options for PHP's php.ini file for this Drupal site.

Whether to enable this proxy cache path entry.

The name of the wrapper program

Protocol names to hide in summary tables (RE2 syntax),

Settings that should be passed to rsync via long options

The furl for a Tahoe helper node

The external address where the host can be reached

Kissattach parameters for this interface.

Number of simultaneous ‹name› tunnels.

Absolute path to the certificate to load

Add the necessary actions for a upsmon process to work

A list of one or more units that are activated when this unit enters the "inactive" state.

A list of one or more units that are activated when this unit enters the "failed" state.

Canonical hostname for the server.

Path of the source file.

Canonical hostname for the server.

The URL at which to fetch the feed.

The path to the socket to bind to.

Each attribute in this set specifies an option in the [Unit] section of the unit

Database user.

IP Address of a database server

IP Address of a database server

Set size to shared memory zone.

Structural Kimai's local.yaml configuration

Listen address of Go Ethereum Auth RPC API.

Whether to run the check command with the provided checkOpts options.

The PHP package to use for running this PHP-FPM pool.

The repo of the Helm chart

Name of symlink (relative to /etc)

Address to bind on for API connections relied by the reverse proxy/tls terminator.

Port to bind on for API connections relied by the reverse proxy/tls terminator.

Attributes for user's entry in pam_mount.conf.xml

Start the specified units when this unit is started.

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

Extra configuration options to put at the end of this BSS's defintion in the hostapd.conf for the associated interface

The port where the host can be reached

The name of the group for this authelia instance.

The path to the xkb types file

Basic Auth protection for a vhost

Run specified command or script after the tunnel device has been opened.

User name for RPC connections.

The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes

Number of simultaneous ‹name› tunnels.

Additional command line parameters

Location of the DokuWiki state directory.

Hostname of server running iodined

A list of options for 'restic check'.

Whether to run the rspamd worker.

Specifies the frequency band to use, possible values are 2g for 2.4 GHz, 5g for 5 GHz, 6g for 6 GHz and 60g for 60 GHz.

Database host address.

Database host port.

The user as which to run blockbook-frontend-‹name›.

Port number of Go Ethereum WebSocket API.

The hash of the packaged Helm chart

Print global archive statistics upon completion

Optional slot number of the token that stores the certificate.

Additional names of virtual hosts served by this virtual host configuration.

Keeps the specified running while this unit is running

If set, the pam_mysql module will be used to authenticate users against a MySQL/MariaDB database.

If set, the calling user's SSH agent is used to authenticate against the configured keys

The flake input from is rewritten to.

Name of the user to log in

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively

Adds DirectoryIndex directive

Alias directory for requests

Limit refresh time for secondary zones

See torrc manual.

User or group to restrict

Path to the directory where the pastes will be saved to

Arguments passed to date to create a timestamp suffix for the archive name.

Whether to try to create home directories for users with $HOMEs pointing to nonexistent locations on session login.

The user's auxiliary groups.

Remote UDP port

The ax25-tools package to use.

Enable verbose output, default is to not be verbose.

Order of this location block in relation to the others in the vhost

Type of this limit

(optional) name your peer has for you

(optional) name your peer has for you

Path to key file

Denied client IP ranges, these gets evaluated after the allowed IP ranges, defaults to all IPv4 addresses: [ "0.0.0.0/0" ] To block all other access than the allowed.

Arguments passed to the main process script

A list of one or more units that are activated when this unit enters the "failed" state.

A list of one or more units that are activated when this unit enters the "inactive" state.

Whether to enable the QUIC transport protocol

Each attribute in this set specifies an option in the [Unit] section of the unit

This option provides a simple way to serve individual, static files.

A systemd service name to use (without .service suffix).

A systemd service name to use (without .service suffix).

The znapzend backup plan to use for the source

The name of the file or block device that should be used as header for the encrypted device.

FastCGI parameters to override

Name of the wrapper that is installed into PATH

Path to encrypted luks device that contains the user's home directory.

Shell commands to run after borg create

Set the logcheck level.

Number of daily snapshots.

Whether to enable this source.

Whether to enable storage service.

URI to bind the wyoming server to.

These lines go to the end of the location verbatim.

Item this limit applies to

The path of a PEM encoded TLS private key

The path of a PEM encoded TLS private key

Apache configuration can be done by adapting services.httpd.virtualHosts.

