user ‐ NixOS ‐ Searchix

Search Nix packages and options from NixOS, Darwin, Home Manager, Nix Packages and NUR

Indexing last ran 20 hours ago, will run again in 4 hours.

NixOS options search

Title	Description
users.mysql.user	The username to use when connecting to the database
power.ups.upsmon.user	User to run `upsmon` as. `upsmon.conf` will have its owner set to this user
users.users	Additional user accounts to be created automatically by the system
services.qui.user	User to run qui as.
services.znc.user	The name of an existing user account to use to own the ZNC server process
systemd.user.units	Definition of systemd per-user units.
services.bee.user	User the bee binary should execute under.
services.h2o.user	User running H2O service
services.mpd.user	User account under which MPD runs.
services.vdr.user	User under which the VDR service runs.
systemd.user.paths	Definition of systemd per-user path units.
services.cage.user	User to log-in as.
services.node-red.user	User under which Node-RED runs
security.agnos.user	User to run Agnos as
services.u9fs.user	User to run u9fs under.
services.ergo.user	The user as which to run the Ergo node.
services.kubo.user	User under which the Kubo daemon runs
services.ttyd.user	Which unix user ttyd should run as.
services.mame.user	User from which you run MAME binary.
services.unit.user	User account under which unit runs.
services.loki.user	User under which the Loki service runs.
services.ombi.user	User account under which Ombi runs.
services.plex.user	User account under which Plex runs.
services.nats.user	User account under which NATS runs.
services.tcsd.user	User account under which tcsd runs.
services.nscd.user	User account under which nscd runs.
services.ocis.user	The user to run oCIS as
services.bird-lg.user	User to run the service.
services.ente.api.user	User under which museum runs
services.nifi.user	User account where Apache NiFi runs.
users.users.<name>.subUidRanges	Subordinate user ids that user is allowed to use
services.caddy.user	User account under which caddy runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the Caddy service starts.
services.mysql.user	User account under which MySQL runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the MySQL service starts.
services.tt-rss.user	User account under which both the update daemon and the web-application run.
users.users.<name>.name	The name of the user account
services.maddy.user	User account under which maddy runs. If left as the default value this user will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the user exists before the maddy service starts.
services.hitch.user	The user to run as
services.db-rest.user	User account under which db-rest runs.
services.ntfy-sh.user	User the ntfy-sh server runs under.
services.dspam.user	User for the dspam daemon.
services.davis.user	User davis runs as.
services.nexus.user	User which runs Nexus3.
services.seatd.user	User to own the seatd socket
services.mlmmj.user	mailinglist local user
services.omnom.user	The Omnom service user.
services.stash.user	User under which Stash runs.
systemd.user.slices	Definition of systemd per-user slice units.
systemd.user.timers	Definition of systemd per-user timer units.
services.zeyple.user	User to run Zeyple as. If left as the default value this user will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the user exists.
services.memos.user	The user to run Memos as. If changing the default value, you are responsible of creating the corresponding user with `users.users`.
users.users.<name>.enable	If set to false, the user account will not be created
services.ytdl-sub.user	User account under which ytdl-sub runs.
services.legit.user	User account under which legit runs.
services.gitea.user	User account under which gitea runs.
services.amule.user	The user the aMule daemon should run as
services.komga.user	User account under which Komga runs.
services.hound.user	User the hound daemon should execute under.
services.bosun.user	User account under which bosun runs.
services.jboss.user	User account under which jboss runs.
services.slskd.user	User account under which slskd runs.
services.nginx.user	User account under which nginx runs.
services.rqbit.user	User account under which rqbit runs.
services.movim.user	User running Movim service
services.uwsgi.user	User account under which uWSGI runs.
services.snipe-it.user	User snipe-it runs as.
services.cyrus-imap.user	Cyrus IMAP user name
services.felix.user	User account under which Apache Felix runs.
services.cgit.<name>.user	User to run the cgit service as.
services.nipap.user	User to use for running NIPAP services.
services.inadyn.user	User account under which inadyn runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the inadyn service starts.
services.sonarr.user	User account under which Sonarr runs."; If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the Sonarr service starts.
services.slurm.user	Set this option when you want to run the slurmctld daemon as something else than the default slurm user "slurm"
services.murmur.user	The name of an existing user to use to run the service
services.patroni.user	The user for the service
services.coder.user	User under which the coder service runs. If left as the default value this user will automatically be created on system activation, otherwise it needs to be configured manually.
users.mysql.pam.userColumn	The name of the column that contains a unix login name.
services.nixops-dns.user	The user the nixops-dns daemon should run as
services.quorum.user	The user as which to run quorum.
services.gammu-smsd.user	User that has access to the device
services.kismet.user	The user to run Kismet as.
services.atticd.user	The user under which attic runs.
services.artalk.user	Artalk user name.
services.immich.user	The user immich should run as.
services.monica.user	User monica runs as.
services.pretix.user	User under which pretix should run.
services.zammad.user	Name of the Zammad user.
services.webhook.user	Webhook will be run under this user
services.actual.user	User account under which Actual runs
services.gocd-agent.user	User the Go
services.lidarr.user	User account under which Lidarr runs.
services.flarum.user	System user to run Flarum
services.galene.user	User account under which galene runs.
services.akkoma.user	User account under which Akkoma runs.
services.bazarr.user	User account under which bazarr runs.
services.deluge.user	User account under which deluge runs.
services.kavita.user	User account under which Kavita runs.
services.cross-seed.user	User to run cross-seed as.
services.opkssh.user	System user for running opkssh
services.nzbget.user	User account under which NZBGet runs
services.radarr.user	User account under which Radarr runs.
services.webdav.user	User account under which WebDAV runs.
services.traefik.user	User under which Traefik runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the Traefik service starts.
users.users.<name>.home	The user's home directory.
services.code-server.user	The user to run code-server as
systemd.user.targets	Definition of systemd per-user target units.
systemd.user.sockets	Definition of systemd per-user socket units.
services.prosody.user	User account under which prosody runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the prosody service starts.
services.gitlab.user	User to run gitlab and all related services.
services.baikal.user	User account under which the web-application run.
services.rspamd.user	User to use when no root privileges are required.
services.tomcat.user	User account under which Apache Tomcat runs.
services.sftpgo.user	User account name under which SFTPGo runs.
users.users.<name>.subGidRanges	Subordinate group ids that user is allowed to use
services.ollama.user	User account under which to run ollama
services.ebusd.mqtt.user	The MQTT user to use
services.dawarich.user	User under which dawarich runs
services.pihole-ftl.user	User to run the service as.
services.pyload.user	User under which pyLoad runs, and which owns the download directory.
services.pocket-id.user	User account under which Pocket ID runs.
services.klipper.user	User account under which Klipper runs
services.quassel.user	The existing user the Quassel daemon should run as
services.outline.user	User under which the service should run
services.gitDaemon.user	User under which Git daemon would be running.
users.users.<name>.autoSubUidGidRange	Automatically allocate subordinate user and group ids for this user
users.users.<name>.uid	The account UID
systemd.user.tmpfiles.users	Per-user rules for creation, deletion and cleaning of volatile and temporary files automatically.
services.gancio.user	The user (and PostgreSQL database name) used to run the gancio server
services.rss-bridge.user	The user account under which both the service and the web application run.
services.monero.rpc.user	User name for RPC connections.
services.gocd-server.user	User the Go
services.roon-server.user	User to run the Roon Server as.
services.roon-bridge.user	User to run the Roon bridge as.
services.opengfw.user	Username of the OpenGFW user.
services.icecast.user	User privileges for the server.
services.flexget.user	The user under which to run flexget.
services.corteza.user	The user to run Corteza under.
services.sabnzbd.user	User to run the service as
services.pretalx.user	User under which pretalx should run.
services.redmine.user	User under which Redmine is ran.
services.stunnel.user	The user under which stunnel runs.
services.zitadel.user	The user to run ZITADEL under.
services.zerobin.user	The user 0bin should run as
services.yandex-disk.user	The user the yandex-disk daemon should run as.
users.users.<name>.group	The user's primary group.
services.seafile.user	User account under which seafile runs.
services.haproxy.user	User account under which haproxy runs.
services.jackett.user	User account under which Jackett runs.
services.graylog.user	User account under which graylog runs
services.couchdb.user	User account under which couchdb runs.
services.jenkins.user	User the jenkins server should execute under.
services.forgejo.user	User account under which Forgejo runs.
services.homebox.user	User account under which Homebox runs.
services.cgminer.user	User account under which cgminer runs
services.netdata.user	User account under which netdata runs.
services.owncast.user	User account under which owncast runs.
services.pleroma.user	User account under which pleroma runs.
services.readarr.user	User account under which Readarr runs.
services.polaris.user	User account under which Polaris runs.
services.unbound.user	User account under which unbound runs.
services.mongodb.user	User account under which MongoDB runs
services.monetdb.user	User account under which MonetDB runs.
services.pdfding.user	User account under which PdfDing runs
services.dolibarr.user	User account under which dolibarr runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the dolibarr application starts.
services.pixelfed.user	User account under which pixelfed runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the pixelfed application starts.
services.jigasi.userName	User part of the JID for XMPP user connection.
services.jicofo.userName	User part of the JID for XMPP user connection.
services.httpd.user	User account under which httpd children processes run
services.usbmuxd.user	The user usbmuxd should use to run after startup.
services.syncoid.user	The user for the service
services.postfix.user	What to call the Postfix user (must be used only for postfix).
services.podgrab.user	User under which Podgrab runs, and which owns the download directory.
services.selfoss.user	User account under which both the service and the web-application run.
systemd.user.services	Definition of systemd per-user service units.
systemd.user.extraConfig	Extra config options for systemd user instances
services.exim.user	User to use when no root privileges are required
users.mysql.pam.logging.userColumn	The name of the column in the log table to which the name of the user being authenticated is stored.
users.users.<name>.subUidRanges.*.startUid	Start of the range of subordinate user ids that user is allowed to use.
services.jupyter.user	Name of the user used to run the jupyter service
services.mysqlBackup.user	User to be used to perform backup.
services.rsync.jobs.<name>.user	The name of an existing user account under which the rsync process should run.
services.calibre-web.user	User account under which Calibre-Web runs.
services.firefly-iii.user	User account under which firefly-iii runs.
users.users.<name>.createHome	Whether to create the home directory and ensure ownership as well as permissions to match the user.
services.tt-rss.database.user	The database user
hardware.cpu.amd.sev.user	Owner to assign to the SEV device.
systemd.user.units.<name>.text	Text of this systemd unit.
services.dovecot2.user	Dovecot user name.
services.lavalink.user	The user of the service.
services.opendkim.user	User for the daemon.
services.postsrsd.user	User for the daemon
users.users.<name>.linger	Whether to enable or disable lingering for this user
services.mastodon.user	User under which mastodon runs
security.tpm2.fapi.userDir	The directory where user objects are stored.
services.logcheck.user	Username for the logcheck user.
services.kanboard.user	User under which Kanboard runs.
services.ejabberd.user	User under which ejabberd is ran
services.librenms.user	Name of the LibreNMS user.
services.agorakit.user	User agorakit runs as.
services.collectd.user	User under which to run collectd.
services.freshrss.user	User under which FreshRSS runs.
services.crowdsec.user	The user to run crowdsec as
services.stalwart.user	User ownership of service
services.headscale.user	User account under which headscale runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the headscale service starts.
services.matrix-tuwunel.user	The user `tuwunel` is run as
services.guix.publish.user	Name of the user to change once the server is up.
services.redis.servers.<name>.user	User account under which this instance of redis-server runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the redis service starts.
services.gollum.user	Specifies the owner of the wiki directory
services.firebird.user	User account under which firebird runs.
services.jellyfin.user	User account under which Jellyfin runs.
services.airsonic.user	User account under which airsonic runs.
services.influxdb.user	User account under which influxdb runs
services.cloudlog.user	User account under which Cloudlog runs.
services.ersatztv.user	User account under which ErsatzTV runs.
services.olivetin.user	The user account under which OliveTin runs.
services.opentsdb.user	User account under which OpenTSDB runs.
services.rtorrent.user	User account under which rtorrent runs.
services.openldap.user	User account under which slapd runs.
services.oxidized.user	User under which the oxidized service runs.
services.peertube.user	User account under which Peertube runs.
services.sniproxy.user	User account under which sniproxy runs.
services.tautulli.user	User account under which Tautulli runs.
services.whisparr.user	User account under which Whisparr runs.
users.users.<name>.isSystemUser	Indicates if the user is a system user or not
services.sympa.database.user	Database user
services.github-runners.<name>.user	User under which to run the service
services.portunus.user	User account under which Portunus runs its webserver.
services.webdav-server-rs.user	User to run under when setuid is not enabled.
services.gitolite.user	Gitolite user account
services.snipe-it.mail.user	Mail username.
services.phpfpm.pools.<name>.user	User account under which this pool runs.
services.pingvin-share.user	User account under which Pingvin Share runs.
services.jenkinsSlave.user	User the jenkins slave agent should execute under.
users.motd	Message of the day shown to users when they log in.
services.nginx.gitweb.user	Existing user that the CGI process will belong to. (Default almost surely will do.)
users.users.<name>.subUidRanges.*.count	Count of subordinate user ids
services.quickwit.user	The user Quickwit runs as
services.temporal.user	The user Temporal runs as
services.gitwatch.<name>.user	The name of services's user
services.bitcoind.<name>.user	The user as which to run bitcoind.
services.opencloud.user	The user to run OpenCloud as
systemd.user.paths.<name>.partOf	If the specified units are stopped or restarted, then this unit is stopped or restarted as well.
systemd.user.paths.<name>.wants	Start the specified units when this unit is started.
services.syncthing.user	The user to run Syncthing as
services.db-rest.redis.user	Optional username used for authentication with redis.
systemd.user.tmpfiles.users.<name>.rules	Per-user rules for creation, deletion and cleaning of volatile and temporary files automatically
services.mjpg-streamer.user	mjpg-streamer user name.
systemd.user.units.<name>.name	The name of this systemd unit, including its extension
systemd.user.paths.<name>.name	The name of this systemd unit, including its extension
services.calibre-server.user	The user under which calibre-server runs.
services.etebase-server.user	User under which Etebase server runs.
services.monica.mail.user	Mail username.
services.octoprint.user	User for the daemon.
services.athens.index.mysql.user	User for the MySQL database.
services.anuko-time-tracker.user	User under which Anuko Time Tracker runs.
systemd.user.paths.<name>.after	If the specified units are started at the same time as this unit, delay this unit until they have started.
services.commafeed.user	User under which CommaFeed runs.
services.bookstack.user	User bookstack runs as
services.bitmagnet.user	User running bitmagnet
services.blendfarm.user	User under which blendfarm runs.
services.librechat.user	The user to run the service as.
services.memcached.user	The user to run Memcached as
services.pgbouncer.user	The user pgbouncer is run as.
services.sickbeard.user	User to run the service as
services.navidrome.user	User under which Navidrome runs.
services.paperless.user	User under which Paperless runs.
users.users.<name>.homeMode	The user's home directory mode in numeric format
users.extraUsers.<name>.subUidRanges	Subordinate user ids that user is allowed to use
users.users.<name>.packages	The set of packages that should be made available to the user
services.charybdis.user	Charybdis IRC daemon user.
services.kapacitor.user	User account under which Kapacitor runs
services.cassandra.user	Run Apache Cassandra under this user.
services.glitchtip.user	The user account under which GlitchTip runs.
services.mediatomb.user	User account under which the service runs.
services.recyclarr.user	User account under which recyclarr runs.
services.rutorrent.user	User which runs the ruTorrent service.
services.pinchflat.user	User account under which Pinchflat runs.
services.rethinkdb.user	User account under which RethinkDB runs.
services.stargazer.user	User account under which stargazer runs.
services.moonraker.user	User account under which Moonraker runs.
users.users.<name>.shell	The path to the user's shell
services.portunus.ldap.user	User account under which Portunus runs its LDAP server.
services.varnish.listen.*.user	User name who owns the socket file.
services.gitea.database.user	Database user.
hardware.cpu.amd.sevGuest.user	Owner to assign to the SEV guest device.
services.infinoted.user	What to call the dedicated user under which infinoted is run
services.i2pd.proto.http.user	Username for webconsole access
users.users.<name>.subGidRanges.*.startGid	Start of the range of subordinate group ids that user is allowed to use.
services.sourcehut.hg.user	User for hg.sr.ht.
systemd.user.timers.<name>.partOf	If the specified units are stopped or restarted, then this unit is stopped or restarted as well.
systemd.user.slices.<name>.partOf	If the specified units are stopped or restarted, then this unit is stopped or restarted as well.
systemd.user.timers.<name>.wants	Start the specified units when this unit is started.
systemd.user.slices.<name>.wants	Start the specified units when this unit is started.
services.sitespeed-io.user	User account under which sitespeed-io runs.
users.users.<name>.pamMount	Attributes for user's entry in pam_mount.conf.xml
services.sourcehut.git.user	User for git.sr.ht.
services.sourcehut.man.user	User for man.sr.ht.
services.sourcehut.hub.user	User for hub.sr.ht.
systemd.user.slices.<name>.name	The name of this systemd unit, including its extension
systemd.user.timers.<name>.name	The name of this systemd unit, including its extension
systemd.user.paths.<name>.bindsTo	Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.
services.journald.gateway.user	Serve entries from services for the current user
users.users.<name>.expires	Set the date on which the user's account will no longer be accessible
services.restic.backups.<name>.user	As which user the backup should run.
services.gollum.user-icons	Enable specific user icons for history view
services.tandoor-recipes.user	User account under which Tandoor runs.
services.selfoss.database.user	The database user
services.ente.api.settings.db.user	The database user
services.namecoind.rpc.user	User name for RPC connections.
services.handheld-daemon.user	The user to run Handheld Daemon with.
services.buildbot-master.user	User the buildbot server should execute under.
services.buildbot-worker.user	User the buildbot Worker should execute under.
services.plantuml-server.user	User which runs PlantUML server.
systemd.user.tmpfiles.rules	Global user rules for creation, deletion and cleaning of volatile and temporary files automatically
systemd.user.paths.<name>.before	If the specified units are started at the same time as this unit, delay them until this unit has started.
systemd.user.slices.<name>.after	If the specified units are started at the same time as this unit, delay this unit until they have started.
systemd.user.timers.<name>.after	If the specified units are started at the same time as this unit, delay this unit until they have started.
services.gammu-smsd.backend.sql.user	User name used for connection to the database
users.users.<name>.extraGroups	The user's auxiliary groups.
services.smokeping.user	User that runs smokeping and (optionally) thttpd
services.sourcehut.todo.user	User for todo.sr.ht.
services.sourcehut.meta.user	User for meta.sr.ht.
services.moodle.database.user	Database user.
services.zammad.database.user	Database user.
users.users.<name>.cryptHomeLuks	Path to encrypted luks device that contains the user's home directory.
systemd.user.tmpfiles.enable	Whether to enable systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer.
users.users.<name>.isNormalUser	Indicates whether this is an account for a “real” user
services.peertube-runner.user	User account under which peertube-runner runs.
services.suwayomi-server.user	User account under which Suwayomi-Server runs.
services.tailscaleAuth.user	User which runs tailscale-nginx-auth
services.xinetd.services.*.user	User account for the service
services.code-server.userDataDir	Path to the user data directory.
services.immich.database.user	The database user for immich.
systemd.user.units.<name>.aliases	Aliases of that unit.
systemd.user.paths.<name>.aliases	Aliases of that unit.
services.weblate.smtp.user	SMTP login name.
services.gns3-server.auth.user	Username used to access the GNS3 Server.
services.wakapi.database.user	The name of the user to use for Wakapi.
services.zabbixWeb.database.user	Database user.
services.duplicati.user	Duplicati runs as it's own user
services.taskserver.user	User for Taskserver.
services.vsftpd.userDbPath	Only applies if `enableVirtualUsers` is true
services.vdirsyncer.jobs.<name>.user	User account to run vdirsyncer as, otherwise as a systemd dynamic user
services.filesender.user	User under which filesender runs.
services.sourcehut.lists.user	User for lists.sr.ht.
services.sourcehut.pages.user	User for pages.sr.ht.
services.sourcehut.paste.user	User for paste.sr.ht.
services.homebridge.user	User to run homebridge as.
services.headphones.user	User to run the service as
services.govee2mqtt.user	User under which Govee2MQTT should run.
services.photoprism.user	User under which photoprism runs.
services.microsocks.user	User microsocks runs as.
services.reposilite.user	The user to run Reposilite under.
services.linkwarden.user	The user Linkwarden should run as.
services.node-red.userDir	The directory to store all user data, such as flow and credential files and all library data
services.shairport-sync.user	User account name under which to run shairport-sync
power.ups.upsmon.monitor.<name>.user	Username from `upsd.users` for accessing this UPS
systemd.user.units.<name>.upheldBy	Keep this unit running as long as the listed units are running
systemd.user.paths.<name>.upheldBy	Keep this unit running as long as the listed units are running
systemd.user.timers.<name>.bindsTo	Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.
systemd.user.slices.<name>.bindsTo	Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.
users.extraUsers.<name>.enable	If set to false, the user account will not be created
services.jigasi.userDomain	Domain part of the JID for XMPP user connection.
services.jicofo.userDomain	Domain part of the JID for XMPP user connection.
systemd.user.targets.<name>.partOf	If the specified units are stopped or restarted, then this unit is stopped or restarted as well.
systemd.user.sockets.<name>.partOf	If the specified units are stopped or restarted, then this unit is stopped or restarted as well.
systemd.user.sockets.<name>.wants	Start the specified units when this unit is started.
systemd.user.targets.<name>.wants	Start the specified units when this unit is started.
services.scollector.user	User account under which scollector runs.
services.szurubooru.user	User account under which Szurubooru runs.
services.mattermost.user	User which runs the Mattermost service.
services.privatebin.user	User account under which privatebin runs.
services.lubelogger.user	User account under which LubeLogger runs.
services.nullmailer.user	User to use to run nullmailer-send.
systemd.user.sockets.<name>.name	The name of this systemd unit, including its extension
systemd.user.targets.<name>.name	The name of this systemd unit, including its extension
systemd.user.timers.<name>.before	If the specified units are started at the same time as this unit, delay them until this unit has started.
systemd.user.slices.<name>.before	If the specified units are started at the same time as this unit, delay them until this unit has started.
services.forgejo.database.user	Database user.
services.redmine.database.user	Database user.
services.pdfding.database.user	PostgreSQL user
services.vikunja.database.user	Database user.
services.borgbackup.jobs.<name>.user	The user `borg` is run as
services.icecast.admin.user	Username used for all administration functions.
services.gnome.gnome-user-share.enable	Whether to enable GNOME User Share, a user-level file sharing service for GNOME.
users.mysql.pam	Settings for `pam_mysql`
users.ldap.base	The distinguished name of the search base.
systemd.user.paths.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.user.units.<name>.wantedBy	Units that want (i.e. depend on) this unit
users.users.<name>.password	Specifies the (clear text) password for the user
systemd.user.slices.<name>.aliases	Aliases of that unit.
systemd.user.timers.<name>.aliases	Aliases of that unit.
services.openvscode-server.user	The user to run openvscode-server as
systemd.user.targets.<name>.after	If the specified units are started at the same time as this unit, delay this unit until they have started.
systemd.user.sockets.<name>.after	If the specified units are started at the same time as this unit, delay this unit until they have started.
systemd.user.paths.<name>.upholds	Keeps the specified running while this unit is running
services.icecream.daemon.user	User to run the icecream daemon as
services.opensearch.user	The user OpenSearch runs as
services.komodo-periphery.user	User under which the Periphery agent runs.
services.autossh.sessions.*.user	Name of the user the AutoSSH session should run as
services.sourcehut.builds.user	User for builds.sr.ht.
services.zabbixProxy.database.user	Database user.
systemd.user.paths.<name>.onFailure	A list of one or more units that are activated when this unit enters the "failed" state.
systemd.user.paths.<name>.onSuccess	A list of one or more units that are activated when this unit enters the "inactive" state.
services.agorakit.mail.user	Mail username.
services.unpoller.loki.user	Username for Loki.
users.motdFile	A file containing the message of the day shown to users when they log in.
services.cloudflare-ddns.user	User account under which the service runs.
services.healthchecks.user	User account under which healthchecks runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the healthchecks service starts.
systemd.user.paths.<name>.pathConfig	Each attribute in this set specifies an option in the `[Path]` section of the unit
systemd.user.paths.<name>.unitConfig	Each attribute in this set specifies an option in the `[Unit]` section of the unit
environment.etc.<name>.user	User name of file owner
systemd.user.generators	Definition of systemd generators; see systemd.generator(5)
services.kimai.sites.<name>.database.user	Database user.
services.logcheck.ignoreCron.<name>.user	User that runs the cronjob.
services.borgbackup.repos.<name>.user	The user `borg serve` is run as
systemd.user.timers.<name>.upheldBy	Keep this unit running as long as the listed units are running
systemd.user.slices.<name>.upheldBy	Keep this unit running as long as the listed units are running
services.dawarich.smtp.user	SMTP login name.
services.mastodon.smtp.user	SMTP login name.
services.misskey.settings.db.user	The user used for database authentication.
systemd.user.timers.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.user.slices.<name>.wantedBy	Units that want (i.e. depend on) this unit
services.athens.index.postgres.user	User for the Postgres database.
systemd.user.sockets.<name>.bindsTo	Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.
systemd.user.targets.<name>.bindsTo	Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.
systemd.user.services.<name>.preStop	Shell commands executed to stop the service.
users.users.<name>.subGidRanges.*.count	Count of subordinate group ids
services.netbird.clients.<name>.user.name	A system user name for this client instance.
services.netbird.tunnels.<name>.user.name	A system user name for this client instance.
services.hbase-standalone.user	User account under which HBase runs.
services.castopod.database.user	Database user.
services.mastodon.database.user	Database user.
services.peertube.database.user	Database user.
services.windmill.database.user	Database user.
services.zabbixServer.database.user	Database user.
users.extraUsers.<name>.name	The name of the user account
systemd.user.services.<name>.wants	Start the specified units when this unit is started.
systemd.user.slices.<name>.upholds	Keeps the specified running while this unit is running
systemd.user.targets.<name>.before	If the specified units are started at the same time as this unit, delay them until this unit has started.
systemd.user.services.<name>.partOf	If the specified units are stopped or restarted, then this unit is stopped or restarted as well.
systemd.user.sockets.<name>.before	If the specified units are started at the same time as this unit, delay them until this unit has started.
systemd.user.timers.<name>.upholds	Keeps the specified running while this unit is running
services.movim.database.user	Database username.
users.extraUsers.<name>.subGidRanges	Subordinate group ids that user is allowed to use
services.asusd.userLedModesConfig	The content of /etc/asusd/asusd-user-ledmodes.ron
services.displayManager.autoLogin.user	User to be used for the automatic login.
services.grafana.settings.smtp.user	User used for authentication.
users.users.<name>.hashedPassword	Specifies the hashed password for the user
services.cloudlog.database.user	MySQL user name.
services.freshrss.database.user	Database user for FreshRSS.
services.dawarich.database.user	The database user for dawarich.
services.dragonflydb.user	The user to run DragonflyDB as
services.meshtasticd.user	User meshtasticd runs as.
services.writefreely.user	User under which Writefreely is ran.
systemd.user.sockets.<name>.aliases	Aliases of that unit.
systemd.user.targets.<name>.aliases	Aliases of that unit.
systemd.user.services.<name>.name	The name of this systemd unit, including its extension
services.znc.confOptions.userName	The user name used to log in to the ZNC web admin interface.
systemd.user.slices.<name>.onFailure	A list of one or more units that are activated when this unit enters the "failed" state.
systemd.user.timers.<name>.onSuccess	A list of one or more units that are activated when this unit enters the "inactive" state.
systemd.user.timers.<name>.onFailure	A list of one or more units that are activated when this unit enters the "failed" state.
systemd.user.slices.<name>.onSuccess	A list of one or more units that are activated when this unit enters the "inactive" state.
services.snipe-it.database.user	Database username.
services.drupal.sites.<name>.database.user	Database user.
users.users.<name>.useDefaultShell	If true, the user's shell will be set to `users.defaultUserShell`.
services.filebrowser.user	User account under which FileBrowser runs.
services.cockroachdb.user	User account under which CockroachDB runs
services.qbittorrent.user	User account under which qbittorrent runs.
users.mutableUsers	If set to `true`, you are free to add new users and groups to the system with the ordinary `useradd` and `groupadd` commands
services.firefly-iii-data-importer.user	User account under which firefly-iii-data-importer runs.
users.extraUsers.<name>.autoSubUidGidRange	Automatically allocate subordinate user and group ids for this user
systemd.user.timers.<name>.unitConfig	Each attribute in this set specifies an option in the `[Unit]` section of the unit
systemd.user.slices.<name>.unitConfig	Each attribute in this set specifies an option in the `[Unit]` section of the unit
services.sillytavern.user	User account under which the web-application run.
services.wyoming.satellite.user	User to run wyoming-satellite under.
systemd.user.services.<name>.after	If the specified units are started at the same time as this unit, delay this unit until they have started.
systemd.user.services.<name>.postStop	Shell commands executed after the service's main process has exited.
systemd.user.targets.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.user.sockets.<name>.wantedBy	Units that want (i.e. depend on) this unit
users.groups	Additional groups to be created automatically by the system.
services.vault-agent.instances.<name>.user	User under which this instance runs.
systemd.user.services.<name>.path	Packages added to the service's PATH environment variable
systemd.user.sockets.<name>.upheldBy	Keep this unit running as long as the listed units are running
systemd.user.targets.<name>.upheldBy	Keep this unit running as long as the listed units are running
users.mysql.host	The hostname of the MySQL/MariaDB server
systemd.user.services.<name>.preStart	Shell commands executed before the service's main process is started.
services.silverbullet.user	The user to run Silverbullet as
systemd.user.paths.<name>.enable	If set to false, this unit will be a symlink to /dev/null
systemd.user.units.<name>.enable	If set to false, this unit will be a symlink to /dev/null
systemd.user.paths.<name>.requires	Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.
services.bookstack.mail.user	Mail username.
services.monica.database.user	Database username.
systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user	The user of the file
systemd.user.slices.<name>.sliceConfig	Each attribute in this set specifies an option in the `[Slice]` section of the unit
systemd.user.services.<name>.script	Shell commands executed as the service's main process.
systemd.user.services.<name>.bindsTo	Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.
systemd.user.targets.<name>.upholds	Keeps the specified running while this unit is running
systemd.user.sockets.<name>.upholds	Keeps the specified running while this unit is running
users.users.<name>.initialPassword	Specifies the initial password for the user, i.e. the password assigned if the user does not already exist
virtualisation.appvm.user	AppVM user login
systemd.user.services.<name>.postStart	Shell commands executed after the service's main process is started.
systemd.user.services.<name>.reload	Shell commands executed when the service's main process is reloaded.
users.extraUsers	Alias of `users.users`.
power.ups.users	Users that can access upsd
services.suricata.settings.run-as.user	Run Suricata with a specific user-id.
systemd.user.paths.<name>.startLimitBurst	Configure unit start rate limiting
services.mediawiki.database.user	Database user.
services.mailman.ldap.userSearch.ou	Organizational unit to look up a user.
systemd.user.sockets.<name>.onFailure	A list of one or more units that are activated when this unit enters the "failed" state.
systemd.user.sockets.<name>.onSuccess	A list of one or more units that are activated when this unit enters the "inactive" state.
systemd.user.targets.<name>.onFailure	A list of one or more units that are activated when this unit enters the "failed" state.
systemd.user.targets.<name>.onSuccess	A list of one or more units that are activated when this unit enters the "inactive" state.
systemd.user.services.<name>.before	If the specified units are started at the same time as this unit, delay them until this unit has started.
systemd.user.timers.<name>.timerConfig	Each attribute in this set specifies an option in the `[Timer]` section of the unit
services.anubis.defaultOptions.user	The user under which Anubis is run
systemd.user.targets.<name>.unitConfig	Each attribute in this set specifies an option in the `[Unit]` section of the unit
systemd.user.sockets.<name>.unitConfig	Each attribute in this set specifies an option in the `[Unit]` section of the unit
users.extraUsers.<name>.subUidRanges.*.startUid	Start of the range of subordinate user ids that user is allowed to use.
systemd.user.services.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.user.services.<name>.aliases	Aliases of that unit.
services.anubis.instances.<name>.user	The user under which Anubis is run
systemd.user.slices.<name>.enable	If set to false, this unit will be a symlink to /dev/null
systemd.user.timers.<name>.enable	If set to false, this unit will be a symlink to /dev/null
users.extraUsers.<name>.linger	Whether to enable or disable lingering for this user
systemd.user.slices.<name>.requires	Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.
systemd.user.timers.<name>.requires	Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.
users.users.<name>.initialHashedPassword	Specifies the initial hashed password for the user, i.e. the hashed password assigned if the user does not already exist
services.oncall.settings.db.conn.kwargs.user	Database user.
services.unpoller.unifi.defaults.user	Unifi service user name.
systemd.user.units.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
systemd.user.paths.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
systemd.user.paths.<name>.conflicts	If the specified units are started, then this unit is stopped and vice versa.
services.blockbook-frontend.<name>.user	The user as which to run blockbook-frontend-‹name›.
systemd.user.services.<name>.upheldBy	Keep this unit running as long as the listed units are running
services.amazon-cloudwatch-agent.user	The user that runs the Amazon CloudWatch Agent.
services.foundationdb.user	User account under which FoundationDB runs.
services.matterbridge.user	User which runs the matterbridge service.
services.transmission.user	User account under which Transmission runs.
services.jigasi.userPasswordFile	Path to file containing password for XMPP user connection.
services.jicofo.userPasswordFile	Path to file containing password for XMPP user connection.
systemd.user.timers.<name>.startLimitBurst	Configure unit start rate limiting
systemd.user.slices.<name>.startLimitBurst	Configure unit start rate limiting
users.allowNoPasswordLogin	Disable checking that at least the `root` user or a user in the `wheel` group can log in using a password or an SSH key
services.sftpgo.settings.smtp.user	SMTP username.
services.authelia.instances.<name>.user	The name of the user for this authelia instance.
services.triggerhappy.user	User account under which `triggerhappy` runs.
services.hylafax.userAccessFile	The hosts.hfaxd file entry in the spooling area will be symlinked to the location given here
boot.loader.grub.users	User accounts for GRUB
services.kasmweb.postgres.user	Username to use for the postgres database.
users.mysql.nss	Settings for `libnss-mysql`
systemd.user.paths.<name>.requisite	Similar to requires
systemd.user.services.<name>.upholds	Keeps the specified running while this unit is running
programs.weylus.users	To enable stylus and multi-touch support, the user you're going to use must be added to this list
users.users.<name>.hashedPasswordFile	The full path to a file that contains the hash of the user's password
users.ldap.useTLS	If enabled, use TLS (encryption) over an LDAP (port 389) connection
services.xserver.desktopManager.phosh.user	The user to run the Phosh service.
users.ldap.loginPam	Whether to include authentication against LDAP in login PAM.
programs.fuse.userAllowOther	Allow non-root users to specify the allow_other or allow_root mount options, see mount.fuse3(8).
services.nginx.tailscaleAuth.user	Alias of `services.tailscaleAuth.user`.
systemd.user.services.<name>.startAt	Automatically start this unit at the given date/time, which must be in the format described in systemd.time(7)
services.filesender.database.user	Database user.
services.szurubooru.database.user	PostgreSQL user.
services.limesurvey.database.user	Database user.
services.reposilite.database.user	Database user.
systemd.user.services.<name>.onFailure	A list of one or more units that are activated when this unit enters the "failed" state.
systemd.user.services.<name>.onSuccess	A list of one or more units that are activated when this unit enters the "inactive" state.
services.znc.confOptions.userModules	A list of user modules to include in the znc.conf file.
users.ldap.server	The URL of the LDAP server.
users.users.<name>.description	A short description of the user account, typically the user's full name
systemd.user.timers.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
systemd.user.slices.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
systemd.user.timers.<name>.conflicts	If the specified units are started, then this unit is stopped and vice versa.
systemd.user.slices.<name>.conflicts	If the specified units are started, then this unit is stopped and vice versa.
services.plausible.mail.smtp.user	The username/email in case SMTP auth is enabled.
services.mailman.ldap.userSearch.query	Query to find a user in the LDAP database.
services.linkwarden.database.user	The database user for Linkwarden.
systemd.user.services.<name>.unitConfig	Each attribute in this set specifies an option in the `[Unit]` section of the unit
services.anki-sync-server.users.*.username	User name accepted by anki-sync-server.
users.users.<name>.ignoreShellProgramCheck	By default, nixos will check that programs
users.extraUsers.<name>.isSystemUser	Indicates if the user is a system user or not
users.groups.<name>.members	The user names of the group members, added to the `/etc/group` file.
systemd.user.targets.<name>.requires	Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.
systemd.user.sockets.<name>.requires	Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.
systemd.user.targets.<name>.enable	If set to false, this unit will be a symlink to /dev/null
systemd.user.sockets.<name>.enable	If set to false, this unit will be a symlink to /dev/null
users.mysql.passwordFile	The path to the file containing the password for the user
services.netbird.server.coturn.user	The username used by netbird to connect to the coturn server.
systemd.user.sockets.<name>.socketConfig	Each attribute in this set specifies an option in the `[Socket]` section of the unit
boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.user	The user of the file
services.fcgiwrap.instances.<name>.process.user	User as which this instance of fcgiwrap will be run
services.keepalived.vrrpScripts.<name>.user	Name of user to run the script under.
systemd.user.sockets.<name>.startLimitBurst	Configure unit start rate limiting
systemd.user.services.<name>.scriptArgs	Arguments passed to the main process script
systemd.user.targets.<name>.startLimitBurst	Configure unit start rate limiting
services.agorakit.database.user	Database username.
services.dolibarr.database.user	Database username.
services.unpoller.influxdb.user	Username for the influxdb.
services.nntp-proxy.users	NNTP-Proxy user configuration
systemd.user.slices.<name>.requisite	Similar to requires
systemd.user.timers.<name>.requisite	Similar to requires
users.ldap.enable	Whether to enable authentication against an LDAP server.
services.grafana.settings.database.user	The database user (not applicable for `sqlite3`).
users.extraGroups	Alias of `users.groups`.
services.prosody.uploadHttp.userQuota	Maximum size of all uploaded files per user, in bytes
services.wordpress.sites.<name>.database.user	Database user.
systemd.user.sockets.<name>.listenStreams	For each item in this list, a `ListenStream` option in the `[Socket]` section will be created.
services.gancio.userLocale	Override default locales within gancio
power.ups.users.<name>.actions	Allow the user to do certain things with upsd
hardware.cpu.intel.sgx.provision.user	Owner to assign to the SGX provisioning device.
services.nebula-lighthouse-service.user	The user and group to run nebula-lighthouse-service as.
users.ldap.daemon.enable	Whether to let the nslcd daemon (nss-pam-ldapd) handle the LDAP lookups for NSS and PAM
systemd.user.sockets.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
systemd.user.targets.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
systemd.user.sockets.<name>.conflicts	If the specified units are started, then this unit is stopped and vice versa.
systemd.user.targets.<name>.conflicts	If the specified units are started, then this unit is stopped and vice versa.
services.netbird.tunnels.<name>.user.group	A system group name for this client instance.
services.netbird.clients.<name>.user.group	A system group name for this client instance.
services.consul-template.instances.<name>.user	User under which this instance runs.
services.matrix-continuwuity.user	The user `continuwuity` is run as.
services.wasabibackend.user	The user as which to run the wasabibackend node.
users.extraUsers.<name>.createHome	Whether to create the home directory and ensure ownership as well as permissions to match the user.
users.mysql.pam.where	Additional criteria for the query.
systemd.user.services.<name>.requires	Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.
systemd.user.services.<name>.enable	If set to false, this unit will be a symlink to /dev/null
services.avahi.publish.userServices	Whether to publish user services
services.writefreely.database.user	The database user to connect as.
services.anuko-time-tracker.database.user	Database username.
systemd.user.targets.<name>.requisite	Similar to requires
systemd.user.paths.<name>.restartTriggers	An arbitrary list of items such as derivations
systemd.user.sockets.<name>.requisite	Similar to requires
services.fcgiwrap.instances.<name>.socket.user	User to be set as owner of the UNIX socket.
users.extraUsers.<name>.password	Specifies the (clear text) password for the user
systemd.user.services.<name>.startLimitBurst	Configure unit start rate limiting
services.akkoma.initDb.username	Name of the database user to initialise the database with
services.nextcloud-spreed-signaling.user	User account under which to run the Spreed signaling server.
services.foldingathome.user	The user associated with the reported computation results
services.wasabibackend.rpc.user	RPC user for the bitcoin endpoint.
services.taskchampion-sync-server.user	Unix User to run the server under
systemd.user.paths.<name>.reloadTriggers	An arbitrary list of items such as derivations
services.bookstack.database.user	Database username.
systemd.user.paths.<name>.startLimitIntervalSec	Configure unit start rate limiting
users.defaultUserShell	This option defines the default shell assigned to user accounts
users.extraUsers.<name>.hashedPassword	Specifies the hashed password for the user
services.prometheus.exporters.pve.user	User name under which the pve exporter shall be run.