Extra configuration values that you want to insert into settings.php

"Options appended to the PHP configuration file php.ini used for this PHP-FPM pool."

Host to use for the destination dataset

The name of the file (can be a raw device or a partition) that should be used as the decryption key for the encrypted device

Group account under which this instance of redis-server runs.

The bitcoind package to use.

Name of the heat source.

Refer to xrandr(1) for the documentation of the transform matrix.

The configuration file path to supply bitcoind.

TTL for dnssec records

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively

Absolute path to the certificate to load

Number of ElGamal/AES tags to send.

Enables TCP_NODELAY on the TCP socket.

Whitelists the given rrl-types.

The IP and port to forward all traffic to.

The IP and port to forward all traffic to.

Enables TCP_NODELAY on the TCP socket.

Whether to update /var/log/wtmp.

Maps kanidm groups to values for the claim.

Location of the dokuwiki acl rules

The input type

Name of user to run the script under.

Extra lines that go into the pool configuration

Location of blockbook-frontend-‹name› data directory.

Require TLS or TLS-PSK encryption

Require TLS or TLS-PSK encryption

Indicates the priority over identical Subnets owned by different nodes

The account type

Where to mount this dataset.

The hostname the web service appears under.

Name to match.

The delay time (in microseconds) on failure.

User that runs the cronjob.

Paths to SSL files

Whether this node is a relay.

Network interface to bind to.

The group as which to run blockbook-frontend-‹name›.

Additional TLS/SSL-related configuration options

If enabled, the pam_umask module will be loaded.

Shell commands to execute when the event is triggered.

Regex specifying which log lines to ignore.

Whether to enable HTTPS in addition to plain HTTP

Whether to enable HTTPS in addition to plain HTTP

Name of the network interface managed by this client.

Name of the network interface managed by this client.

Attribute set describing resource limits

Arguments passed to the main process script

(optional) human-readable name for peer

(optional) human-readable name for peer

The number of shares required to store a file.

Name (relative to the root of the filesystem) of the subvolume where the hash table will be stored.

Your yandex.com login name.

Path to the key file.

The type of the service

Sets up a simple reverse proxy as described by https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple.

Whether to use the testnet instead of mainnet.

Number of ElGamal/AES tags to send.

Path to the SSH host public key.

The flake reference to be rewritten

Log level of the NetBird daemon.

Log level of the NetBird daemon.

If enabled, checks all masters for the last zone version

If the specified units are started at the same time as this unit, delay this unit until they have started.

Whether the delay after typing a wrong password should be disabled.

Allow client if common name appears in the list.

If set, users listed in $XDG_CONFIG_HOME/Yubico/u2f_keys (or $HOME/.config/Yubico/u2f_keys if XDG variable is not set) are able to log in with the associated U2F key

If set, fingerprint reader will be used (if exists and your fingerprints are enrolled).

Permission level to restrict the actor(s) to

Path to the working directory (used for config and pidfile)

Take unencrypted connections from the source socket and send encrypted connections to the target socket.

Take encrypted connections from the source socket and send unencrypted connections to the target socket.

The path to the xkb compat file

Database user.

Whether to enable frp.

Akkoma frontend reference.

The tinc_pre package to use.

Change permissions for the socket

The address that Anubis listens to

Allow client if organizational unit name appears in the list.

E-mail address of the server administrator.

Whether to create the home directory and ensure ownership as well as permissions to match the user.

Path to host the API on and forward to the daemon's api port

Whether the PPP session is automatically started at boot time.

Controls how long to wait for a Neighbor Advertisement Message before invalidating the entry, in milliseconds.

Whether to enable HTTPS and reject plain HTTP connections

Whether to enable HTTPS and reject plain HTTP connections

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

Directory for the ACME challenge, which is public

NNTP group name for the inbox.

URL of the accounts server.

Number of simultaneous ‹name› tunnels.

If set to false, this unit will be a symlink to /dev/null

The number of distinct storage nodes required to store a file.

Database host address.

Database host port.

Whether to enable fedimintd.

Don't send the password immediately after login, but store for PAM session.

Value of this limit

Path of the source .yaml file.

Whether this manifest file should be generated.

Extra parameters to append to redis-server invocation

Public domain of the API address of the reverse proxy/tls terminator.

Access Control Lists: see https://www.dokuwiki.org/acl Mutually exclusive with services.dokuwiki.aclFile Set this to a value other than null to take precedence over aclFile option

By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.

Timeout, in seconds, after which an attempt to connect to the target or a protocol handshake will be aborted (and the connection dropped) if not completed

Basic Auth password file for a vhost

The external location that the node should listen on

Whether to enable kTLS support

This setting configures the name of a mailbox for which administrator scripts are configured

Short description for the zone.

Rich rules for the zone.

Ports to allow in the zone.

The restic package to use.

S3 bucket name to use for HTTP-01 based challenges

Number of simultaneous ‹name› tunnels.

Key of taint.

The prefix length of the subnet

Name of the platform

The frp consists of client and server

How often to fsync the append-only log, options: no, always, everysec.

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively

Email address to which to send feed items

If set, users listed in ~/.yubico/authorized_yubikeys are able to log in with the associated Yubikey tokens.

User under which to run the service

Allow client if URI subject alternative name appears in the list.

Allow client if DNS subject alternative name appears in the list.

The email address used to authenticate as this account

Full legal name

The repo of the Helm chart

Path to the certificate file.

Text of the file.

Which paths to backup, in addition to ones specified via dynamicFilesFrom

Path to 64x64 logo png.

Path to 32x32 logo png.

Enable SSL.

If set to false, this unit will be a symlink to /dev/null

Additional configurations to be appended to bitcoin.conf.

Any additional text to be appended to the wp-config.php configuration file

IP to listen on. 0.0.0.0 for IPv4 only, * for all.

Target node name on the IBM TSM server.

If set, users with an SSH certificate containing an authorized principal in their SSH agent are able to log in

The znapzend backup plan to use for the source

The auth adapter type

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

The hash of the packaged Helm chart

Start the specified units when this unit is started.

Enable or disable TTY auditing for specified users

A state directory used by NetBird client to store config.json, state.json & resolv.conf.

A state directory used by NetBird client to store config.json, state.json & resolv.conf.

Hostname alias(es).

Username for this DDNS provider.

Path of the source file.

Number of yearly snapshots.

Number of hourly snapshots.

Enable or disable this network.

The location of the Drupal private files directory.

Whether this OpenVPN instance should be started automatically.

The nickname of this Tahoe introducer.

Path to the accounts file.

Paths for public-inbox-watch(1) to monitor for new mail.

Sets the number of worker threads to use

This option provides a simple way to serve individual, static files.

Canonical hostname for the server.

Allowed time window for first received packet in seconds (positive number allows packets from history)

The path to the xkb symbols file

Name of group to run the script under

The external IP address or hostname where the host can be reached.

Controls presence of netbird-ui wrapper for this NetBird client.

Controls presence of netbird-ui wrapper for this NetBird client.

Order of this location block in relation to the others in the vhost

Name of the PCM card to control (slave).

Database name.

Specify delay (in seconds) before sending snaps to the destination

Tell nylon which interface to use as an uplink, default is "enp3s0f0".

The piper-tts package to use.

The client authentication stance for this policy.

Name of the theme to use for the lightdm-gtk-greeter.

Whether to accelerate the underlying onnxruntime library with CUDA.

Start the specified units when this unit is started.

Start the specified units when this unit is started.

Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests

Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.

Allow the user to do certain things with upsd

These lines go to the end of the location verbatim.

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

Name of the font to use.

The dokuwiki package to use.

The dataset to use for this source.

How frequently to change keys

How frequently to change keys

The number of shares required to reconstitute a file.

Whether to enable SSL (https) support.

Patterns to exclude when backing up

If NSD as secondary server should be allowed to AXFR if the primary server does not allow IXFR.

Root directory for requests.

Root directory for requests.

Root directory for requests.

The server name.

Whether to use HTTPS for this DDNS provider.

Name of the database user to initialise the database with

Set the login uid of the process (/proc/self/loginuid) for auditing purposes

Optional text to use in as commit message; all occurrences of %d will be replaced by formatted date/time

Path to the data dir fedimintd will use to store its data

The levels parameter defines structure of subdirectories in cache: from 1 to 3, each level accepts values 1 or 2

Remote or local repository to back up to.

Port to listen on

Additional command line parameters

Listen address.