services.prometheus.exporters.nut.user	User name under which the nut exporter shall be run.
services.prometheus.exporters.kea.user	User name under which the kea exporter shall be run.
services.prometheus.exporters.sql.user	User name under which the sql exporter shall be run.
services.prometheus.exporters.zfs.user	User name under which the zfs exporter shall be run.
services.prometheus.exporters.lnd.user	User name under which the lnd exporter shall be run.
systemd.user.services.<name>.conflicts	If the specified units are started, then this unit is stopped and vice versa.
systemd.user.services.<name>.requiredBy	Units that require (i.e. depend on and need to go down with) this unit
services.asusd.userLedModesConfig.text	Text of the file.
users.extraGroups.<name>.members	The user names of the group members, added to the `/etc/group` file.
users.groups.<name>.gid	The group GID
systemd.user.slices.<name>.restartTriggers	An arbitrary list of items such as derivations
systemd.user.timers.<name>.restartTriggers	An arbitrary list of items such as derivations
users.mysql.enable	Whether to enable authentication against a MySQL/MariaDB database.
users.extraUsers.<name>.subUidRanges.*.count	Count of subordinate user ids
services.prometheus.exporters.snmp.user	User name under which the snmp exporter shall be run.
services.prometheus.exporters.bind.user	User name under which the bind exporter shall be run.
services.prometheus.exporters.ipmi.user	User name under which the ipmi exporter shall be run.
services.prometheus.exporters.flow.user	User name under which the flow exporter shall be run.
services.prometheus.exporters.nats.user	User name under which the nats exporter shall be run.
services.prometheus.exporters.mail.user	User name under which the mail exporter shall be run.
services.prometheus.exporters.ping.user	User name under which the ping exporter shall be run.
services.prometheus.exporters.bird.user	User name under which the bird exporter shall be run.
services.prometheus.exporters.ebpf.user	User name under which the ebpf exporter shall be run.
services.prometheus.exporters.json.user	User name under which the json exporter shall be run.
services.prometheus.exporters.mqtt.user	User name under which the mqtt exporter shall be run.
services.prometheus.exporters.node.user	User name under which the node exporter shall be run.
services.prometheus.exporters.knot.user	User name under which the knot exporter shall be run.
services.bitmagnet.settings.postgres.user	User to connect as
systemd.user.services.<name>.serviceConfig	Each attribute in this set specifies an option in the `[Service]` section of the unit
users.mysql.pam.table	The name of table that maps unique login names to the passwords.
services.prometheus.exporters.php-fpm.user	User name under which the php-fpm exporter shall be run.
boot.initrd.systemd.users.<name>.uid	ID of the user in initrd.
services.prometheus.exporters.chrony.user	User name under which the chrony exporter shall be run
systemd.user.paths.<name>.description	Description of this unit used in systemd messages and progress indicators.
services.diod.squashuser	Change the squash user
systemd.user.slices.<name>.reloadTriggers	An arbitrary list of items such as derivations
systemd.user.timers.<name>.reloadTriggers	An arbitrary list of items such as derivations
services.prometheus.exporters.node-cert.user	User owning the certs.
systemd.user.services.<name>.requisite	Similar to requires
systemd.user.slices.<name>.startLimitIntervalSec	Configure unit start rate limiting
systemd.user.timers.<name>.startLimitIntervalSec	Configure unit start rate limiting
users.mysql.pam.statusColumn	The name of the column or an SQL expression that indicates the status of the user
services.prometheus.exporters.nginx.user	User name under which the nginx exporter shall be run.
services.prometheus.exporters.kafka.user	User name under which the kafka exporter shall be run.
services.prometheus.exporters.redis.user	User name under which the redis exporter shall be run.
services.prometheus.exporters.fritz.user	User name under which the fritz exporter shall be run.
services.prometheus.exporters.idrac.user	User name under which the idrac exporter shall be run.
services.prometheus.exporters.jitsi.user	User name under which the jitsi exporter shall be run.
services.prometheus.exporters.dmarc.user	User name under which the dmarc exporter shall be run.
services.prometheus.exporters.v2ray.user	User name under which the v2ray exporter shall be run.
users.extraUsers.<name>.home	The user's home directory.
services.unpoller.unifi.controllers.*.user	Unifi service user name.
services.pretix.settings.database.user	Database username.
services.prometheus.exporters.frr.user	User name under which the frr exporter shall be run
services.github-runners.<name>.group	Group under which to run the service
services.audiobookshelf.user	User account under which Audiobookshelf runs.
services.libretranslate.user	User account under which libretranslate runs.
services.nntp-proxy.users.<name>.username	Username
services.szurubooru.server.settings.smtp.user	User to connect to the SMTP server.
systemd.user.services.<name>.restartIfChanged	Whether the service should be restarted during a NixOS configuration switch if its definition has changed.
system.userActivationScripts	A set of shell script fragments that are executed by a systemd user service when a NixOS system configuration is activated
services.privoxy.userActions	Actions to be included in a `user.action` file
services.guacamole-server.userMappingXml	Configuration file that correspond to `user-mapping.xml`.
services.guacamole-client.userMappingXml	Configuration file that correspond to `user-mapping.xml`.
users.groups.<name>.name	The name of the group
services.blockbook-frontend.<name>.rpc.user	Username for JSON-RPC connections.
systemd.user.sockets.<name>.listenDatagrams	For each item in this list, a `ListenDatagram` option in the `[Socket]` section will be created.
systemd.user.targets.<name>.restartTriggers	An arbitrary list of items such as derivations
systemd.user.sockets.<name>.restartTriggers	An arbitrary list of items such as derivations
services.homebridge.userStoragePath	Path to store homebridge user files (needs to be writeable).
users.ldap.timeLimit	Specifies the time limit (in seconds) to use when performing searches
systemd.user.slices.<name>.description	Description of this unit used in systemd messages and progress indicators.
systemd.user.timers.<name>.description	Description of this unit used in systemd messages and progress indicators.
services.userdbd.enable	Whether to enable the systemd JSON user/group record lookup service .
systemd.user.services.<name>.enableDefaultPath	Whether to append a minimal default PATH environment variable to the service, containing common system utilities.
services.privoxy.userFilters	Filters to be included in a `user.filter` file
users.extraUsers.<name>.initialPassword	Specifies the initial password for the user, i.e. the password assigned if the user does not already exist
services.openvscode-server.userDataDir	Specifies the directory that user data is kept in
users.extraUsers.<name>.packages	The set of packages that should be made available to the user
services.prometheus.exporters.statsd.user	User name under which the statsd exporter shall be run.
services.prometheus.exporters.dnssec.user	User name under which the dnssec exporter shall be run.
services.prometheus.exporters.script.user	User name under which the script exporter shall be run.
services.prometheus.exporters.mysqld.user	User name under which the mysqld exporter shall be run.
services.prometheus.exporters.deluge.user	User name under which the deluge exporter shall be run.
services.prometheus.exporters.domain.user	User name under which the domain exporter shall be run.
services.prometheus.exporters.fastly.user	User name under which the fastly exporter shall be run.
services.prometheus.exporters.restic.user	User name under which the restic exporter shall be run.
services.prometheus.exporters.pihole.user	User name under which the pihole exporter shall be run.
services.prometheus.exporters.shelly.user	User name under which the shelly exporter shall be run.
services.prometheus.exporters.rspamd.user	User name under which the rspamd exporter shall be run.
services.prometheus.exporters.tibber.user	User name under which the tibber exporter shall be run.
users.extraUsers.<name>.initialHashedPassword	Specifies the initial hashed password for the user, i.e. the hashed password assigned if the user does not already exist
systemd.user.targets.<name>.reloadTriggers	An arbitrary list of items such as derivations
systemd.user.sockets.<name>.reloadTriggers	An arbitrary list of items such as derivations
services.anki-sync-server.users	List of user-password pairs to provide to the sync server.
services.mattermost.database.user	Local Mattermost database username.
users.extraUsers.<name>.uid	The account UID
systemd.user.targets.<name>.startLimitIntervalSec	Configure unit start rate limiting
systemd.user.sockets.<name>.startLimitIntervalSec	Configure unit start rate limiting
users.extraUsers.<name>.subGidRanges.*.startGid	Start of the range of subordinate group ids that user is allowed to use.
systemd.user.services.<name>.stopIfChanged	If set, a changed unit is restarted by calling `systemctl stop` in the old configuration, then `systemctl start` in the new one
services.prometheus.exporters.nvidia-gpu.user	User name under which the nvidia-gpu exporter shall be run.
services.pretalx.settings.database.user	Database username.
users.mysql.pam.logging.hostColumn	The name of the column in the log table to which the name of the user being authenticated is stored.
services.sourcehut.settings.mail.smtp-user	Outgoing SMTP user.
services.prometheus.exporters.rtl_433.user	User name under which the rtl_433 exporter shall be run.
services.asusd.userLedModesConfig.source	Path of the source file.
services.prometheus.exporters.systemd.user	User name under which the systemd exporter shall be run.
services.prometheus.exporters.bitcoin.user	User name under which the bitcoin exporter shall be run.
services.prometheus.exporters.varnish.user	User name under which the varnish exporter shall be run.
services.prometheus.exporters.apcupsd.user	User name under which the apcupsd exporter shall be run.
services.prometheus.exporters.ecoflow.user	User name under which the ecoflow exporter shall be run.
services.prometheus.exporters.dovecot.user	User name under which the dovecot exporter shall be run.
services.prometheus.exporters.process.user	User name under which the process exporter shall be run.
services.prometheus.exporters.dnsmasq.user	User name under which the dnsmasq exporter shall be run.
services.prometheus.exporters.libvirt.user	User name under which the libvirt exporter shall be run.
services.prometheus.exporters.sabnzbd.user	User name under which the sabnzbd exporter shall be run.
services.prometheus.exporters.mongodb.user	User name under which the mongodb exporter shall be run.
services.prometheus.exporters.postfix.user	User name under which the postfix exporter shall be run.
services.prometheus.exporters.klipper.user	User name under which the klipper exporter shall be run.
services.prometheus.exporters.unbound.user	User name under which the unbound exporter shall be run.
systemd.user.targets.<name>.description	Description of this unit used in systemd messages and progress indicators.
systemd.user.sockets.<name>.description	Description of this unit used in systemd messages and progress indicators.
boot.initrd.systemd.users.<name>.group	Group the user belongs to in initrd.
users.extraUsers.<name>.group	The user's primary group.
systemd.user.services.<name>.reloadIfChanged	Whether the service should be reloaded during a NixOS configuration switch if its definition has changed
users.extraUsers.<name>.expires	Set the date on which the user's account will no longer be accessible
systemd.user.services.<name>.restartTriggers	An arbitrary list of items such as derivations
services.bitwarden-directory-connector-cli.user	User to run the program.
services.parsedmarc.settings.smtp.user	The SMTP server username.
services.parsedmarc.settings.imap.user	The IMAP server username.
users.defaultUserHome	The default home directory for normal users.
systemd.user.services.<name>.reloadTriggers	An arbitrary list of items such as derivations
services.invoiceplane.sites.<name>.database.user	Database user.
services.opkssh.authorizations.*.user	Linux user to authorize
services.userborn.static	Whether to generate the password files at build time and store them directly in the system closure, without requiring any services at boot time
services.cpuminer-cryptonight.user	Username for mining server
systemd.user.services.<name>.startLimitIntervalSec	Configure unit start rate limiting
services.prometheus.exporters.py-air-control.user	User name under which the py-air-control exporter shall be run.
users.extraUsers.<name>.isNormalUser	Indicates whether this is an account for a “real” user
services.prometheus.exporters.mailman3.user	User name under which the mailman3 exporter shall be run.
power.ups.users.<name>.instcmds	Let the user initiate specific instant commands
services.calibre-server.auth.userDb	Choose users database file to use for authentication
systemd.user.services.<name>.environment	Environment variables passed to the service's processes.
services.vsftpd.userlistDeny	Specifies whether `userlistFile` is a list of user names to allow or deny access
services.prometheus.exporters.influxdb.user	User name under which the influxdb exporter shall be run.
services.prometheus.exporters.opnsense.user	User name under which the opensense exporter shall be run.
services.prometheus.exporters.smartctl.user	User name under which the smartctl exporter shall be run.
services.prometheus.exporters.fritzbox.user	User name under which the fritzbox exporter shall be run.
services.prometheus.exporters.mikrotik.user	User name under which the mikrotik exporter shall be run.
services.prometheus.exporters.nginxlog.user	User name under which the nginxlog exporter shall be run.
services.prometheus.exporters.postgres.user	User name under which the postgres exporter shall be run.
services.prometheus.exporters.unpoller.user	User name under which the unpoller exporter shall be run.
services.prometheus.exporters.graphite.user	User name under which the graphite exporter shall be run.
services.prometheus.exporters.blackbox.user	User name under which the blackbox exporter shall be run.
services.prometheus.exporters.keylight.user	User name under which the keylight exporter shall be run.
services.prometheus.exporters.collectd.user	User name under which the collectd exporter shall be run.
services.changedetection-io.user	User account under which changedetection-io runs.
systemd.user.services.<name>.description	Description of this unit used in systemd messages and progress indicators.
services.actual.settings.userFiles	The server will put all the budget files in this directory as binary blobs.
services.xserver.displayManager.lightdm.greeters.mini.user	The user to login as.
users.extraUsers.<name>.hashedPasswordFile	The full path to a file that contains the hash of the user's password
users.extraGroups.<name>.gid	The group GID
services.marytts.userDictionaries	Paths to the user dictionary files for MaryTTS.
services.prometheus.exporters.imap-mailstat.user	User name under which the imap-mailstat exporter shall be run.
users.ldap.nsswitch	Whether to include lookup against LDAP in NSS.
services.headscale.settings.database.postgres.user	Database user.
systemd.user.units.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
systemd.user.paths.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
users.ldap.bind.timeLimit	Specifies the time limit (in seconds) to use when connecting to the directory server
services.prometheus.exporters.surfboard.user	User name under which the surfboard exporter shall be run.
services.prometheus.exporters.tailscale.user	User name under which the tailscale exporter shall be run.
services.prometheus.exporters.wireguard.user	User name under which the wireguard exporter shall be run.
services.prometheus.exporters.rasdaemon.user	User name under which the rasdaemon exporter shall be run.
services.prometheus.exporters.borgmatic.user	User name under which the borgmatic exporter shall be run.
services.prometheus.exporters.smokeping.user	User name under which the smokeping exporter shall be run.
services.prometheus.exporters.pgbouncer.user	User name under which the pgbouncer exporter shall be run.
services.prometheus.exporters.nextcloud.user	User name under which the nextcloud exporter shall be run.
services.prometheus.exporters.junos-czerwonk.user	User name under which the junos-czerwonk exporter shall be run.
services.sourcehut.settings."pages.sr.ht".user-domain	Configures the user domain, if enabled
systemd.user.paths.<name>.documentation	A list of URIs referencing documentation for this unit or its configuration.
services.firefox-syncserver.database.user	Username for database connections.
systemd.user.services.<name>.notSocketActivated	If set, a changed unit is never assumed to be socket-activated on configuration switch, even if it might have associated socket units
users.extraGroups.<name>.name	The name of the group
services.bitcoind.<name>.rpc.users	RPC user information for JSON-RPC connections.
systemd.user.timers.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
systemd.user.slices.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
services.ddclient.username	User name.
users.mysql.database	The name of the database containing the users
systemd.user.slices.<name>.documentation	A list of URIs referencing documentation for this unit or its configuration.
systemd.user.timers.<name>.documentation	A list of URIs referencing documentation for this unit or its configuration.
services.prometheus.exporters.buildkite-agent.user	User name under which the buildkite-agent exporter shall be run.
services.prometheus.exporters.scaphandre.user	User name under which the scaphandre exporter shall be run.
services.prometheus.exporters.storagebox.user	User name under which the storagebox exporter shall be run.
users.ldap.extraConfig	Extra configuration options that will be added verbatim at the end of the ldap configuration file (ldap.conf(5))
services.jitsi-videobridge.xmppConfigs.<name>.userName	User part of the JID.
users.mysql.pam.verbose	If enabled, produces logs with detailed messages that describes what `pam_mysql` is doing
services.matrix-synapse.settings.database.args.user	Username to connect with psycopg2, set to null when using sqlite3.
systemd.oomd.enableUserSlices	Whether to enable oomd on all user slices (`user@.slice`) and all user owned slices.
systemd.user.sockets.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
systemd.user.targets.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
users.extraUsers.<name>.homeMode	The user's home directory mode in numeric format
power.ups.users.<name>.upsmon	Add the necessary actions for a upsmon process to work
services.prometheus.exporters.exportarr-lidarr.user	User name under which the exportarr-lidarr exporter shall be run.
services.prometheus.exporters.exportarr-sonarr.user	User name under which the exportarr-sonarr exporter shall be run.
services.prometheus.exporters.exportarr-radarr.user	User name under which the exportarr-radarr exporter shall be run.
services.prometheus.exporters.exportarr-bazarr.user	User name under which the exportarr-bazarr exporter shall be run.
systemd.user.sockets.<name>.documentation	A list of URIs referencing documentation for this unit or its configuration.
systemd.user.targets.<name>.documentation	A list of URIs referencing documentation for this unit or its configuration.
services.lighttpd.mod_userdir	If true, requests in the form /~user/page.html are rewritten to take the file public_html/page.html from the home directory of the user.
services.samba.usershares.enable	Whether to enable user-configurable Samba shares.
users.extraUsers.<name>.shell	The path to the user's shell
systemd.user.services.<name>.enableStrictShellChecks	Enable running `shellcheck` on the generated scripts for this unit
services.prometheus.exporters.exportarr-readarr.user	User name under which the exportarr-readarr exporter shall be run.
services.prometheus.exporters.artifactory.user	User name under which the artifactory exporter shall be run.
users.extraUsers.<name>.pamMount	Attributes for user's entry in pam_mount.conf.xml
systemd.user.services.<name>.overrideStrategy	Defines how unit configuration is provided for systemd: `asDropinIfExists` creates a unit file when no unit file is provided by the package otherwise it creates a drop-in file named `overrides.conf`. `asDropin` creates a drop-in file named `overrides.conf`
users.mysql.nss.getpwnam	SQL query for the getpwnam syscall.
users.mysql.nss.getgrgid	SQL query for the getgrgid syscall.
users.mysql.nss.getgrnam	SQL query for the getgrnam syscall.
users.mysql.nss.getspnam	SQL query for the getspnam syscall.
users.mysql.nss.getspent	SQL query for the getspent syscall.
users.mysql.nss.getgrent	SQL query for the getgrent syscall.
users.mysql.nss.getpwuid	SQL query for the getpwuid syscall.
users.mysql.nss.getpwent	SQL query for the getpwent syscall.
services.bloop.install	Whether to install a user service for the Bloop server
systemd.user.services.<name>.documentation	A list of URIs referencing documentation for this unit or its configuration.
users.mysql.pam.updateTable	The name of the table used for password alteration
services.mastodon.elasticsearch.user	Used for optionally authenticating with Elasticsearch.
users.extraUsers.<name>.extraGroups	The user's auxiliary groups.
users.extraUsers.<name>.cryptHomeLuks	Path to encrypted luks device that contains the user's home directory.
boot.initrd.systemd.users	Users to include in initrd.
services.prometheus.exporters.exportarr-prowlarr.user	User name under which the exportarr-prowlarr exporter shall be run.
users.ldap.daemon.rootpwmoddn	The distinguished name to use to bind to the LDAP server when the root user tries to modify a user's password.
boot.loader.grub.users.<name>.passwordFile	Specifies the path to a file containing the clear text password for the account
users.mysql.pam.cryptDefault	The default encryption method to use for `passwordCrypt = 1`.
users.mysql.pam.logging.table	The name of the table to which logs are written.
services.prometheus.exporters.unpoller.loki.user	Username for Loki.
services.prometheus.exporters.modemmanager.user	User name under which the modemmanager exporter shall be run.
services.murmur.users	Maximum number of concurrent clients allowed.
services.bitwarden-directory-connector-cli.sync.userPath	User directory, relative to root.
services.nextcloud.config.dbuser	Database user.
users.extraUsers.<name>.description	A short description of the user account, typically the user's full name
services.grafana.settings.users.user_invite_max_lifetime_duration	The duration in time a user invitation remains valid before expiring
power.ups.upsmon.group	Group for the default `nutmon` user
users.ldap.daemon.rootpwmodpwFile	The path to a file containing the credentials with which to bind to the LDAP server if the root user tries to change a user's password.
services.diod.userdb	This option disables password/group lookups
users.extraUsers.<name>.ignoreShellProgramCheck	By default, nixos will check that programs
networking.openconnect.interfaces.<name>.user	Username to authenticate with.
security.pam.oath.usersFile	Set the path to file where the user's credentials are stored
services.sourcehut.settings."meta.sr.ht::settings".user-invites	How many invites each user is issued upon registration (only applicable if open registration is disabled).