If set, the calling user's SSH agent is used to authenticate against the keys in the calling user's ~/.ssh/authorized_keys

Whether to enable Go Ethereum WebSocket API.

An application timeout on receiving data from the TCP socket.

An application timeout on receiving data from the TCP socket.

List of IPs of relays that this node should allow traffic from.

The log file to be scanned

Filesystem type

Children zones inherit all options of their parents

The callsign of the physical interface to bind to.

Settings specific to this plugin.

Use this as the SNI while connecting via TLS

Basic Auth protection for a vhost

Whether to enable the HTTP/3 protocol

Makes this policy trust all remote parties

The name of the module

HTTP status used by globalRedirect & forceSSL

File that contains password

Makes this vhost the default.

Allowed client IP ranges are evaluated first, defaults to ARIN IPv4 private ranges: [ "192.168.0.0/16" "127.0.0.0/8" "172.16.0.0/12" "10.0.0.0/8" ]

Which protocol to use.

Configure unit start rate limiting

Path to server SSL certificate key.

The github-runner package to use.

TLS key to use instead of the hardcoded on in case of HTTPS connections

Public URL of the API address of the reverse proxy/tls terminator

Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.

The amount of debugging information to add to the log. 0 means little logging while 5 is the most logging. man tincd for more details.

To enable SSL, specify path to the name of certificate files without extension

Port number to listen on.

Root directory for requests.

IP address to listen on.

IRC server port.

Optional hostname to add to /etc/hosts; prevents reverse lookup failures.

Optional hostname to add to /etc/hosts; prevents reverse lookup failures.

Path to the SSH host private key.

Nginx first writes files that are destined for the cache to a temporary storage area, and the use_temp_path=off directive instructs Nginx to write them to the same directories where they will be cached

Name of the theme to use for the lightdm-enso-os-greeter

Configuration for MPD

Subordinate group ids that user is allowed to use

Subordinate user ids that user is allowed to use

Whether to allow the remote address and port to change when properly encrypted packets are received.

Tag list

Data directory for errbot instance.

Whether to enable HTTP 2

Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.

Port to run the TCP server on. null will not run the server.

Whether this file should be generated

Wait for DNS

Arguments to pass to the command

SSH private key file to use to login to the remote system

Set the TTY audit flag when opening the session, but do not restore it when closing the session

Path to the unix socket file to use for authentication.

This option sets the PAM "control" used for this module.

The php package to use.

Number of daily snapshots.

File with password for the database.

User under which this instance runs.

Extra paths to link in kernel directory

Whether to enable ytdl-sub instance.

If the specified units are started at the same time as this unit, delay this unit until they have started.

Whether to support proxying websocket connections with HTTP/1.1.

This option provides a simple way to serve static directories.

Enables support for IEEE 802.11ax (WiFi 6, HE)

Redis configuration

The members of this group

Address to bind on for API connections relied by the reverse proxy/tls terminator.

Log format for Apache's log files

Configuration for HTTP request logging (also known as access logs)

Configure unit start rate limiting

Whether to enable HTTPS in addition to plain HTTP

Whether to enable the Howdy PAM module

Repository to add the runner to

Interface name

Domain name of this Gemini server, enables checking hostname and port in requests. (multiple occurrences means basic vhosts)

Name of the icon theme to use for the lightdm-gtk-greeter.

Whether to configure nginx for fedimintd

Action for packets that doesn't match any rules.

Path to server SSL certificate.

A list of options (--keep-* et al.) for 'restic forget --prune', to automatically prune old snapshots

Configuration for ytdl-sub

Path to a certificate signing request to apply when fetching the certificate.

Enables support for IEEE 802.11ac (WiFi 5, VHT)

Abort archival if upstream bandwidth usage in bytes exceeds this threshold.

User account to run vdirsyncer as, otherwise as a systemd dynamic user

The fedimint package to use.

Units that want (i.e. depend on) this unit

Units that want (i.e. depend on) this unit

TCP Port to bind on for API connections relayed by the reverse proxy/tls terminator.

Name of the theme to use for the lightdm-slick-greeter.

FastCGI parameters to override

Whether to use SSL to connect to the IRC server.

Name of the default administrator user

Path of the source .yaml file.

Whether this manifest file should be generated.

Limit how many jobs can be handled concurrently by this service. 0 (default) simply means don't limit.