services.discourse.admin.username	The admin user username.
services.dependency-track.oidc.userProvisioning	Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication
users.users.<name>.openssh.authorizedKeys.keys	A list of verbatim OpenSSH public keys that should be added to the user's authorized keys
services.xserver.displayManager.lightdm.greeters.tiny.label.user	The string to represent the user_text label.
users.ldap.bind.passwordFile	The path to a file containing the credentials to use when binding to the LDAP server (if not binding anonymously).
services.honk.username	The admin account username.
services.prometheus.exporters.unpoller.controllers.*.user	Unifi service user name.
users.users.<name>.openssh.authorizedKeys.keyFiles	A list of files each containing one OpenSSH public key that should be added to the user's authorized keys
services.emacs.install	Whether to install a user service for the Emacs daemon
services.pgbouncer.settings.pgbouncer.max_user_connections	Do not allow more than this many server connections per user (regardless of database)
users.ldap.daemon.extraConfig	Extra configuration options that will be added verbatim at the end of the nslcd configuration file (nslcd.conf(5)).
services.ttyd.username	Username for basic http authentication.
users.manageLingering	Whether to manage whether users linger or not.
services.vsftpd.userlist	See `userlistFile`.
users.mysql.nss.memsbygid	SQL query for the memsbygid syscall.
users.mysql.nss.gidsbymem	SQL query for the gidsbymem syscall.
users.mysql.pam.logging.enable	Enables logging of authentication attempts in the MySQL database.
services.hound.home	The path to use as hound's $HOME
services.prometheus.exporters.mailman3.mailman.user	Mailman3 Core REST API username.
users.extraUsers.<name>.subGidRanges.*.count	Count of subordinate group ids
services.postsrsd.settings.unprivileged-user	Unprivileged user to drop privileges to. Our systemd unit never runs postsrsd as a privileged process, so this option is read-only.
security.sudo.extraRules.*.runAs	Under which user/group the specified command is allowed to run
users.extraUsers.<name>.useDefaultShell	If true, the user's shell will be set to `users.defaultUserShell`.
security.sudo-rs.extraRules.*.runAs	Under which user/group the specified command is allowed to run
security.allowUserNamespaces	Whether to allow creation of user namespaces
services.vsftpd.userlistFile	Newline separated list of names to be allowed/denied if `userlistEnable` is `true`
users.ldap.bind.policy	Specifies the policy to use for reconnecting to an unavailable LDAP server
services.iio-niri.niriUnit	The Niri user service unit to bind IIO-Niri's user service unit to.
services.userborn.enable	Whether to enable userborn.
services.pgbouncer.settings.users	Optional
virtualisation.oci-containers.containers.<name>.podman.user	The user under which the container should run.
security.doas.extraRules.*.users	The usernames / UIDs this rule should apply for.
security.sudo.extraRules.*.users	The usernames / UIDs this rule should apply for.
boot.loader.grub.users.<name>.hashedPasswordFile	Specifies the path to a file containing the password hash for the account, generated with grub-mkpasswd-pbkdf2
services.stargazer.allowCgiUser	When enabled, the stargazer process will be given `CAP_SETGID` and `CAP_SETUID` so that it can run cgi processes as a different user
i18n.inputMethod.fcitx5.ignoreUserConfig	Ignore the user configures. Warning: When this is enabled, the user config files are totally ignored and the user dict can't be saved and loaded.
services.bcg.mqtt.username	MQTT server access username.
users.mysql.pam.logging.msgColumn	The name of the column in the log table to which the description of the performed operation is stored.
users.users.<name>.openssh.authorizedPrincipals	A list of verbatim principal names that should be added to the user's authorized principals.
security.sudo-rs.extraRules.*.users	The usernames / UIDs this rule should apply for.
services.gocd-agent.group	If the default user "gocd-agent" is configured then this is the primary group of that user.
users.mysql.pam.passwordColumn	The name of the column that contains a (encrypted) password string.
security.duosec.prompts	If a user fails to authenticate with a second factor, Duo Unix will prompt the user to authenticate again
services.stash.username	Username for login. This option takes precedence over `services.stash.settings.username`
users.mysql.pam.logging.pidColumn	The name of the column in the log table to which the pid of the process utilising the `pam_mysql` authentication service is stored.
services.librenms.database.username	Name of the user on the MySQL/MariaDB server
users.mysql.pam.logging.timeColumn	The name of the column in the log table to which the timestamp of the log entry is stored.
networking.wireless.userControlled.group	Members of this group can control wpa_supplicant.
services.influxdb2.provision.users.<name>.passwordFile	Password for the user
boot.initrd.systemd.users.<name>.shell	The path to the user's shell in initrd.
services.bitlbee.authMode	The following authentication modes are available: Open -- Accept connections from anyone, use NickServ for user authentication
services.userborn.package	The userborn package to use.
services.cntlm.username	Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
services.discourse.database.username	Discourse database user.
power.ups.users.<name>.passwordFile	The full path to a file that contains the user's (clear text) password
services.vsftpd.userlistEnable	Whether users are included.
services.parsedmarc.settings.elasticsearch.user	Username to use when connecting to Elasticsearch, if required.
services.jenkins.home	The path to use as JENKINS_HOME
services.jenkins.group	If the default user "jenkins" is configured then this is the primary group of that user.
services.gocd-server.group	If the default user "gocd-server" is configured then this is the primary group of that user.
services.nntp-proxy.users.<name>.maxConnections	Maximum number of concurrent connections to the proxy for this user
nix.sshServe.write	Whether to enable writing to the Nix store as a remote store via SSH
services.yandex-disk.username	Your yandex.com login name.
services.cloudlog.update-lotw-users.interval	Specification (in the format described by systemd.time(7)) of the time at which the LoTW user update will occur.
systemd.sysusers.enable	If enabled, users are created with systemd-sysusers instead of with the custom `update-users-groups.pl` script
services.dependency-track.settings."alpine.oidc.user.provisioning"	Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication
services.etebase-server.enable	Whether to enable the Etebase server
boot.initrd.network.ssh.shell	Login shell of the remote user
networking.wireless.userControlled	Allow users of the `wpa_supplicant` group to control wpa_supplicant through wpa_gui or wpa_cli
services.roundcube.database.username	Username for the postgresql connection
services.keycloak.database.username	Username to use when connecting to an external or manually provisioned database; has no effect when a local database is automatically provisioned
services.gitlab.smtp.username	Username of the SMTP server for GitLab.
users.mysql.pam.logging.rHostColumn	The name of the column in the log table to which the name of the remote host that initiates the session is stored
virtualisation.oci-containers.containers.<name>.user	Override the username or UID (and optionally groupname or GID) used in the container.
services.nullidentdmod.userid	User ID to return
programs.zsh.enable	Whether to configure zsh as an interactive shell
networking.supplicant.<name>.userControlled.group	Members of this group can control wpa_supplicant.
services.grafana.settings.users.allow_sign_up	Set to false to prohibit users from being able to sign up / create user accounts
hardware.openrazer.users	Usernames to be added to the "openrazer" group, so that they can start and interact with the OpenRazer userspace daemon.
virtualisation.lxc.usernetConfig	This is the config file for managing unprivileged user network administration access in LXC
services.outline.smtp.username	Username to authenticate with.
networking.wireless.userControlled.enable	Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli
users.enforceIdUniqueness	Whether to require that no two users/groups share the same uid/gid.
services.bitwarden-directory-connector-cli.sync.userFilter	LDAP filter for users.
nix.settings.trusted-users	A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs
services.jenkinsSlave.home	The path to use as JENKINS_HOME
services.grafana.settings.users.hidden_users	This is a comma-separated list of usernames
services.samba.usershares.group	Name of the group members of which will be allowed to create usershares
nix.settings.allowed-users	A list of names of users (separated by whitespace) that are allowed to connect to the Nix daemon
boot.loader.grub.users.<name>.password	Specifies the clear text password for the account
services.xserver.displayManager.lightdm.greeters.slick.draw-user-backgrounds	Whether to enable draw user backgrounds.
services.ncps.cache.redis.username	Redis username for authentication (for Redis ACL).
services.saned.enable	Enable saned network daemon for remote connection to scanners. saned would be run from `scanner` user; to allow access to hardware that doesn't have `scanner` group you should add needed groups to this user.
networking.supplicant.<name>.userControlled.socketDir	Directory of sockets for controlling wpa_supplicant.
services.paretosecurity.users	Per-user Pareto Security configuration.
services.nextcloud.notify_push.dbuser	Database user.
services.jenkinsSlave.group	If the default slave agent user "jenkins" is configured then this is the primary group of that user.
services.influxdb2.provision.users.<name>.present	Whether to ensure that this user is present or absent.
services.inadyn.group	Group account under which inadyn runs. If left as the default value this user will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the inadyn service starts.
services.bitwarden-directory-connector-cli.sync.userObjectClass	Class that users must have.
programs.dconf.profiles	Attrset of dconf profiles
programs.gphoto2.enable	Whether to configure system to use gphoto2
services._3proxy.usersFile	Load users and passwords from this file
services.factorio.username	Your factorio.com login credentials
networking.supplicant.<name>.userControlled.enable	Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli
services.bitcoind.<name>.rpc.users.<name>.name	Username for JSON-RPC connections.
services.crossmacro.users	List of users granted permission to use CrossMacro.
services.mosquitto.listeners.*.users.<name>.password	Specifies the (clear text) password for the MQTT User.
programs.benchexec.users	Users that intend to use BenchExec
services.dependency-track.database.username	Username to use when connecting to an external or manually provisioned database; has no effect when a local database is automatically provisioned
services.coder.database.username	Username for accessing the database.
services.mailman.ldap.attrMap.username	LDAP-attribute that corresponds to the `username`-attribute in mailman.
services.userdbd.enableSSHSupport	Whether to enable exposing OpenSSH public keys defined in userdb
services.offlineimap.install	Whether to install a user service for Offlineimap
security.doas.extraRules.*.runAs	Which user or group the specified command is allowed to run as
services.postgresql.ensureUsers.*.ensureClauses.login	Grants the user, created by the ensureUser attr, login permissions
services._3proxy.services..acl..users	List of users, use empty list for any.
services.postfixadmin.database.username	Username for the postgresql connection
services.multipath.devices.*.user_friendly_names	If set to "yes", using the bindings file /etc/multipath/bindings to assign a persistent and unique alias to the multipath, in the form of mpath
services.pdfding.consume.enable	Bulk PDF import from consume directory
services.jibri.xmppEnvironments.<name>.call.login.username	User part of the JID for the recorder.
services.bitwarden-directory-connector-cli.sync.userEmailAttribute	Attribute for a users email.
services.archisteamfarm.bots.<name>.username	Name of the user to log in
services.geoclue2.appConfig.<name>.users	List of UIDs of all users for which this application is allowed location info access, Defaults to an empty string to allow it for all users.
boot.loader.grub.users.<name>.hashedPassword	Specifies the password hash for the account, generated with grub-mkpasswd-pbkdf2
programs.idescriptor.users	Users to be added to the idevice group.
services.pgadmin.emailServer.username	SMTP server username for email delivery
services.longview.mysqlUser	The user for connecting to the MySQL database
services.bitwarden-directory-connector-cli.ldap.username	The user to authenticate as.
services.pulseaudio.systemWide	If false, a PulseAudio server is launched automatically for each user that tries to use the sound system
services.nntp-proxy.users.<name>.passwordHash	SHA-512 password hash (can be generated by `mkpasswd -m sha-512 <password>`)
services.dokuwiki.sites.<name>.usersFile	Location of the dokuwiki users file
services.mosquitto.listeners.*.users.<name>.passwordFile	Specifies the path to a file containing the clear text password for the MQTT user
services.cassandra.jmxRoles.*.username	Username for JMX
services.clickhouse.usersConfig	Your users.yaml as a Nix attribute set
nix.nrBuildUsers	Number of `nixbld` user accounts created to perform secure concurrent builds
services.jibri.xmppEnvironments.<name>.control.login.username	User part of the JID.
services.printing.cups-pdf.instances.<name>.settings.Anonuser	User for anonymous PDF creation
services.firezone.server.smtp.username	Username to authenticate against the SMTP relay
services.znc.mutable	Indicates whether to allow the contents of the `dataDir` directory to be changed by the user at run-time
services.hqplayerd.auth.username	Username used for HQPlayer's WebUI
services.mosquitto.listeners.*.users.<name>.hashedPassword	Specifies the hashed password for the MQTT User
services.tailscale.permitCertUid	Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.
services.taskserver.organisations.<name>.users	A list of user names that belong to the organization.
services.anki-sync-server.users.*.passwordFile	File containing the password accepted by anki-sync-server for the associated username
services.postgresql.ensureUsers.*.ensureClauses	An attrset of clauses to grant to the user
users.mysql.pam.passwordCrypt	The method to encrypt the user's password: `0` (or `"plain"`): No encryption
services.prometheus.exporters.dovecot.socketPath	Path under which the stats socket is placed
services.anki-sync-server.users.*.password	Password accepted by anki-sync-server for the associated username. WARNING: This option is not secure
services.outline.oidcAuthentication.usernameClaim	Specify which claims to derive user information from
services.nscd.group	User group under which nscd runs.
programs.firefox.autoConfig	AutoConfig files can be used to set and lock preferences that are not covered by the policies.json for Mac and Linux
services.portunus.ldap.searchUserName	The login name of the search user
services.physlock.allowAnyUser	Whether to allow any user to lock the screen
services.freeciv.settings.Newusers	Whether to enable new users to login if auth is enabled.
services.influxdb2.provision.users	Users to provision.
services.cloudlog.update-lotw-users.enable	Whether to periodically update the list of LoTW users
services.guix.group	The group of the Guix build user pool.
users.ldap.bind.distinguishedName	The distinguished name to bind to the LDAP server with
security.pam.services.<name>.forwardXAuth	Whether X authentication keys should be passed from the calling user to the target user (e.g. for `su`)
services.mosquitto.listeners.*.users.<name>.hashedPasswordFile	Specifies the path to a file containing the hashed password for the MQTT user
services.inadyn.settings.custom.<name>.username	Username for this DDNS provider.
services.mtprotoproxy.users	Allowed users and their secrets
services.mosquitto.listeners.*.users	A set of users and their passwords and ACLs.
services.coder.homeDir	Home directory for coder user.
services.ntfy-sh.group	Primary group of ntfy-sh user.
services.samba.settings.global."invalid users"	List of users who are denied to login via Samba.
containers.<name>.privateUsers	Whether to give the container its own private UIDs/GIDs space (user namespacing)
systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group	The group of the file
services.openvpn.servers.<name>.authUserPass.username	The username to store inside the credentials file.
security.tpm2.tssUser	Name of the tpm device-owner and service user, set if applyUdevRules is set.
services.movim.logDir	Log directory of the `movim` user which holds the application’s logs.
services.umurmur.settings.max_users	Maximum number of concurrent clients allowed.
services.matomo.webServerUser	Name of the web server user that forwards requests to `services.phpfpm.pools.<name>.socket` the fastcgi socket for Matomo if the nginx option is not used
services.xrdp.defaultWindowManager	The script to run when user log in, usually a window manager, e.g. "icewm", "xfce4-session" This is per-user overridable, if file ~/startwm.sh exists it will be used instead.
services.openafsServer.roles.backup.buserverArgs	Arguments to the buserver process
services.zfs.autoReplication.username	Username used by SSH to login to remote host.
services.spiped.config.<name>.keyfile	Name of a file containing the spiped key
services.dependency-track.oidc.usernameClaim	Defines the name of the claim that contains the username in the provider's userinfo endpoint
services.pipewire.systemWide	If true, a system-wide PipeWire service and socket is enabled allowing all users in the "pipewire" group to use it simultaneously
services.grafana-to-ntfy.settings.bauthUser	The user that you will authenticate with in the Grafana webhook settings
services.grocy.dataDir	Home directory of the `grocy` user which contains the application's state.
programs.rush.enable	Whether to enable Restricted User Shell..
services.discourse.mail.outgoing.username	The username of the SMTP server.
programs.firefox.autoConfigFiles	AutoConfig files can be used to set and lock preferences that are not covered by the policies.json for Mac and Linux
services.userborn.passwordFilesLocation	The location of the original password files
services.mosquitto.listeners.*.users.<name>.acl	Control client access to topics on the broker.
services.movim.dataDir	State directory of the `movim` user which holds the application’s state & data.
services.unpoller.unifi.defaults.pass	Path of a file containing the password for the unifi service user
services.zoneminder.database.username	Username for accessing the database.
services.lldap.settings.ldap_user_dn	Admin username
services.nifi.initUser	Initial user account for Apache NiFi
services.mobilizon.settings.":mobilizon"."Mobilizon.Storage.Repo".username	User used to connect to the database
services.inadyn.settings.provider.<name>.username	Username for this DDNS provider.
users.mysql.pam.disconnectEveryOperation	By default, `pam_mysql` keeps the connection to the MySQL database until the session is closed
services.mjolnir.pantalaimon.username	The username to login with.
services.displayManager.sddm.autoLogin.minimumUid	Minimum user ID for auto-login user.
systemd.mounts.*.wantedBy	Units that want (i.e. depend on) this unit
systemd.paths.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.units.<name>.wantedBy	Units that want (i.e. depend on) this unit
services.bitcoind.<name>.rpc.users.<name>.passwordHMAC	Password HMAC-SHA-256 for JSON-RPC connections
users.extraUsers.<name>.openssh.authorizedKeys.keys	A list of verbatim OpenSSH public keys that should be added to the user's authorized keys
services.netbird.tunnels.<name>.hardened	Hardened service: runs as a dedicated user with minimal set of permissions (see caveats), restricts daemon configuration socket access to dedicated user group (you can grant access to it with `users.users."<user>".extraGroups = [ netbird-‹name› ]`), Even though the local system resources access is restricted: `CAP_NET_RAW`, `CAP_NET_ADMIN` and `CAP_BPF` still give unlimited network manipulation possibilites, older kernels don't have `CAP_BPF` and use `CAP_SYS_ADMIN` instead, Known security features that are not (yet) integrated into the module: 2024-02-14: `rosenpass` is an experimental feature configurable solely through `--enable-rosenpass` flag on the `netbird up` command, see the docs
services.netbird.clients.<name>.hardened	Hardened service: runs as a dedicated user with minimal set of permissions (see caveats), restricts daemon configuration socket access to dedicated user group (you can grant access to it with `users.users."<user>".extraGroups = [ netbird-‹name› ]`), Even though the local system resources access is restricted: `CAP_NET_RAW`, `CAP_NET_ADMIN` and `CAP_BPF` still give unlimited network manipulation possibilites, older kernels don't have `CAP_BPF` and use `CAP_SYS_ADMIN` instead, Known security features that are not (yet) integrated into the module: 2024-02-14: `rosenpass` is an experimental feature configurable solely through `--enable-rosenpass` flag on the `netbird up` command, see the docs
services.syncoid.localTargetAllow	Permissions granted for the `services.syncoid.user` user for local target datasets
security.pam.ussh.group	If set, then the authenticating user must be a member of this group to use this module.
services.newt.enable	Whether to enable Newt, user space tunnel client for Pangolin.
services.prosody.muc	Multi User Chat (MUC) configuration
services.nextcloud.config.adminuser	Username for the admin account
users.extraUsers.<name>.openssh.authorizedKeys.keyFiles	A list of files each containing one OpenSSH public key that should be added to the user's authorized keys
services.postgresql.ensureUsers.*.ensureClauses.superuser	Grants the user, created by the ensureUser attr, superuser permissions
boot.initrd.systemd.tmpfiles.settings.<config-name>.<path>.<tmpfiles-type>.group	The group of the file
services.logind.settings.Login.KillUserProcesses	Specifies whether the processes of a user should be killed when the user logs out
programs.nano.enable	Whether to enable nano, a small user-friendly console text editor.
services.logind.killUserProcesses	Specifies whether the processes of a user should be killed when the user logs out
systemd.slices.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.timers.<name>.wantedBy	Units that want (i.e. depend on) this unit
services.saunafs.sfsUser	Run daemons as user.
services.grafana.settings.users.auto_assign_org	Set to `true` to automatically add new users to the main organization (id 1)
services.kapacitor.defaultDatabase.username	The username to connect to the remote InfluxDB server
security.pam.services.<name>.startSession	If set, the service will register a new session with systemd's login manager
services.grafana.settings.users.home_page	Path to a custom home page
services.seafile.dataDir	Path in which to store user data
services.homed.enable	Whether to enable systemd home area/user account manager.
services.mailman.webUser	User to run mailman-web as
services.rshim.enable	Whether to enable user-space rshim driver for the BlueField SoC.
system.nixos.variantName	A string identifying a specific variant or edition of the operating system suitable for presentation to the user
systemd.targets.<name>.wantedBy	Units that want (i.e. depend on) this unit
systemd.sockets.<name>.wantedBy	Units that want (i.e. depend on) this unit
boot.crashDump.enable	If enabled, NixOS will set up a kernel that will boot on crash, and leave the user in systemd rescue to be able to save the crashed kernel dump at /proc/vmcore
services.monado.enable	Whether to enable Monado user service.
services.botamusique.settings.bot.username	Name the bot should appear with.
services.grafana.settings.users.login_hint	Text used as placeholder text on login page for login/username input.
users.extraUsers.<name>.openssh.authorizedPrincipals	A list of verbatim principal names that should be added to the user's authorized principals.
services.mqtt2influxdb.mqtt.username	Username used to connect to the MQTT server.
services.postfix.recipientDelimiter	Delimiter for address extension: so mail to user+test can be handled by ~user/.forward+test
services.rshim.package	The rshim-user-space package to use.
services.saunafs.chunkserver.hdds	Mount points to be used by chunkserver for storage (see sfshdd.cfg(5))
services.lldap.settings.ldap_user_email	Admin email.
security.pam.ussh.caFile	By default `pam-ussh` reads the trusted user CA keys from /etc/ssh/trusted_user_ca
services.davfs2.davUser	When invoked by root the mount.davfs daemon will run as this user
services.librenms.database.passwordFile	A file containing the password for the user of the MySQL/MariaDB server
services.umami.settings.APP_SECRET_FILE	A file containing a secure random string
programs.rush.shell	The resolved shell path that users can inherit to set `rush` as their login shell
services.lldap.settings.ldap_user_pass	Password for default admin password
systemd.services.<name>.wantedBy	Units that want (i.e. depend on) this unit
security.pam.mount.enable	Enable PAM mount system to mount filesystems on user login.
security.doas.extraRules.*.noPass	If `true`, the user is not required to enter a password.
services.dwm-status.enable	Whether to enable dwm-status user service.
services.rabbitmq.listenAddress	IP address on which RabbitMQ will listen for AMQP connections
services.glitchtip.settings.ENABLE_USER_REGISTRATION	When true, any user will be able to register
services.mpdscribble.endpoints.<name>.username	Username for the scrobble service.
networking.interfaces.<name>.virtualOwner	In case of a virtual device, the user who owns it. `null` will not set owner, allowing access to any user.
services.rsync.jobs.<name>.group	The name of an existing user group under which the rsync process should run.
services.moosefs.runAsUser	Run daemons as moosefs user instead of root for better security.
services.nvme-rs.settings.email.smtp_username	SMTP username
services.influxdb2.provision.initialSetup.username	Primary username
services.prometheus.exporters.dmarc.imap.username	Login username for the IMAP connection.
services.openssh.authorizedKeysCommandUser	Specifies the user under whose account the AuthorizedKeysCommand is run
services.gitea.useWizard	Do not generate a configuration and use gitea' installation wizard instead
security.pam.makeHomeDir.umask	The user file mode creation mask to use on home directories newly created by `pam_mkhomedir`.
services.lxd-image-server.group	Group assigned to the user and the webroot directory.
services.unpoller.unifi.controllers.*.pass	Path of a file containing the password for the unifi service user
services.emacs.enable	Whether to enable a user service for the Emacs daemon
services.guix.stateDir	The state directory where Guix service will store its data such as its user-specific profiles, cache, and state files. Changing it to something other than the default will rebuild the package.
services.openssh.banner	Message to display to the remote user before authentication is allowed.
services.xtreemfs.homeDir	XtreemFS home dir for the xtreemfs user.
services.zammad.enable	Whether to enable Zammad, a web-based, open source user support/ticketing solution.
services.grafana.settings.security.admin_user	Default admin username.
services.bitwarden-directory-connector-cli.sync.users	Sync users.
services.outline.oidcAuthentication.userinfoUrl	OIDC userinfo URL endpoint.
hardware.i2c.enable	Whether to enable i2c devices support
services.actual.group	Group account under which Actual runs
services.btrbk.sshAccess.*.key	SSH public key allowed to login as user `btrbk` to run remote backups.
services.gitolite.group	Primary group of the Gitolite user account.
services.mysql.ensureUsers.*.name	Name of the user to ensure.
services.movim.runtimeDir	Runtime directory of the `movim` user which holds the application’s caches & temporary files.
services.dovecot2.mailUser	Default user to store mail for virtual users.
security.please.enable	Whether to enable please, a Sudo clone which allows a users to execute a command or edit a file as another user .
services.mqtt2influxdb.influxdb.username	Username for InfluxDB login.
services.klipper.group	Group account under which Klipper runs
programs.gnupg.agent.enable	Enables GnuPG agent with socket-activation for every user session.
services.tomcat.extraGroups	Defines extra groups to which the tomcat user belongs.
services.zitadel.enable	Whether to enable ZITADEL, a user and identity access management platform.
services.prometheus.remoteRead.*.basic_auth.username	HTTP username
services.lldap.settings.ldap_user_pass_file	Path to a file containing the default admin password
systemd.automounts.*.wantedBy	Units that want (i.e. depend on) this unit
programs.tmux.secureSocket	Store tmux socket under /run, which is more secure than /tmp, but as a downside it doesn't survive user logout.
services.gocd-agent.extraGroups	List of extra groups that the "gocd-agent" user should be a part of.
services.mysql.group	Group account under which MySQL runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the MySQL service starts.
services.pixelfed.dataDir	State directory of the `pixelfed` user which holds the application's state and data.
services.vault.extraSettingsPaths	Configuration files to load besides the immutable one defined by the NixOS module
services.prometheus.remoteWrite.*.basic_auth.username	HTTP username
services.printing.cups-pdf.instances.<name>.settings.Out	output directory; `${HOME}` will be expanded to the user's home directory, `${USER}` will be expanded to the user name.
nix.buildMachines.*.sshUser	The username to log in as on the remote host
services.dependency-track.settings."alpine.oidc.username.claim"	Defines the name of the claim that contains the username in the provider's userinfo endpoint
services.syncoid.commands.<name>.localTargetAllow	Permissions granted for the `services.syncoid.user` user for local target datasets
security.rtkit.enable	Whether to enable the RealtimeKit system service, which hands out realtime scheduling priority to user processes on demand
programs.tcpdump.enable	Whether to configure a setcap wrapper for tcpdump
services.bitlbee.configDir	Specify an alternative directory to store all the per-user configuration files.
services.homed.promptOnFirstBoot	Whether to enable interactively prompting for user creation on first boot .
security.acme.certs.<name>.postRun	Commands to run after new certificates go live
services.omnom.passwordFile	File containing the password for the SMTP user.
services.zeyple.group	Group to use to run Zeyple. If left as the default value this group will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the user exists.
services.code-server.extraGroups	An array of additional groups for the `code-server` user.
services.speechd.config	System wide configuration file for Speech Dispatcher
services.nsd.keys.<name>.keyFile	Path to the file which contains the actual base64 encoded key
services.coturn.use-auth-secret	TURN REST API flag
services.pgbouncer.settings.pgbouncer.max_client_conn	Maximum number of client connections allowed
services.paretosecurity.users.<name>.inviteId	A unique ID that links the agent to Pareto Cloud
services.prosody.uploadHttp	Configures the old Prosody builtin HTTP server to handle user uploads.
security.acme.useRoot	Whether to use the root user when generating certs
services.jenkins.extraGroups	List of extra groups that the "jenkins" user should be a part of.
services.gocd-server.extraGroups	List of extra groups that the "gocd-server" user should be a part of.
hardware.alsa.enable	Whether to set up the user space part of the Advanced Linux Sound Architecture (ALSA) Enable this option only if you want to use ALSA as your main sound system, not if you're using a sound server (e.g
services.bitmagnet.group	Group of user running bitmagnet
services.rethinkdb.group	Group which rethinkdb user belongs to.
services.mainsail.enable	Whether to enable a modern and responsive user interface for Klipper.
services.prometheus.scrapeConfigs.*.basic_auth.username	HTTP username
services.incron.allow	Users allowed to use incrontab
services.dovecot2.imapsieve.mailbox.*.after	When an IMAP event of interest occurs, this sieve script is executed after any user script respectively
services.znapzend.zetup.<name>.destinations.<name>.host	Host to use for the destination dataset
services.dependency-track.settings."alpine.database.username"	Specifies the username to use when authenticating to the database.
services.slurm.procTrackType	Plugin to be used for process tracking on a job step basis
services.prometheus.exporters.nextcloud.username	Username for connecting to Nextcloud
services.grafana.settings.users.default_theme	Sets the default UI theme. `system` matches the user's system theme.
services.anuko-time-tracker.settings.defaultLanguage	Defines Anuko Time Tracker default language
services.diod.allsquash	Remap all users to "nobody"
services.tt-rss.auth.autoLogin	Automatically login user on remote or other kind of externally supplied authentication, otherwise redirect to login form as normal
services.tt-rss.singleUserMode	Operate in single user mode, disables all functionality related to multiple users and authentication
services.grafana.settings.users.password_hint	Text used as placeholder text on login page for password input.
services.asusd.enableUserService	Activate the asusd-user service.
services.davis.nginx.kTLS	Whether to enable kTLS support
services.slskd.nginx.kTLS	Whether to enable kTLS support
services.movim.nginx.kTLS	Whether to enable kTLS support
services.prosody.httpFileShare	Configures the http_file_share module to handle user uploads
services.pdfding.enable	Whether to enable PdfDing service
services.dovecot2.imapsieve.mailbox.*.before	When an IMAP event of interest occurs, this sieve script is executed before any user script respectively
services.disnix.enableMultiUser	Whether to support multi-user mode by enabling the Disnix D-Bus service
nix.channel.enable	Whether the `nix-channel` command and state files are made available on the machine
services.grav.systemSettings	Settings written to user/config/system.yaml.
security.doas.extraRules.*.persist	If `true`, do not ask for a password again for some time after the user successfully authenticates.
services.couchdb.configFile	Configuration file for persisting runtime changes
services.infinoted.group	What to call the primary group of the dedicated user under which infinoted is run
services.unpoller.loki.pass	Path of a file containing the password for Loki
services.snipe-it.nginx.kTLS	Whether to enable kTLS support
services.dovecot2.enablePAM	Whether to enable creating a own Dovecot PAM service and configure PAM user logins.
security.doas.extraRules.*.cmd	The command the user is allowed to run
services.couchdb.viewIndexDir	Specifies location of CouchDB view index files
services.buildbot-master.group	Primary group of buildbot user.
services.oidentd.enable	Whether to enable ‘oidentd’, an implementation of the Ident protocol (RFC 1413)
services.portunus.enable	Whether to enable Portunus, a self-contained user/group management and authentication service for LDAP.
services.riemann-dash.dataDir	Location of the riemann-base dir
services.firefox-syncserver.database.createLocally	Whether to create database and user on the local machine if they do not exist
services.pgbackrest.stanzas.<name>.instances	An attribute set of database instances as described in: https://pgbackrest.org/configuration.html#section-stanza Each instance defaults to set `pg-host` to the attribute's name
services.buildbot-worker.group	Primary group of buildbot Worker user.
services.prefect.databaseUser	database user for postgres only
services.oauth2-proxy.passBasicAuth	Pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream.
services.mjolnir.accessTokenFile	File containing the matrix access token for the `mjolnir` user.
services.syncthing.settings.options.urAccepted	Whether the user has accepted to submit anonymous usage data
services.coturn.no-auth	This option is opposite to lt-cred-mech. (TURN Server with no-auth option allows anonymous access)
services.headscale.settings.oidc.allowed_users	Users allowed to authenticate even if not in allowedDomains.
environment.shells	A list of permissible login shells for user accounts
services.fluidd.nginx.kTLS	Whether to enable kTLS support
services.akkoma.nginx.kTLS	Whether to enable kTLS support
services.graylog.rootUsername	Name of the default administrator user
services.gancio.nginx.kTLS	Whether to enable kTLS support
services.monica.nginx.kTLS	Whether to enable kTLS support
services.matomo.nginx.kTLS	Whether to enable kTLS support
services.documize.db	Database specific connection string for example: MySQL/Percona/MariaDB: `user:password@tcp(host:3306)/documize` MySQLv8+: `user:password@tcp(host:3306)/documize?allowNativePasswords=true` PostgreSQL: `host=localhost port=5432 dbname=documize user=admin password=secret sslmode=disable` MSSQL: `sqlserver://username:password@localhost:1433?database=Documize` or `sqlserver://sa@localhost/SQLExpress?database=Documize`
security.loginDefs.settings.UID_MAX	Range of user IDs used for the creation of regular users by useradd or newusers.
security.loginDefs.settings.UID_MIN	Range of user IDs used for the creation of regular users by useradd or newusers.
services.siproxd.passwordFile	Path to per-user password file.
services._3proxy.services.*.acl	Use this option to limit user access to resources.
services.gitlab.statePath	GitLab state directory
programs.gnupg.dirmngr.enable	Enables GnuPG network certificate management daemon with socket-activation for every user session.
programs.mouse-actions.autorun	Whether to start a user service to run mouse-actions on startup.
services.mailman.ldap.superUserGroup	Group where a user must be a member of to gain superuser rights.
services.prometheus.exporters.fritz.settings.devices.*.username	Username to authenticate with the target device.
security.pam.services.<name>.pamMount	Enable PAM mount (pam_mount) system to mount filesystems on user login.
nix.buildMachines.*.sshKey	The path to the SSH private key with which to authenticate on the build machine
security.sudo.defaultOptions	Options used for the default rules, granting `root` and the `wheel` group permission to run any command as any user.
services.resilio.checkForUpdates	Determines whether to check for updates and alert the user about them in the UI.
services.dependency-track.oidc.teamSynchronization	This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles
security.sudo-rs.defaultOptions	Options used for the default rules, granting `root` and the `wheel` group permission to run any command as any user.
services.librechat.dataDir	Absolute path for where the LibreChat server will use as its data directory to store logs, user uploads, and generated images.
services.greetd.restart	Whether to restart greetd when it terminates (e.g. on failure)
services.kresd.enable	Whether to enable knot-resolver (version 5) domain name server
services.dokuwiki.sites.<name>.acl.*.actor	User or group to restrict
security.acme.defaults.postRun	Commands to run after new certificates go live
services.discourse.admin.email	The admin user email address.
services.davis.adminPasswordFile	The full path to a file that contains the admin's password
services.smokeping.config	Full smokeping config supplied by the user
services.pixelfed.runtimeDir	Ruutime directory of the `pixelfed` user which holds the application's caches and temporary files.
services.vsftpd.anonymousUser	Whether to enable the anonymous FTP user.
services.prometheus.alertmanagerGotify.metrics.username	The username used to access your metrics.
security.loginDefs.settings.SYS_UID_MAX	Range of user IDs used for the creation of system users by useradd or newusers.
security.loginDefs.settings.SYS_UID_MIN	Range of user IDs used for the creation of system users by useradd or newusers.
hardware.hackrf.enable	Enables hackrf udev rules and ensures 'plugdev' group exists
services.znc.confOptions.networks	IRC networks to connect the user to.
services.prometheus.exporters.imap-mailstat.accounts.<name>.username	If empty string mailaddress value is used
services.gitolite.enable	Enable gitolite management under the `gitolite` user
programs.dsearch.systemd.enable	Whether to enable systemd user service for dsearch.
services.pgmanage.loginTimeout	Number of seconds of inactivity before user is automatically logged out.
services.quickwit.dataDir	Data directory for Quickwit
services.temporal.dataDir	Data directory for Temporal
services.dovecot2.createMailUser	Whether to enable automatically creating the user given in `services.dovecot.user` and the group given in `services.dovecot.group`.
programs.zsh.enableGlobalCompInit	Enable execution of compinit call for all interactive zsh shells
programs.corectrl.enable	Whether to enable CoreCtrl, a tool to overclock amd graphics cards and processors
services.buildbot-worker.workerUser	Specifies the Buildbot Worker user.
services.logcheck.extraGroups	Extra groups for the logcheck user, for example to be able to use sendmail, or to access certain log files.
services.vsftpd.enableVirtualUsers	Whether to enable the `pam_userdb`-based virtual user system
services.lasuite-docs.settings.DB_USER	User of the database
services.lasuite-meet.settings.DB_USER	User of the database
security.run0.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `run0`.
services.couchdb.uriFile	This file contains the full URI that can be used to access this instance of CouchDB
services.syncoid.localSourceAllow	Permissions granted for the `services.syncoid.user` user for local source datasets
services.vsftpd.anonymousUserHome	Directory to consider the HOME of the anonymous user.
services.dendrite.settings.user_api.device_database.connection_string	Database for the User API, devices.
security.sudo.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `sudo`.
security.doas.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `doas`.
services.jenkinsSlave.enable	If true the system will be configured to work as a jenkins slave
services.immich.mediaLocation	Directory used to store media files
programs.feedbackd.enable	Whether to enable the feedbackd D-BUS service and udev rules
security.sudo-rs.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands as super user via `sudo`.
services.icingaweb2.modules.monitoring.transports.<name>.username	Username for the api or remote transport
services.greetd.useTextGreeter	Whether the greeter uses text-based user interfaces (For example, tuigreet)
programs.mosh.withUtempter	Whether to enable libutempter for mosh
programs.tmux.withUtempter	Whether to enable libutempter for tmux
services.tt-rss.plugins	List of plugins to load automatically for all users
services.pgmanage.loginGroup	This tells pgmanage to only allow users in a certain PostgreSQL group to login to pgmanage
services.accounts-daemon.enable	Whether to enable AccountsService, a DBus service for accessing the list of user accounts and information attached to those accounts.
services.gitea.captcha.requireForLogin	Displays a CAPTCHA challenge whenever a user logs in.
services.couchdb.extraConfigFiles	Extra configuration files
services.akkoma.initDb.password	Password of the database user to initialise the database with
services.dovecot2.quotaGlobalPerUser	Quota limit for the user in bytes
services.couchdb.databaseDir	Specifies location of CouchDB database files (*.couch named)
services.hostapd.enable	Whether to enable hostapd, a user space daemon for access point and authentication servers
environment.stub-ld.enable	Install a stub ELF loader to print an informative error message in the event that a user attempts to run an ELF binary not compiled for NixOS.
services.nomad.dropPrivileges	Whether the nomad agent should be run as a non-root nomad user.
services.lighttpd.document-root	Document-root of the web server
services.mailman.ldap.groupSearch.query	Query to find a group associated to a user in the LDAP database.
services.earlyoom.enableNotifications	Send notifications about killed processes via the system d-bus
services.upower.ignoreLid	Do we ignore the lid state Some laptops are broken
services.strongswan-swanctl.swanctl.connections.<name>.unique	Connection uniqueness policy to enforce
services.prosody.muc.*.vcard_muc	Adds the ability to set vCard for Multi User Chat rooms
services.librenms.nginx.kTLS	Whether to enable kTLS support
services.cockroachdb.group	User account under which CockroachDB runs
services.fediwall.nginx.kTLS	Whether to enable kTLS support
services.dolibarr.nginx.kTLS	Whether to enable kTLS support
services.jenkins.jobBuilder.accessUser	User id in Jenkins used to reload config.
services.buildbot-master.extraGroups	List of extra groups that the buildbot user should be a part of.
services.headscale.group	Group under which headscale runs. If left as the default value this group will automatically be created on system activation, otherwise you are responsible for ensuring the user exists before the headscale service starts.
services.agorakit.nginx.kTLS	Whether to enable kTLS support
services.kanboard.nginx.kTLS	Whether to enable kTLS support
fonts.fontconfig.includeUserConf	Include the user configuration from ~/.config/fontconfig/fonts.conf or ~/.config/fontconfig/conf.d.
services.mainsail.nginx.kTLS	Whether to enable kTLS support
services.namecoind.rpc.allowFrom	List of IP address ranges allowed to use the RPC API
services.pixelfed.nginx.kTLS	Whether to enable kTLS support
services.dendrite.settings.user_api.account_database.connection_string	Database for the User API, accounts.
services.gnome.gnome-keyring.enable	Whether to enable GNOME Keyring daemon, a service designed to take care of the user's security credentials, such as user names and passwords .
services.gitea.settings.service.DISABLE_REGISTRATION	By default any user can create an account on this `gitea` instance
services.apcupsd.enable	Whether to enable the APC UPS daemon. apcupsd monitors your UPS and permits orderly shutdown of your computer in the event of a power failure
services.buildbot-worker.extraGroups	List of extra groups that the Buildbot Worker user should be a part of.
services.gitlab.databaseUsername	GitLab database user.
services.matomo.nginx	With this option, you can customize an nginx virtualHost which already has sensible defaults for Matomo
services.restic.server.privateRepos	Enable private repos
services.livebook.enableUserService	Whether to enable a user service for Livebook.