Attribute set of NetBird client daemons, by default each one will:

1. be manageable using dedicated tooling:

• netbird-<name> script,
• NetBird - netbird-<name> graphical interface when appropriate (see ui.enable),

2. run as a netbird-<name>.service,
3. listen for incoming remote connections on the port 51820 (openFirewall by default),
4. manage the netbird-<name> wireguard interface,
5. use the /var/lib/netbird-/config.json configuration file,
6. override /var/lib/netbird-/config.json with values from /etc/netbird-/config.d/*.json,
7. (hardened) be locally manageable by netbird-<name> system group,

With following caveats:

• multiple daemons will interfere with each other's DNS resolution of netbird.cloud, but should remain fully operational otherwise

group to run vdirsyncer as

The name of the cluster.

Overrides to the nginx vhost section for api

URL path part of the web interface.

Username, groupname, or wildcard this limit applies to

List of extra Kubernetes manifests to deploy with this Helm chart.

Adds index directive.

Alias directory for requests.

Alias directory for requests.

Alias directory for requests.

Adds index directive.

Adds index directive.

Additional entries to put verbatim into worker section of rspamd config file.

Options for the DokuWiki PHP pool

SHA-512 password hash (can be generated by mkpasswd -m sha-512 <password>)

E-mail address of the server administrator.

Whether to enable HTTPS and reject plain HTTP connections

Restrict the allowed ciphers of this policy to those defined here

If the specified units are started at the same time as this unit, delay this unit until they have started.

If the specified units are started at the same time as this unit, delay them until this unit has started.

The user names of the group members, added to the /etc/group file.

If the specified units are started at the same time as this unit, delay this unit until they have started.

Directory for the acme challenge which is PUBLIC, don't put certs or keys in here

If enabled, this will replace the FAIL_DELAY setting from login.defs

Use 'name' instead of 'spn' in the preferred_username claim

Repository host when operating remotely

Interface name

Options for PHP's php.ini file for this dokuwiki site.

Whether to enable serving ~/public_html as /~«username».

The ip address to bind to (both listen on and send packets from).

List of sockets to listen, in format acceptable by rspamd

Path where to store the data files of the hidden service

Log queries whose execution take longer than X in milliseconds.

Units that require (i.e. depend on and need to go down with) this unit

User name.

Automatically allocate subordinate user and group ids for this user

How long in advance to publish new keys

How long in advance to publish new keys

Working directory, available as $GITHUB_WORKSPACE during workflow runs and used as a default for repository checkouts

IP address or hostname of the local end.

The path to the user's shell

Name of the icon theme to use for the lightdm-enso-os-greeter

Errbot log level

The nebula package to use.

Number of monthly snapshots.

Override default chart values via Nix expressions

These lines go to the end of the vhost verbatim.

Location of the dokuwiki users file

PHP-FPM pool directives

Root directory for requests.

Root directory for requests.

Root directory for requests.

Kind of a bitcoin node.

Root directory for requests.

Root directory for requests.

Alias directory for requests.

Adds index directive.

Whether to permit root access only to members of group wheel.

The group which should be allowed access to the given resource.

Host which to proxy requests to if ACME challenge is not found

Listen addresses and ports for this virtual host.

A runtime directory used by NetBird client.

A runtime directory used by NetBird client.

Extra arguments to pass to the server commandline.

Whether to enable Wyoming Piper server.

Whether to enable GitHub Actions runner

This directory is used to download fonts from a remote location, e.g. to host google fonts locally.

Bitcoin node (bitcoind/electrum/esplora) address to connect to

Command to pass to --stdin-from-command

Order of this location block in relation to the others in the vhost

The path to the xkb keycodes file

Count of subordinate user ids

Count of subordinate group ids

If set to false, the user account will not be created

SMTP bind interface and port.

Exclude files with the nodump flag.

List of files to include in configuration

Extra syncoid arguments for this command.

Whether to enable this wstunnel instance.

Whether to enable this wstunnel instance.

Database charset.

Additional configuration that exists before the first start and later overrides the existing values in config.json

Additional configuration that exists before the first start and later overrides the existing values in config.json

IPv4 interface to bind to.

IPv6 interface to bind to.

Ports of the service.

The path of the web root directory.

Display name

Aliases of that unit.

Aliases of that unit.

IP to listen on. 0.0.0.0 for IPv4 only, * for all.

Whether to enable automated login for NetBird client.