services.openafsClient.daemons	Number of daemons to serve user requests
security.pam.u2f.settings.cue	By default `pam-u2f` module does not inform user that he needs to use the u2f device, it just waits without a prompt
boot.loader.initScript.enable	Some systems require a /sbin/init script which is started
boot.bootspec.extensions	User-defined data that extends the bootspec document
programs.system-config-printer.enable	Whether to enable system-config-printer, a Graphical user interface for CUPS administration.
services.miniflux.config.CREATE_ADMIN	Create an admin user from environment variables.
services.maubot.extraConfigFile	A file for storing secrets
services.tt-rss.database.createLocally	Create the database and database user locally.
services.privoxy.settings	This option is mapped to the main Privoxy configuration file
services.openssh.settings.PrintMotd	Whether to enable printing /etc/motd when a user logs in interactively.
virtualisation.oci-containers.containers.<name>.login.username	Username for login.
security.pam.enableFscrypt	Whether to enable fscrypt, to automatically unlock directories with the user's login password
services.gammu-smsd.backend.sql.password	User password used for connection to the database
services.consul.dropPrivileges	Whether the consul agent should be run as a non-root consul user.
services.anki-sync-server.baseDirectory	Base directory where user(s) synchronized data will be stored.
services.microsocks.authOnce	If true, once a specific ip address authed successfully with user/pass, it is added to a whitelist and may use the proxy without auth.
services.radicle.httpd.nginx.kTLS	Whether to enable kTLS support
services.netbird.tunnels.<name>.name	Primary name for use (as a suffix) in: systemd service name, hardened user name and group, systemd `*Directory=` names, desktop application identification,
services.netbird.clients.<name>.name	Primary name for use (as a suffix) in: systemd service name, hardened user name and group, systemd `*Directory=` names, desktop application identification,
services.misskey.settings.url	The final user-facing URL
services.minetest-server.configPath	Path to the config to use
services.grafana.settings.users.allow_org_create	Set to `false` to prohibit users from creating new organizations.
services.pgmanage.superOnly	This tells pgmanage whether or not to only allow super users to login
services.dependency-track.settings."alpine.oidc.team.synchronization"	This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles
programs.steam.fontPackages	Font packages to use in Steam
services.wstunnel.clients.<name>.upgradeCredentials	Use these credentials to authenticate during the HTTP upgrade request (Basic authorization type, `USER:[PASS]`). Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `HTTP_PASSWORD=<your-password-here>` and set this option to `<user>:$HTTP_PASSWORD`
services.gitolite.adminPubkey	Initial administrative public key for Gitolite
services.unpoller.influxdb.pass	Path of a file containing the password for influxdb
services.slurm.dbdserver.storageUser	Database user name.
services.portunus.dex.enable	Whether to enable Dex ldap connector
services.grafana.settings.users.default_language	This setting configures the default UI language, which must be a supported IETF language tag, such as `en-US`.
services.anuko-time-tracker.nginx.kTLS	Whether to enable kTLS support
services.jupyter.kernels.<name>.displayName	Name that will be shown to the user.
services.kasmweb.defaultUserPassword	default user password to use.
services.httpd.logFormat	Selects the access log format written to log files
services.nginx.virtualHosts.<name>.kTLS	Whether to enable kTLS support
services.udisks2.mountOnMedia	When enabled, instructs udisks2 to mount removable drives under `/media/` directory, instead of the default, ACL-controlled `/run/media/$USER/`
services.hylafax.autostart	Autostart the HylaFAX queue manager at system start
services.grafana.settings.users.viewers_can_edit	Viewers can access and use Explore and perform temporary edits on panels in dashboards they have access to
security.duosec.autopush	If `true`, Duo Unix will automatically send a push login request to the user’s phone, falling back on a phone call if push is unavailable
services.atuin.database.createLocally	Create the database and database user locally.
services.coder.database.createLocally	Create the database and database user locally.
services.davis.database.createLocally	Create the database and database user locally.
services.maddy.ensureAccounts	List of IMAP accounts which get automatically created
services.lldap.database.createLocally	Create the database and database user locally.
services.writefreely.admin.name	The name of the first admin user.
services.rke2.cisHardening	Enable CIS Hardening for RKE2
services.hologram-server.enableLdapRoles	Whether to assign user roles based on the user's LDAP group memberships
services.prometheus.exporters.unpoller.controllers.*.pass	Path of a file containing the password for the unifi service user
services.xserver.desktopManager.surf-display.inactivityInterval	Setting for internal inactivity timer to restart surf-display if the user goes inactive/idle to get a fresh session for the next user of the kiosk
services.hbase-standalone.dataDir	Specifies location of HBase database files
services.bookstack.nginx.kTLS	Whether to enable kTLS support
services.snipe-it.database.createLocally	Create the database and database user locally.
services.oncall.secretFile	A YAML file containing secrets such as database or user passwords
services.tcsd.platformCred	Path to the platform credential for your TPM
services.postgresql.ensureUsers.*.name	Name of the user to ensure.
services.weblate.djangoSecretKeyFile	Location of the Django secret key
security.duosec.acceptEnvFactor	Look for factor selection or passcode in the `$DUO_PASSCODE` environment variable before prompting the user for input
security.pam.services.<name>.enableAppArmor	Enable support for attaching AppArmor profiles at the user/group level, e.g., as part of a role based access control scheme.
services.borgbackup.jobs.<name>.group	The group borg is run as
services.firezone.relay.tokenFile	A file containing the firezone relay token
services.jenkins.jobBuilder.accessTokenFile	File containing the API token for the `accessUser` user.
services.fwupd.extraTrustedKeys	Installing a public key allows firmware signed with a matching private key to be recognized as trusted, which may require less authentication to install than for untrusted files
boot.initrd.network.ssh.authorizedKeys	Authorized keys for the root user on initrd
programs.dsearch.systemd.target	The systemd target that will automatically start the dsearch service
services.librenms.database.socket	A unix socket to mysql, accessible by the librenms user
services.opensearch.dataDir	Data directory for OpenSearch
services.lldap.settings.http_port	The port on which to have the HTTP server, for user login and administration.
services.monado.forceDefaultRuntime	Whether to ensure that Monado is the active runtime set for the current user
services.part-db.enablePostgresql	Whether to configure the postgresql database for part-db
services.windmill.database.urlPath	Path to the file containing the database url windmill should connect to
services.maubot.settings.admins	List of administrator users
programs.atop.setuidWrapper.enable	Whether to install a setuid wrapper for Atop
services.buildkite-agents.<name>.extraGroups	Groups the user for this buildkite agent should belong to
power.ups.upsmon.monitor.<name>.passwordFile	The full path to a file containing the password from `upsd.users` for accessing this UPS
programs.miriway.enable	Whether to enable Miriway, a Mir based Wayland compositor
services.moodle.initialPassword	Specifies the initial password for the admin, i.e. the password assigned if the user does not already exist
services.monica.database.createLocally	Create the database and database user locally.
services.physlock.enable	Whether to enable the `physlock` screen locking mechanism
services.moodle.database.createLocally	Create the database and database user locally.
services.mysql.ensureUsers	Ensures that the specified users exist and have at least the ensured permissions
services.angrr.settings.owned-only	Only monitors owned symbolic link target of GC roots. "auto": behaves like true for normal users, false for root. "true": only monitor GC roots owned by the current user. "false": monitor all GC roots.
services.bitmagnet.useLocalPostgresDB	Use a local postgresql database, create user and database
services.coturn.static-auth-secret	'Static' authentication secret value (a string) for TURN REST API only
services.power-profiles-daemon.enable	Whether to enable power-profiles-daemon, a DBus daemon that allows changing system behavior based upon user-selected power profiles.
services.syncoid.commands.<name>.target	Target ZFS dataset
services.roundcube.database.host	Host of the postgresql server
services.jirafeau.nginxConfig.kTLS	Whether to enable kTLS support
programs.gnupg.agent.enableSSHSupport	Enable SSH agent support in GnuPG agent
services.oncall.database.createLocally	Whether to enable Create the database and database user locally..
services.openssh.settings.PermitRootLogin	Whether the root user can login using ssh.
services.nominatim.database.apiUser	Postgresql database user with read-only permissions used for Nominatim web API service.
services.smartd.notifications.systembus-notify.enable	Whenever to send systembus-notify notifications
services.thelounge.public	Make your The Lounge instance public
services.borgbackup.repos.<name>.group	The group `borg serve` is run as
services.journald.gateway.key	Specify the path to a file or `AF_UNIX` stream socket to read the secret server key corresponding to the certificate specified with `services.journald.gateway.cert` from
services.distccd.allowedClients	Client IPs which are allowed to connect to distccd in CIDR notation
services.graylog.passwordSecret	You MUST set a secret to secure/pepper the stored user passwords here
services.pretix.settings.pretix.datadir	Directory for storing user uploads and similar data.
services.mongodb.initialRootPasswordFile	Path to the file containing the password for the root user if auth is enabled.
services.zabbixWeb.nginx.virtualHost.kTLS	Whether to enable kTLS support
security.polkit.adminIdentities	Specifies which users are considered “administrators”, for those actions that require the user to authenticate as an administrator (i.e. have an `auth_admin` value)
services.lldap.settings.force_ldap_user_pass_reset	Force reset of the admin password
services.kbfs.enableRedirector	Whether to enable the Keybase root redirector service, allowing any user to access KBFS files via `/keybase`, which will show different contents depending on the requester.
services.displayManager.lemurs.enable	Whether to enable lemurs, a customizable TUI display/login manager. For Wayland compositors, your user must be in the "seat" group.
services.systembus-notify.enable	Whether to enable System bus notification support WARNING: enabling this option (while convenient) should not be done on a machine where you do not trust the other users as it allows any other local user to DoS your session by spamming notifications .
services.multipath.devices.*.deferred_remove	If set to "yes", multipathd will do a deferred remove instead of a regular remove when the last path device has been deleted
networking.dhcpcd.runHook	Shell code that will be run after all other hooks
services.gokapi.mutableSettings	Allow changes to the program config made by the program to persist between restarts
services.gitolite.description	Gitolite user account's description.
services.dovecot2.sieve.extensions	Sieve extensions for use in user scripts
services.redmine.database.createLocally	Create the database and database user locally.
services.nextcloud.extraAppsEnable	Automatically enable the apps in services.nextcloud.extraApps every time Nextcloud starts
services.openvscode-server.extraGroups	An array of additional groups for the `openvscode-server` user.
services.xscreensaver.enable	Whether to enable xscreensaver user service.
services.avahi.nssmdns6	Whether to enable the mDNS NSS (Name Service Switch) plug-in for IPv6
services.atuin.openRegistration	Allow new user registrations with the atuin server.
boot.initrd.network.ssh.authorizedKeyFiles	Authorized keys taken from files for the root user on initrd
services.vsftpd.anonymousUserNoPassword	Whether to disable the password for the anonymous FTP user.
services.prometheus.scrapeConfigs..uyuni_sd_configs..username	Credentials are used to authenticate the requests to Uyuni API.
services.mysql.replication.masterUser	Username of the MySQL replication user.
services.keycloak.database.name	Database name to use when connecting to an external or manually provisioned database; has no effect when a local database is automatically provisioned
services.heisenbridge.owner	Set owner MXID otherwise first talking local user will claim the bridge
services.grafana-to-ntfy.settings.ntfyBAuthPass	The path to the password for the specified ntfy-sh user
services.jenkins.jobBuilder.accessToken	User token in Jenkins used to reload config
services.firezone.gateway.tokenFile	A file containing the firezone gateway token
services.borgbackup.repos	Serve BorgBackup repositories to given public SSH keys, restricting their access to the repository only
services.ocis.configDir	Path to directory containing oCIS config file
services.authelia.instances.<name>.name	Name is used as a suffix for the service name, user, and group
services.kimai.sites.<name>.database.createLocally	Create the database and database user locally.
services.cloudlog.database.passwordFile	MySQL user password file.
services.crossfire-server.stateDir	Where to store runtime data (save files, persistent items, etc)
services.grafana-to-ntfy.settings.ntfyBAuthUser	The ntfy-sh user to use for authenticating with the ntfy-sh instance
services.calibre-server.libraries	Make sure each library path is initialized before service startup
services.gitlab.databasePasswordFile	File containing the GitLab database user password
services.pufferpanel.environment	Environment variables to set for the service
services.reaction.runAsRoot	Whether to run reaction as root
services.postgresql.identMap	Defines the mapping from system users to database users
services.keepalived.vrrpScripts.<name>.group	Name of group to run the script under
services.netbird.server.coturn.password	The password of the user used by netbird to connect to the coturn server
services.upower.enableWattsUpPro	Enable the Watts Up Pro device
services.victorialogs.enable	Whether to enable VictoriaLogs is an open source user-friendly database for logs from VictoriaMetrics.
security.pam.rssh.settings.auth_key_file	Path to file with trusted public keys in OpenSSH's `authorized_keys` format
services.sourcehut.settings."hg.sr.ht".repos	Path to mercurial repositories on disk
services.agorakit.database.createLocally	Create the database and database user locally.
services.castopod.database.createLocally	Create the database and database user locally.
services.dolibarr.database.createLocally	Create the database and database user locally.
security.pam.services.<name>.ttyAudit.enablePattern	For each user matching one of comma-separated glob patterns, enable TTY auditing
services.cloudlog.database.createLocally	Create the database and database user locally.
boot.initrd.systemd.emergencyAccess	Set to true for unauthenticated emergency access, and false or null for no emergency access
services.netbird.server.coturn.passwordFile	The path to a file containing the password of the user used by netbird to connect to the coturn server.
services.linkwarden.cacheLocation	Directory used as cache
services.mediatomb.customCfg	Allow the service to create and use its own config file inside the `dataDir` as configured by `services.mediatomb.dataDir`
services.samba.settings.global."passwd program"	Path to a program that can be used to set UNIX user passwords.
services.misskey.database.createLocally	Create the PostgreSQL database locally
services.zammad.secretKeyBaseFile	The path to a file containing the `secret_key_base` secret
services.zoneminder.enable	Whether to enable ZoneMinder
services.prometheus.scrapeConfigs..consul_sd_configs..username	Consul username
services.grafana.settings.users.auto_assign_org_id	Set this value to automatically add new users to the provided org
services.sourcehut.settings."git.sr.ht".repos	Path to git repositories on disk
services.listmonk.database.createLocally	Create the PostgreSQL database and database user locally.
services.znc.useLegacyConfig	Whether to propagate the legacy options under `services.znc.confOptions.*` to the znc config
services.wastebin.secretFile	Path to file containing sensitive environment variables
services.drupal.sites.<name>.database.createLocally	Create the database and database user locally.
services.neo4j.directories.home	Path of the Neo4j home directory
services.dashy.settings	Settings serialized into `user-data/conf.yml` before build
services.anuko-time-tracker.database.passwordFile	Database user password file.
services.fedimintd.<name>.nginx.config.kTLS	Whether to enable kTLS support
security.duosec.fallbackLocalIP	Duo Unix reports the IP address of the authorizing user, for the purposes of authorization and whitelisting
services.reposilite.useACMEHost	Host of an existing Let's Encrypt certificate to use for SSL
services.prometheus.scrapeConfigs..http_sd_configs..basic_auth.username	HTTP username
services.prometheus.scrapeConfigs..kuma_sd_configs..basic_auth.username	HTTP username
security.pam.services.<name>.ttyAudit.disablePattern	For each user matching one of comma-separated glob patterns, disable TTY auditing
services.anuko-time-tracker.database.createLocally	Create the database and database user locally.
services.jupyterhub.kernels.<name>.displayName	Name that will be shown to the user.
security.pam.services.<name>.gnupg.noAutostart	Don't start `gpg-agent` if it is not running
services.nominatim.database.superUser	Postgresql database superuser used to create Nominatim database and import data
security.googleOsLogin.enable	Whether to enable Google OS Login
services.mediatomb.openFirewall	If false (the default), this is up to the user to declare the firewall rules
security.pam.services.<name>.kwallet.enable	If enabled, pam_wallet will attempt to automatically unlock the user's default KDE wallet upon login
services._3proxy.services.*.auth	Authentication type
services.bookstack.database.createLocally	Create the database and database user locally.
services.graylog.rootPasswordSha2	You MUST specify a hash password for the root user (which you only need to initially set up the system and in case you lose connectivity to your authentication backend) This password cannot be changed using the API or via the web interface
services.foundationdb.package	The FoundationDB package to use for this server
services.matrix-alertmanager.tokenFile	File that contains a valid Matrix token for the Matrix user.
services.syncoid.commands.<name>.localSourceAllow	Permissions granted for the `services.syncoid.user` user for local source datasets
services.umami.settings.DATABASE_URL_FILE	A file containing a connection string for the database
services.neo4j.directories.data	Path of the data directory
services.openvpn.servers.<name>.authUserPass	This option can be used to store the username / password credentials with the "auth-user-pass" authentication method
programs.firefox.policies	Group policies to install
services.keycloak.initialAdminPassword	Initial password set for the temporary `admin` user
services.nextcloud.database.createLocally	Whether to create the database and database user locally.
services.matrix-alertmanager.matrixUser	Matrix user to use for the bot.
services.n8n.environment.N8N_USER_FOLDER	Provide the path where n8n will create the .n8n folder
services.dnsdist.dnscrypt.providerKey	The filepath to the provider secret key
services.prosody.httpFileShare.daily_quota	Maximum size of daily uploaded files per user, in bytes.
virtualisation.qemu.options	Options passed to QEMU
security.pam.services.<name>.enableGnomeKeyring	If enabled, pam_gnome_keyring will attempt to automatically unlock the user's default Gnome keyring upon login
services.maddy.ensureCredentials	List of user accounts which get automatically created if they don't exist yet
security.unprivilegedUsernsClone	When disabled, unprivileged users will not be able to create new namespaces
services.postfix.localRecipients	List of accepted local users
services.cron.systemCronJobs	A list of Cron jobs to be appended to the system-wide crontab
services.flarum.createDatabaseLocally	Create the database and database user locally, and run installation
services.libeufin.nexus.settings.nexus-ebics.USER_ID	User ID of the EBICS subscriber
services.linkwarden.storageLocation	Directory used to store media files
services.wastebin.settings.WASTEBIN_BASE_URL	Base URL for the QR code display
services.prometheus.scrapeConfigs..uyuni_sd_configs..basic_auth.username	HTTP username
services.unbound.localControlSocketPath	When not set to `null` this option defines the path at which the unbound remote control socket should be created at
services.journaldriver.logName	Configures the name of the target log in Stackdriver Logging
services.public-inbox.inboxes.<name>.description	User-visible description for the repository.
services.firezone.headless-client.tokenFile	A file containing the firezone client token
services.grafana.settings.users.verify_email_enabled	Require email validation before sign up completes.
services.postgresql.ensureUsers	Ensures that the specified users exist
services.keepalived.enableScriptSecurity	Don't run scripts configured to be run as root if any part of the path is writable by a non-root user.
networking.resolvconf.package	The package that provides the system-wide resolvconf command
services.mysql.replication.masterPassword	Password of the MySQL replication user.
services.szurubooru.database.passwordFile	A file containing the password for the PostgreSQL user.
services.minidlna.settings.wide_links	Set this to yes to allow symlinks that point outside user-defined `media_dir`.
services.mediawiki.database.createLocally	Create the database and database user locally
services.kubo.settings.Addresses.API	Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on
services.hostapd.radios.<name>.wifi6.multiUserBeamformer	HE multi user beamformee support
programs.tsmClient.defaultServername	If multiple server stanzas are declared with `programs.tsmClient.servers`, this option may be used to name a default server stanza that IBM TSM uses in the absence of a user-defined dsm.opt file
services.dawarich.secretKeyBaseFile	Path to file containing the secret key base
services.opkssh.authorizations	User authorization mappings
services.zoneminder.database.createLocally	Create the database and database user locally.
services.grafana.settings.users.auto_assign_org_role	The role new users will be assigned for the main organization (if the `auto_assign_org` setting is set to `true`).
services.filesender.database.createLocally	Create the PostgreSQL database and database user locally.
services.hostapd.radios.<name>.wifi7.multiUserBeamformer	EHT multi user beamformee support
services.limesurvey.nginx.virtualHost.kTLS	Whether to enable kTLS support
services.tt-rss.registration.notifyAddress	Email address to send new user notifications to.
services.minidlna.settings.media_dir	Directories to be scanned for media files
services.postfixadmin.database.host	Host of the postgresql server
services.blockbook-frontend.<name>.rpc.passwordFile	File containing password of the RPC user
services.kmonad.keyboards.<name>.extraGroups	Extra permission groups to attach to the KMonad instance for this keyboard
services.syncthing.settings.folders.<name>.path	The path to the folder which should be shared
services.prometheus.exporters.bitcoin.rpcUser	RPC user name.
services.prometheus.exporters.nut.nutUser	The user to log in into NUT server
services.varnish.listen.*.address	If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad ("127.0.0.1") or an IPv6 address enclosed in square brackets ("[::1]"). (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@" followed by the name of an abstract socket ("@myvarnishd") accept connections on a Unix domain socket
services.prometheus.scrapeConfigs..eureka_sd_configs..basic_auth.username	HTTP username
services.prometheus.scrapeConfigs..linode_sd_configs..basic_auth.username	HTTP username
services.prometheus.scrapeConfigs..consul_sd_configs..basic_auth.username	HTTP username
services.prometheus.scrapeConfigs..docker_sd_configs..basic_auth.username	HTTP username
services.wstunnel.clients.<name>.httpProxy	Proxy to use to connect to the wstunnel server (`USER:PASS@HOST:PORT`). Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `PROXY_PASSWORD=<your-password-here>` and set this option to `<user>:$PROXY_PASSWORD@<host>:<port>`
services.discourse.secretKeyBaseFile	The path to a file containing the `secret_key_base` secret
services.commafeed.environment	Extra environment variables passed to CommaFeed, refer to https://github.com/Athou/commafeed/blob/master/commafeed-server/config.yml.example for supported values
services.discourse.database.passwordFile	File containing the Discourse database user password
services.mjolnir.pantalaimon.passwordFile	File containing the matrix password for the `mjolnir` user.
services.szurubooru.server.settings.smtp.passFile	File containing the password associated to the given user for the SMTP server.
services.hostapd.radios.<name>.wifi6.singleUserBeamformee	HE single user beamformee support
services.jitsi-videobridge.xmppConfigs.<name>.domain	Domain part of JID of the XMPP user, if it is different from hostName.
services.hostapd.radios.<name>.wifi6.singleUserBeamformer	HE single user beamformer support
services.neo4j.ssl.policies.<name>.revokedDir	Path to directory of CRLs (Certificate Revocation Lists) in PEM format
services.borgbackup.repos.<name>.allowSubRepos	Allow clients to create repositories in subdirectories of the specified `path`
programs.gnupg.agent.pinentryPackage	Which pinentry package to use
services.hostapd.radios.<name>.wifi7.singleUserBeamformer	EHT single user beamformer support
services.hostapd.radios.<name>.wifi7.singleUserBeamformee	EHT single user beamformee support
services.oauth2-proxy.setXauthrequest	Set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)
services.wordpress.sites.<name>.database.createLocally	Create the database and database user locally.
services.xserver.displayManager.startx.enable	Whether to enable the dummy "startx" pseudo-display manager, which allows users to start X manually via the `startx` command from a virtual terminal. The X server will run under the current user, not as root.
services.neo4j.directories.imports	The root directory for file URLs used with the Cypher `LOAD CSV` clause
services.prosody.muc.*.allowners_muc	Add module allowners, any user in chat is able to kick other
services.limesurvey.database.createLocally	Create the database and database user locally
programs.firefox.preferencesStatus	The status of `firefox.preferences`. `status` can assume the following values: `"default"`: Preferences appear as default. `"locked"`: Preferences appear as default and can't be changed. `"user"`: Preferences appear as changed. `"clear"`: Value has no effect
services.prometheus.exporters.deluge.delugeUser	User to connect to deluge server.
services.neo4j.directories.plugins	Path of the database plugin directory
services.vdirsyncer.jobs.<name>.additionalGroups	additional groups to add the dynamic user to
services.pgmanage.connections	pgmanage requires at least one PostgreSQL server be defined
services.openssh.authorizedKeysFiles	Specify the rules for which files to read on the host
services.bitmagnet.settings.postgres.password	Password for database user
services.displayManager.dms-greeter.configFiles	List of DankMaterialShell configuration files to copy into the greeter data directory at `/var/lib/dms-greeter`
services.wasabibackend.rpc.passwordFile	File that contains the password of the RPC user.
services.hercules-ci-agent.settings.labels	A key-value map of user data
services.prometheus.scrapeConfigs..openstack_sd_configs..username	username is required if using Identity V2 API
services.prometheus.scrapeConfigs..openstack_sd_configs..userid	username is required if using Identity V2 API
programs.firefox.preferences	Preferences to set from `about:config`
services.dovecot2.imapsieve.mailbox.*.causes	Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox..name when one of the listed IMAPSIEVE causes apply
services.mattermost.database.password	Password for local Mattermost database user
services.nominatim.database.passwordFile	Password file used for Nominatim database connection
services.weblate.configurePostgresql	Whether to enable and configure a local PostgreSQL server by creating a user and database for weblate
services.prometheus.scrapeConfigs..hetzner_sd_configs..basic_auth.username	HTTP username
services.influxdb2.provision.initialSetup.tokenFile	API Token to set for the admin user
services.maddy.ensureCredentials.<name>.passwordFile	Specifies the path to a file containing the clear text password for the user.
services.slskd.settings.soulseek.description	The user description for the Soulseek network.
services.roundcube.database.passwordFile	Password file for the postgresql connection
services.ayatana-indicators.packages	List of packages containing Ayatana Indicator services that should be brought up by a SystemD "ayatana-indicators" user target
services.neo4j.ssl.policies.<name>.trustedDir	Path to directory of X.509 certificates in PEM format for trusted parties
documentation.nixos.options.splitBuild	Whether to split the option docs build into a cacheable and an uncacheable part
services.mosquitto.listeners.*.omitPasswordAuth	Omits password checking, allowing anyone to log in with any user name unless other mandatory authentication methods (eg TLS client certificates) are configured.
services.misskey.reverseProxy.webserver.nginx.kTLS	Whether to enable kTLS support
services.resilio.sharedFolders	Shared folder list
services.jitsi-meet.prosody.allowners_muc	Add module allowners, any user in chat is able to kick other
nixpkgs.pkgs	If set, the pkgs argument to all NixOS modules is the value of this option, extended with `nixpkgs.overlays`, if that is also set
services.jitsi-videobridge.xmppConfigs.<name>.passwordFile	File containing the password for the user.
services.postgresql.ensureUsers.*.ensureDBOwnership	Grants the user ownership to a database with the same name
virtualisation.forwardPorts	When using the SLiRP user networking (default), this option allows to forward ports to/from the host/guest. If the NixOS firewall on the virtual machine is enabled, you also have to open the guest ports to enable the traffic between host and guest. Currently QEMU supports only IPv4 forwarding.
security.pam.ussh.authorizedPrincipals	Comma-separated list of authorized principals to permit; if the user presents a certificate with one of these principals, then they will be authorized
services.neo4j.ssl.policies.<name>.baseDirectory	The mandatory base directory for cryptographic objects of this policy
services.writefreely.admin.initialPasswordFile	Path to a file containing the initial password for the admin user
services.uwsgi.capabilities	Grant capabilities to the uWSGI instance
services.prometheus.scrapeConfigs..marathon_sd_configs..basic_auth.username	HTTP username
services.prometheus.scrapeConfigs..puppetdb_sd_configs..basic_auth.username	HTTP username
security.pam.ussh.authorizedPrincipalsFile	Path to a list of principals; if the user presents a certificate with one of these principals, then they will be authorized
services.dependency-track.settings."alpine.ldap.enabled"	Defines if LDAP will be used for user authentication
services.parsedmarc.provision.localMail.enable	Whether Postfix and Dovecot should be set up to receive mail locally. parsedmarc will be configured to watch the local inbox as the automatically created user specified in services.parsedmarc.provision.localMail.recipientName
services.dependency-track.settings."alpine.oidc.enabled"	Defines if OpenID Connect will be used for user authentication
services.alloy.configPath	Alloy configuration file/directory path
services.authelia.instances.<name>.secrets.manual	Configuring authelia's secret files via the secrets attribute set is intended to be convenient and help catch cases where values are required to run at all
services.prometheus.exporters.unpoller.loki.pass	Path of a file containing the password for Loki
services.postfixadmin.database.passwordFile	Password file for the postgresql connection
services.foundationdb.tls.allowedPeers	"Peer verification string"
services.libinput.mouse.accelProfile	Sets the pointer acceleration profile to the given profile
services.xserver.displayManager.sx.enable	Whether to enable the "sx" pseudo-display manager, which allows users to start manually via the "sx" command from a vt shell
services.biboumi.settings.persistent_by_default	Whether all rooms will be persistent by default: the value of the “persistent” option in the global configuration of each user will be “true”, but the value of each individual room will still default to false
services.influxdb2.provision.initialSetup.passwordFile	Password for primary user
services.archisteamfarm.ipcPasswordFile	Path to a file containing the password
security.pam.sshAgentAuth.authorizedKeysFiles	A list of paths to files in OpenSSH's `authorized_keys` format, containing the keys that will be trusted by the `pam_ssh_agent_auth` module
services.grafana.settings.server.socket_gid	GID where the socket should be set when `protocol=socket`
services.dependency-track.database.databaseName	Database name to use when connecting to an external or manually provisioned database; has no effect when a local database is automatically provisioned
services.jibri.xmppEnvironments.<name>.call.login.passwordFile	File containing the password for the user.
services.strongswan-swanctl.swanctl.secrets.token.<name>.pin	Optional PIN required to access the key on the token
services.matrix-tuwunel.settings.global.server_name	The server_name is the name of this server
services.matrix-conduit.settings.global.server_name	The server_name is the name of this server
services.bitwarden-directory-connector-cli.secrets.ldap	Path to file that contains LDAP password for user in {option}`ldap.username
services.omnom.settings.app.disable_signup	Whether to enable restricting user creation.
services.prometheus.exporters.postgres.runAsLocalSuperUser	Whether to run the exporter as the local 'postgres' super user.
services.xserver.displayManager.session	List of sessions supported with the command used to start each session
programs.opengamepadui.fontPackages	Font packages to use in OpenGamepadUI
services.prometheus.exporters.nextcloud.tokenFile	File containing the token for connecting to Nextcloud
services.cloudflare-ddns.credentialsFile	Path to a file containing the Cloudflare API authentication token
services.rutorrent.nginx.exposeInsecureRPC2mount	If you do not enable one of the rpc or httprpc plugins you need to expose an RPC mount through scgi using this option
virtualisation.libvirtd.qemu.vhostUserPackages	Packages containing out-of-tree vhost-user drivers.
services.angrr.settings.profile-policies.<name>.profile-paths	Paths to the Nix profile
services.invoiceplane.sites.<name>.database.createLocally	Create the database and database user locally.
services.engelsystem.settings	Options to be added to config.php, as a nix attribute set
virtualisation.virtualbox.host.enable	Whether to enable VirtualBox. In order to pass USB devices from the host to the guests, the user needs to be in the `vboxusers` group.
services.nextcloud.settings.loglevel	Log level value between 0 (DEBUG) and 4 (FATAL). 0 (debug): Log all activity. 1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors. 2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors. 3 (error): Log failed operations and fatal errors. 4 (fatal): Log only fatal errors that cause the server to stop.
virtualisation.libvirtd.qemu.runAsRoot	If true, libvirtd runs qemu as root
services.prometheus.scrapeConfigs..kubernetes_sd_configs..basic_auth.username	HTTP username
services.nextcloud.settings."profile.enabled"	Makes user-profiles globally available under `nextcloud.tld/u/user.name`
services.journald.remote.settings.Remote.ServerKeyFile	A path to a SSL secret key file in PEM format
hardware.opentabletdriver.enable	Enable OpenTabletDriver udev rules, user service and blacklist kernel modules known to conflict with OpenTabletDriver.
services.libinput.touchpad.accelProfile	Sets the pointer acceleration profile to the given profile
services.mysql.ensureUsers.*.ensurePermissions	Permissions to ensure for the user, specified as attribute set
programs.thunderbird.preferencesStatus	The status of `thunderbird.preferences`. `status` can assume the following values: `"default"`: Preferences appear as default. `"locked"`: Preferences appear as default and can't be changed. `"user"`: Preferences appear as changed. `"clear"`: Value has no effect
services.jibri.xmppEnvironments.<name>.control.login.passwordFile	File containing the password for the user.
services.xserver.displayManager.startx.generateScript	Whether to generate the system-wide xinitrc script (/etc/X11/xinit/xinitrc)
services.magnetico.web.credentialsFile	The path to the file holding the credentials to access the web interface
services.netbird.server.management.disableSingleAccountMode	If set to true, disables single account mode
services.archisteamfarm.bots.<name>.passwordFile	Path to a file containing the password
services.waagent.settings.Provisioning.Enable	Whether to enable provisioning functionality in the agent
services.bitwarden-directory-connector-cli.sync.useEmailPrefixSuffix	If a user has no email address, combine a username prefix with a suffix value to form an email.
networking.resolvconf.dnsExtensionMechanism	Enable the `edns0` option in resolv.conf
services.prometheus.exporters.nextcloud.passwordFile	File containing the password for connecting to Nextcloud
services.parsedmarc.provision.localMail.recipientName	The DMARC mail recipient name, i.e. the name part of the email address which receives DMARC reports
services.prometheus.scrapeConfigs..dockerswarm_sd_configs..basic_auth.username	HTTP username
hardware.opentabletdriver.daemon.enable	Whether to start OpenTabletDriver daemon as a systemd user service.
services.matrix-appservice-irc.settings.homeserver.domain	The 'domain' part for user IDs on this home server
services.kerberos_server.settings.realms.<name>.acl	The privileges granted to a user.
services.prometheus.exporters.collectd.collectdBinary.authFile	File mapping user names to pre-shared keys (passwords).
services.influxdb2.provision.organizations.<name>.auths	API tokens to provision for the user in this organization.
services.postgresql.ensureUsers.*.ensureClauses.inherit	Grants the user created inherit permissions
security.pam.services.<name>.googleOsLoginAuthentication	If set, will use the `pam_oslogin_login`'s user authentication methods to authenticate users using 2FA
services.suricata.settings.dpdk	Data Plane Development Kit is a framework for fast packet processing in data plane applications running on a wide variety of CPU architectures
services.syncthing.settings.folders.<name>.copyOwnershipFromParent	On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in)
services.prometheus.scrapeConfigs..digitalocean_sd_configs..basic_auth.username	HTTP username
systemd.services.<name>.confinement.mode	The value `full-apivfs` (the default) sets up private /dev, /proc, /sys, /tmp and /var/tmp file systems in a separate user name space
services.postgresql.ensureUsers.*.ensureClauses.createdb	Grants the user, created by the ensureUser attr, createdb permissions
services.glitchtip.settings.ENABLE_ORGANIZATION_CREATION	When false, only superusers will be able to create new organizations after the first
services.matrix-continuwuity.settings.global.server_name	The server_name is the name of this server
virtualisation.directBoot.enable	If enabled, the virtual machine will boot directly into the kernel instead of through a bootloader
services.influxdb2.provision.organizations.<name>.auths.<name>.present	Whether to ensure that this user is present or absent.
services.postgresql.ensureUsers.*.ensureClauses.bypassrls	Grants the user, created by the ensureUser attr, replication permissions
services.neo4j.directories.certificates	Directory for storing certificates to be used by Neo4j for TLS connections
services.healthchecks.settings.REGISTRATION_OPEN	A boolean that controls whether site visitors can create new accounts
services.biboumi.settings.realname_from_jid	Whether the realname and username of each biboumi user will be extracted from their JID
services.grafana.settings.security.disable_gravatar	Set to `true` to disable the use of Gravatar for user profile images.
services.movim.podConfig.restrictsuggestions	Only suggest chatrooms, Communities and other contents that are available on the user XMPP server and related services
services.transmission.downloadDirPermissions	If not `null`, is used as the permissions set by `system.activationScripts.transmission-daemon` on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir
services.amazon-cloudwatch-agent.configurationFile	Amazon CloudWatch Agent configuration file
services.prometheus.exporters.pgbouncer.connectionString	Connection string for accessing pgBouncer
services.postgresql.ensureUsers.*.ensureClauses.replication	Grants the user, created by the ensureUser attr, replication permissions
services.postgresql.ensureUsers.*.ensureClauses.createrole	Grants the user, created by the ensureUser attr, createrole permissions
services.warpgate.settings.ssh.inactivity_timeout	How long can user be inactive until Warpgate terminates the connection.
services.prometheus.exporters.fritz.settings.devices.*.password_file	Path to a file which contains the password to authenticate with the target device
services.prometheus.exporters.mail.configuration.servers.*.detectionDir	Directory in which new mails for the exporter user are placed
services.doh-server.settings.ecs_use_precise_ip	If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask
services.pgbouncer.settings.pgbouncer.default_pool_size	How many server connections to allow per user/database pair
services.movim.h2o.tls.recommendations	By default, H2O, without prejudice, will use as many TLS versions & cipher suites as it & the TLS library (OpenSSL) can support
services.h2o.hosts.<name>.tls.recommendations	By default, H2O, without prejudice, will use as many TLS versions & cipher suites as it & the TLS library (OpenSSL) can support
services.h2o.defaultTLSRecommendations	By default, H2O, without prejudice, will use as many TLS versions & cipher suites as it & the TLS library (OpenSSL) can support
environment.memoryAllocator.provider	The system-wide memory allocator
services.dolibarr.h2o.tls.recommendations	By default, H2O, without prejudice, will use as many TLS versions & cipher suites as it & the TLS library (OpenSSL) can support
services.matrix-continuwuity.settings.global.unix_socket_path	Listen on a UNIX socket at the specified path
services.mediagoblin.settings.mediagoblin.allow_registration	Whether to enable user self registration
services.pgbouncer.settings.pgbouncer.max_db_connections	Do not allow more than this many server connections per database (regardless of user)
services.dendrite.settings.client_api.registration_disabled	Whether to disable user registration to the server without the shared secret.
services.grafana.settings.security.csrf_additional_headers	List of allowed headers to be set by the user
services.grafana.settings.security.content_security_policy	Set to `true` to add the `Content-Security-Policy` header to your requests
services.buffyboard.settings.quirks.ignore_unused_terminals	If true, buffyboard won't automatically update the layout of a new terminal and draw the keyboard, if the terminal is not opened by any process
services.grafana.settings.security.disable_initial_admin_creation	Disable creation of admin user on first start of Grafana.
services.stash.settings.show_one_time_moved_notification	Whether a small notification to inform the user that Stash will no longer show a terminal window, and instead will be available in the tray
security.pam.u2f.enable	Enables U2F PAM (`pam-u2f`) module
services.dante.config	Contents of Dante's configuration file
services.magnetico.web.credentials	The credentials to access the web interface, in case authentication is enabled, in the format `username:hash`
security.pam.yubico.enable	Enables Yubico PAM (`yubico-pam`) module
services.coturn.realm	The default realm to be used for the users when no explicit origin/realm relationship was found in the database, or if the TURN server is not using any database (just the commands-line settings and the userdb file)
virtualisation.kvmgt.enable	Whether to enable KVMGT (iGVT-g) VGPU support
services.mchprs.whitelist.list	Whitelisted players, only has an effect when `services.mchprs.declarativeWhitelist` is `true` and the whitelist is enabled via `services.mchprs.whitelist.enable`
services.minecraft-server.whitelist	Whitelisted players, only has an effect when `services.minecraft-server.declarative` is `true` and the whitelist is enabled via `services.minecraft-server.serverProperties` by setting `white-list` to `true`
hardware.brillo.enable	Whether to enable brillo in userspace
services.memos.group	The group to run Memos as. If changing the default value, you are responsible of creating the corresponding group with `users.groups`.
services.yarr.authFilePath	Path to a file containing username:password. `null` means no authentication required to use the service.
services.deluge.authFile	The file managing the authentication for deluge, the format of this file is straightforward, each line contains a username:password:level tuple in plaintext
services.gpsd.devices	List of devices that `gpsd` should subscribe to
boot.zfs.package	Configured ZFS userland tools package.
programs.bash.enable	Whenever to configure Bash as an interactive shell
programs.rust-motd.enableMotdInSSHD	Whether to let `openssh` print the result when entering a new `ssh`-session
services.dependency-track.oidc.teams.claim	Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
services.silverbullet.envFile	File containing extra environment variables
programs.wayland.miracle-wm.enable	Whether to enable miracle-wm, a tiling Mir based Wayland compositor
services.bitwarden-directory-connector-cli.sync.emailPrefixAttribute	The attribute that contains the users username.
services.dependency-track.settings."alpine.oidc.teams.claim"	Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
hardware.nfc-nci.enable	Whether to enable PN5xx kernel module with udev rules, libnfc-nci userland, and optional ifdnfc-nci PC/SC driver.
security.pam.u2f.settings.authfile	By default `pam-u2f` module reads the keys from $XDG_CONFIG_HOME/Yubico/u2f_keys (or $HOME/.config/Yubico/u2f_keys if XDG variable is not set)
security.pam.services.<name>.rootOK	If set, root doesn't need to authenticate (e.g. for the `useradd` service).