Whether to enable automated login for NetBird client.

Units that want (i.e. depend on) this unit

Units that want (i.e. depend on) this unit

Overwrite the URL for the GitLab instance

Units that require (i.e. depend on and need to go down with) this unit

Whether X authentication keys should be passed from the calling user to the target user (e.g. for su)

The user borg is run as

Port number to listen on

The robot.conf configuration file as key value set

Listening address and listening port of the build runner (with HTTP port if not 80).

Address on which spiped should listen for incoming connections

The driver hostapd will use. nl80211 is used with all Linux mac80211 drivers. none is used if building a standalone RADIUS server that does not control any wireless/wired driver

If the master is password protected (using the requirePass configuration) it is possible to tell the slave to authenticate before starting the replication synchronization process, otherwise the master will refuse the slave request. (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)

The subnet of this host

Group under which this instance runs.

Name that will be shown to the user.

The hostname.

The port.

If the specified units are started, then this unit is stopped and vice versa.

Each attribute of this option defines a systemd service that runs an OpenVPN instance

Extra arguments passed to restic backup.

Whether to open ports in the firewall for the server.

Adds try_files directive.

Adds try_files directive.

Adds try_files directive.

Services to allow in the zone.

Short description for the service.

Path(s) to back up

The size for mbuffer

Mark network packets with the SO_MARK sockoption with the specified value

If given, sets the SO_RCVBUF option on the TCP socket to the given number of bytes

If given, sets the SO_SNDBUF option on the TCP socket to the given number of bytes

If given, sets the SO_RCVBUF option on the TCP socket to the given number of bytes

If given, sets the SO_SNDBUF option on the TCP socket to the given number of bytes

Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)

Attributes for user's entry in pam_mount.conf.xml

Whether to ask Let's Encrypt to sign a certificate for this vhost

Whether to ask Let's Encrypt to sign a certificate for this vhost

DNS name or IP address that will be used for the stream directory lookups or possibly the playlist generation if a Host header is not provided.

The user under which Anubis is run

Enable support for attaching AppArmor profiles at the user/group level, e.g., as part of a role based access control scheme.

The version of the Helm chart

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

Start the specified units when this unit is started.

Start the specified units when this unit is started.

Name of the icon theme to use for the lightdm-slick-greeter.

The resource type

Name of the kernel module that provides the card.

Keyboard configuration.

Issuer URI

enforce sssd access control

Open the appropriate ports in the firewall.

Open the appropriate ports in the firewall.

The email addresses of the public-inbox.

Path of the private RSA keyfile.

The type of the service

Whether to enable .

The path to the xkb geometry file

Listen address of Go Ethereum WebSocket API.

Shell commands to run after borg init.

Path to a JWT secret for authenticated RPC endpoint.

Whether to enable starting this wstunnel instance automatically.

Whether to enable starting this wstunnel instance automatically.

Path to the unix socket file to use for authentication.

Where to store the backups

Whether to log authentication failures in /var/log/faillog.

Configuration of the Tinc daemon for this network

How long after deactivation to keep a key in the zone

How long after deactivation to keep a key in the zone

Shell commands to run before the backup

Each attribute in this set specifies an option in the [Service] section of the unit

Whether to enable Whether add CAP_NET_BIND_SERVICE to the tunnel service, this should be enabled if you want to bind port < 1024.

The log format being used

Command to run before snapshots are taken on the source dataset, e.g. for database locking/flushing

List of UIDs of all users for which this application is allowed location info access, Defaults to an empty string to allow it for all users.

Path to the private key to the matching certificate signing request.

All of these scripts will be executed in lexicographical order before hostapd is started, right after the bss segment was generated and may dynamically append bss options to the generated configuration file

The user's auxiliary groups.

Settings to generate easytier-‹name›.toml

Whether the application is a system component or not.

ID of the user in initrd.

Path of the source file.

Number of hourly snapshots.

Number of yearly snapshots.

Adds try_files directive.

Generator noise value.

Whether to enable the HTTP/2 protocol

Path to server SSL chain file.

Upload bandwidth rate limit in bytes.

If the specified units are started, then this unit is stopped and vice versa.

Whether to enable SSL (https) support.

Additional lines of configuration appended to this virtual host in the automatically generated Caddyfile.

Start the service with the system

Configuration of this OpenVPN instance