services.matrix-appservice-irc.localpart	The user_id localpart to assign to the appservice
security.loginDefs.settings.GID_MAX	Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
security.loginDefs.settings.GID_MIN	Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.
security.loginDefs.settings.SYS_GID_MAX	Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
security.loginDefs.settings.SYS_GID_MIN	Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers
services.matrix-appservice-discord.localpart	The user_id localpart to assign to the AS.
services.multipath.devices.*.alias_prefix	The user_friendly_names prefix to use for this device type, instead of the default mpath
services.hologram-server.ldapUserAttr	The LDAP attribute for usernames
services.biboumi.settings.realname_customization	Whether the users will be able to use the ad-hoc commands that lets them configure their realname and username.
services.usbguard.IPCAllowedUsers	A list of usernames that the daemon will accept IPC connections from.
services.openafsClient.packages.module	OpenAFS kernel module package
security.pam.services.<name>.sshAgentAuth	If set, the calling user's SSH agent is used to authenticate against the keys in the calling user's ~/.ssh/authorized_keys
services.dendrite.settings.global.server_name	The domain name of the server, with optional explicit port
services.matrix-synapse.settings.server_name	The domain name of the server, with optional explicit port
services.openssh.authorizedKeysInHomedir	Enables the use of the `~/.ssh/authorized_keys` file
services.icingaweb2.modules.monitoring.generalConfig.protectedVars	List of string patterns for custom variables which should be excluded from user’s view.
services.gvfs.enable	Whether to enable GVfs, a userspace virtual filesystem.
services.vsftpd.virtualUseLocalPrivs	If enabled, virtual users will use the same privileges as local users
services.iptsd.enable	Whether to enable the userspace daemon for Intel Precise Touch & Stylus.
services.ulogd.enable	Whether to enable ulogd, a userspace logging daemon for netfilter/iptables related logging.
programs.neovim.enable	Whether to enable Neovim
security.tpm2.abrmd.enable	Whether to enable Trusted Platform 2 userspace resource manager daemon .
services.jitsi-meet.extraConfig	Text to append to config.js web application config file
services.hledger-web.allow	User's access level for changing data. view: view only permission. add: view and add permissions. edit: view, add, and edit permissions. sandstorm: permissions from the `X-Sandstorm-Permissions` request header.
services.scx.enable	Whether to enable SCX service, a daemon to run schedulers from userspace. This service requires a kernel with the Sched-ext feature
services.discourse.admin.fullName	The admin user's full name.
services.webdav.settings	Attrset that is converted and passed as config file
services.tt-rss.database.password	The database user's password.
services.tt-rss.database.passwordFile	The database user's password.
networking.ucarp.enable	Whether to enable ucarp, userspace implementation of CARP.
security.pam.services.<name>.rssh	If set, the calling user's SSH agent is used to authenticate against the configured keys
services.davis.adminLogin	Username for the admin account.
security.pam.zfs.homes	Prefix of home datasets
hardware.openrazer.enable	Whether to enable OpenRazer drivers and userspace daemon .
services.flarum.adminUser	Username for first web application administrator
services.selfoss.database.password	The database user's password (has no effect if type is "sqlite").
services.athens.basicAuthUser	Username for basic auth.
services.resilio.httpLogin	HTTP web login username.
services.xserver.windowManager.exwm.loadScript	Emacs lisp code to be run after loading the user's init file.
services.kmscon.enable	Whether to enable kmscon as the virtual console instead of gettys. kmscon is a kms/dri-based userspace virtual terminal implementation
services.tee-supplicant.enable	Whether to enable OP-TEE userspace supplicant.
services.hardware.bolt.enable	Whether to enable Bolt, a userspace daemon to enable security levels for Thunderbolt 3 on GNU/Linux
services.ncdns.enable	Whether to enable ncdns, a Go daemon to bridge Namecoin to DNS
services.discourse.admin.passwordFile	A path to a file containing the admin user's password
security.pam.loginLimits.*.domain	Username, groupname, or wildcard this limit applies to
services.mongodb.enableAuth	Enable client authentication
services.nntp-proxy.upstreamUser	Upstream server username
services.sniproxy.config	sniproxy.conf configuration excluding the daemon username and pid file.
nix.sshServe.trusted	Whether to add nix-ssh to the nix.settings.trusted-users
services.esdm.enableLinuxCompatServices	Enable /dev/random, /dev/urandom and /proc/sys/kernel/random/* userspace wrapper.
security.pam.services.<name>.gnupg.enable	If enabled, pam_gnupg will attempt to automatically unlock the user's GPG keys with the login password via `gpg-agent`
services.openssh.authorizedKeysCommand	Specifies a program to be used to look up the user's public keys
services.freshrss.defaultUser	Default username for FreshRSS.
services.tailscale.interfaceName	The interface name for tunnel traffic
services.fcron.deny	Users forbidden from using fcron.
services.displayManager.dms-greeter.configHome	Path to a user's home directory from which to copy DankMaterialShell configuration files
services.wasabibackend.customConfigFile	Defines the path to a custom configuration file that is copied to the user's directory
services.davis.nginx.basicAuthFile	Basic Auth password file for a vhost
services.movim.nginx.basicAuthFile	Basic Auth password file for a vhost
services.slskd.nginx.basicAuthFile	Basic Auth password file for a vhost
hardware.i2c.group	Grant access to i2c devices (/dev/i2c-*) to users in this group.
services.getty.autologinUser	Username of the account that will be automatically logged in at the console
services.snipe-it.nginx.basicAuthFile	Basic Auth password file for a vhost
services.resilio.storagePath	Where BitTorrent Sync will store it's database files (containing things like username info and licenses)
programs.wireshark.enable	Whether to add Wireshark to the global environment and create a 'wireshark' group
services.logrotate.checkConfig	Whether the config should be checked at build time
services.fluidd.nginx.basicAuthFile	Basic Auth password file for a vhost
services.akkoma.nginx.basicAuthFile	Basic Auth password file for a vhost
services.gancio.nginx.basicAuthFile	Basic Auth password file for a vhost
services.matomo.nginx.basicAuthFile	Basic Auth password file for a vhost
services.monica.nginx.basicAuthFile	Basic Auth password file for a vhost
services.incron.deny	Users forbidden from using incrontab.
services.prosody.modules.blocklist	Allow users to block communications with other users
services.kmscon.autologinUser	Username of the account that will be automatically logged in at the console
programs.cdemu.group	Group that users must be in to use `cdemu`.
services.moodle.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.nagios.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.grafana.settings.database.password	The database user's password (not applicable for `sqlite3`)
services.libinput.mouse.buttonMapping	Sets the logical button mapping for this device, see XSetPointerMapping(3)
services.cadvisor.storageDriverUser	Cadvisor storage driver username.
programs.wireshark.usbmon.enable	Whether to allow users in the 'wireshark' group to capture USB traffic
programs.wireshark.dumpcap.enable	Whether to allow users in the 'wireshark' group to capture network traffic
services.tor.relay.role	Your role in Tor network
security.pam.services.<name>.limits.*.domain	Username, groupname, or wildcard this limit applies to
services.httpd.virtualHosts.<name>.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.znc.confOptions.passBlock	Generate with `nix-shell -p znc --command "znc --makepass"`
programs.fuse.mountMax	Set the maximum number of FUSE mounts allowed to non-root users.
services.oauth2-proxy.google.adminEmail	The Google Admin to impersonate for API calls
programs.ryzen-monitor-ng.enable	Whether to enable ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver
services.syncplay.maxUsernameLength	Maximum number of characters in a username.
services.fcron.allow	Users allowed to use fcrontab and fcrondyn (one name per line, `all` for everyone).
services.kanboard.nginx.basicAuthFile	Basic Auth password file for a vhost
services.librenms.nginx.basicAuthFile	Basic Auth password file for a vhost
services.dolibarr.nginx.basicAuthFile	Basic Auth password file for a vhost
services.agorakit.nginx.basicAuthFile	Basic Auth password file for a vhost
services.fediwall.nginx.basicAuthFile	Basic Auth password file for a vhost
services.mainsail.nginx.basicAuthFile	Basic Auth password file for a vhost
services.pixelfed.nginx.basicAuthFile	Basic Auth password file for a vhost
services.libinput.touchpad.buttonMapping	Sets the logical button mapping for this device, see XSetPointerMapping(3)
services.guix.nrBuildUsers	Number of Guix build users to be used in the build pool.
services.mautrix-meta.instances	Configuration of multiple `mautrix-meta` instances. `services.mautrix-meta.instances.facebook` and `services.mautrix-meta.instances.instagram` come preconfigured with network.mode, appservice.id, bot username, display name and avatar.
services.tor.torsocks.socks5Username	SOCKS5 username
services.microsocks.authUsername	Optional username to use for authentication.
services.zabbixWeb.httpd.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.radicle.httpd.nginx.basicAuthFile	Basic Auth password file for a vhost
security.sudo.enable	Whether to enable the `sudo` command, which allows non-root users to execute commands as root.
security.doas.enable	Whether to enable the `doas` command, which allows non-root users to execute commands as root.
services.deye-dummycloud.mqttUsername	MQTT username
services.drupal.sites.<name>.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.anuko-time-tracker.nginx.basicAuthFile	Basic Auth password file for a vhost
services.oauth2-proxy.htpasswd.displayForm	Display username / password login form if an htpasswd file is provided.
services.nginx.virtualHosts.<name>.basicAuthFile	Basic Auth password file for a vhost
services.warpgate.databaseUrlFile	Path to file containing database connection string with credentials
services.anuko-time-tracker.settings.email.smtpUser	MTA authentication username.
services.ntopng.enable	Enable ntopng, a high-speed web-based traffic analysis and flow collection tool
security.ipa.shells	List of shells which binaries should be installed to /bin/
programs.ydotool.group	Group which users must be in to use `ydotool`.
services.syncplay.chat	Chat with users in the same room.
security.pam.services.<name>.googleAuthenticator.forwardPass	The authentication provides a single field requiring the user's password followed by the one-time password (OTP).
services.bookstack.nginx.basicAuthFile	Basic Auth password file for a vhost
services.onlyoffice.postgresUser	The username OnlyOffice should use to connect to Postgresql
services.vsftpd.localUsers	Whether to enable FTP for local users.
security.ipa.ifpAllowedUids	A list of users allowed to access the ifp dbus interface.
security.sudo-rs.enable	Whether to enable a memory-safe implementation of the `sudo` command, which allows non-root users to execute commands as root .
hardware.sane.enable	Enable support for SANE scanners. Users in the "scanner" group will gain access to the scanner, or the "lp" group if it's also a printer.
services.vmagent.remoteWrite.basicAuthUsername	Basic Auth username used to connect to remote_write endpoint
services.vlagent.remoteWrite.basicAuthUsername	Basic Auth username used to connect to remote_write endpoint
services.jirafeau.nginxConfig.basicAuthFile	Basic Auth password file for a vhost
programs.nix-required-mounts.presets.nvidia-gpu.enable	Whether to enable Declare the support for derivations that require an Nvidia GPU to be available, e.g. derivations with `requiredSystemFeatures = [ "cuda" ]`
services.syncplay.ready	Check readiness of users.
services.weblate.smtp.port	SMTP port used when sending emails to users.
services.weblate.smtp.host	SMTP host used when sending emails to users.
services.mattermost.database.host	Host to use for the database
services.mediagoblin.enable	Whether to enable MediaGoblin
services.sabnzbd.secretFiles	Path to a list of ini file containing confidential settings such as credentials
services.zabbixWeb.nginx.virtualHost.basicAuthFile	Basic Auth password file for a vhost
services.firezone.server.smtp.passwordFile	File containing the password for the given username
services.bitwarden-directory-connector-cli.sync.creationDateAttribute	Attribute that lists a user's creation date.
services.pyload.credentialsFile	File containing PYLOAD_DEFAULT_USERNAME and PYLOAD_DEFAULT_PASSWORD in the format of an `EnvironmentFile=`, as described by systemd.exec(5)
security.pam.p11.enable	Enables P11 PAM (`pam_p11`) module
services.vsftpd.writeEnable	Whether any write activity is permitted to users.
services.postgresql.authentication	Defines how users authenticate themselves to the server
hardware.bladeRF.enable	Enables udev rules for BladeRF devices
services.ombi.enable	Whether to enable Ombi, a web application that automatically gives your shared Plex or Emby users the ability to request content by themselves! Optionally see https://docs.ombi.app/info/reverse-proxy on how to set up a reverse proxy .
services.limesurvey.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.mediawiki.httpd.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.headscale.settings.oidc.allowed_domains	Allowed principal domains. if an authenticated user's domain is not in this list authentication request will be rejected.
programs.pmount.enable	Whether to enable pmount, a tool that allows normal users to mount removable devices without requiring root privileges .
services.tt-rss.auth.autoCreate	Allow authentication modules to auto-create users in tt-rss internal database when authenticated successfully.
services.davis.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.movim.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.slskd.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.sympa.listMasters	The list of the email addresses of the listmasters (users authorized to perform global server commands).
services.snipe-it.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.dovecot2.mailGroup	Default group to store mail for virtual users.
services.dawarich.smtp.host	SMTP host used when sending emails to users.
services.dawarich.smtp.port	SMTP port used when sending emails to users.
services.mastodon.smtp.host	SMTP host used when sending emails to users.
services.mastodon.smtp.port	SMTP port used when sending emails to users.
services.wordpress.sites.<name>.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
services.matrix-synapse.settings.presence.enabled	Whether to enable presence tracking
security.pam.dp9ik.enable	Whether to enable the dp9ik pam module provided by tlsclient
services.jupyter.group	Name of the group used to run the jupyter service
security.sudo.execWheelOnly	Only allow members of the `wheel` group to execute sudo by setting the executable's permissions accordingly
security.pam.howdy.enable	Whether to enable the Howdy PAM module
services.davfs2.davGroup	The group of the running mount.davfs daemon
services.syncplay.motdFile	Path to text to display when users join
services.akkoma.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.fluidd.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.fedimintd.<name>.nginx.config.basicAuthFile	Basic Auth password file for a vhost
services.gancio.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.monica.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.matomo.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.zoneminder.database.password	Username for accessing the database
services.mastodon.smtp.authenticate	Authenticate with the SMTP server using username and password.
security.sudo-rs.execWheelOnly	Only allow members of the `wheel` group to execute sudo by setting the executable's permissions accordingly
services.sftpgo.loadDataFile	Path to a json file containing users and folders to load (or update) on startup
services.doh-server.settings.log_guessed_client_ip	Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP Note: http uri/useragent log cannot be controlled by this config
services.limesurvey.httpd.virtualHost.enableUserDir	Whether to enable serving ~/public_html as `/~«username»`.
programs.minipro.enable	Whether to enable minipro and its udev rules
services.mjolnir.pantalaimon.enable	Whether to enable ignoring the accessToken
services.mchprs.settings.chat_format	How to format chat message interpolating `username` and `message` with curly braces
security.duosec.groups	If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated pattern lists
services.drupal.sites.<name>.themesDir	The location for users to install Drupal themes.
services.prosody.modules.mam	Store messages in an archive and allow users to access it
services.prosody.modules.motd	Send a message to users when they log in
virtualisation.incus.enable	Whether to enable incusd, a daemon that manages containers and virtual machines
services.prosody.modules.pep	Enables users to publish their mood, activity, playing music and more
services.umami.createPostgresqlDatabase	Whether to automatically create the database for Umami using PostgreSQL
services.victorialogs.basicAuthUsername	Basic Auth username used to protect VictoriaLogs instance by authorization
services.timekpr.adminUsers	All listed users will become part of the `timekpr` group so they can manage timekpr settings without requiring sudo.
services.syncplay.motd	Text to display when users join
virtualisation.qemu.networkingOptions	Networking-related command-line options that should be passed to qemu
services.prosody.modules.vcard	Allow users to set vCards
services.kea.dhcp6.configFile	Kea DHCP6 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp6-srv.html
services.kea.dhcp4.configFile	Kea DHCP4 configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/dhcp4-srv.html
services.dolibarr.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.kanboard.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.librenms.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.agorakit.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.fediwall.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.mainsail.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.pixelfed.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.hologram-server.ldapBaseDN	The base DN for your Hologram users
services.bitlbee.authBackend	How users are authenticated storage -- save passwords internally pam -- Linux PAM authentication
services.alerta.signupEnabled	Whether to prevent sign-up of new users via the web UI
programs.flashrom.enable	Installs flashrom and configures udev rules for programmers used by flashrom
services.limesurvey.nginx.virtualHost.basicAuthFile	Basic Auth password file for a vhost
services.drupal.sites.<name>.modulesDir	The location for users to install Drupal modules.
security.pam.services.<name>.unixAuth	Whether users can log in with passwords defined in /etc/shadow.
services.aria2.enable	Whether or not to enable the headless Aria2 daemon service
services.radicle.httpd.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
security.loginDefs.chfnRestrict	Use chfn SUID to allow non-root users to change their account GECOS information.
services.prosody.modules.roster	Allow users to have a roster
services.tt-rss.forceArticlePurge	When this option is not 0, users ability to control feed purging intervals is disabled and all articles (which are not starred) older than this amount of days are purged.
services.zeitgeist.enable	Whether to enable zeitgeist, a service which logs the users' activities and events.
services.kea.dhcp-ddns.configFile	Kea DHCP-DDNS configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/ddns.html
services.easytier.instances.<name>.configServer	Configure the instance from config server
services.anuko-time-tracker.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.prometheus.remoteRead.*.basic_auth	Sets the `Authorization` header on every remote read request with the configured username and password. password and password_file are mutually exclusive.
services.prometheus.exporters.mqtt.mqttUsername	Username which should be used to authenticate against the MQTT broker.
services.nginx.virtualHosts.<name>.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
programs.mouse-actions.enable	Whether to install and set up mouse-actions and it's udev rules
services.vsftpd.forceLocalDataSSL	Only applies if `sslEnable` is true
services.bookstack.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.suwayomi-server.settings.server.basicAuthUsername	The username value that you have to provide when authenticating.
security.pam.krb5.enable	Enables Kerberos PAM modules (`pam-krb5`, `pam-ccreds`)
services.prometheus.remoteWrite.*.basic_auth	Sets the `Authorization` header on every remote write request with the configured username and password. password and password_file are mutually exclusive.
hardware.acpilight.enable	Enable acpilight
security.pam.services.<name>.mysqlAuth	If set, the `pam_mysql` module will be used to authenticate users against a MySQL/MariaDB database.
services.kea.ctrl-agent.configFile	Kea Control Agent configuration as a path, see https://kea.readthedocs.io/en/kea-3.0.2/arm/agent.html
services.pinchflat.secretsFile	Secrets like SECRET_KEY_BASE and BASIC_AUTH_PASSWORD should be passed to the service without adding them to the world-readable Nix store
services.jirafeau.nginxConfig.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.tailscaleAuth.enable	Whether to enable tailscale.nginx-auth, to authenticate users via tailscale.
services.dawarich.smtp.fromAddress	"From" address used when sending emails to users.
security.pam.services.<name>.makeHomeDir	Whether to try to create home directories for users with `$HOME`s pointing to nonexistent locations on session login.
services.mastodon.smtp.fromAddress	"From" address used when sending Emails to users.
services.vsftpd.forceLocalLoginsSSL	Only applies if `sslEnable` is true
services.zabbixWeb.nginx.virtualHost.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.bepasty.servers.<name>.workDir	Path to the working directory (used for config and pidfile)
services.prosody.modules.welcome	Welcome users who register accounts
services.misskey.reverseProxy.webserver.nginx.basicAuthFile	Basic Auth password file for a vhost
services.prometheus.scrapeConfigs.*.basic_auth	Sets the `Authorization` header on every scrape request with the configured username and password. password and password_file are mutually exclusive.
services.displayManager.hiddenUsers	A list of users which will not be shown in the display manager.
security.pam.dp9ik.authserver	This controls the hostname for the 9front authentication server that users will be authenticated against.
security.pam.services.<name>.yubicoAuth	If set, users listed in ~/.yubico/authorized_yubikeys are able to log in with the associated Yubikey tokens.
services.portunus.seedSettings	Seed settings for users and groups
services.terraria.enable	If enabled, starts a Terraria server
services.victoriatraces.basicAuthUsername	Basic Auth username used to protect VictoriaTraces instance by authorization
security.pam.services.<name>.ttyAudit.enable	Enable or disable TTY auditing for specified users
networking.wireguard.interfaces.<name>.peers.*.endpoint	Endpoint IP or hostname of the peer, followed by a colon, and then a port number of the peer
services.freshrss.api.enable	Whether to enable API access for mobile apps and third-party clients (Google Reader API and Fever API)
programs.soundmodem.enable	Whether to add Soundmodem to the global environment and configure a wrapper for 'soundmodemconfig' for users in the 'soundmodem' group.
virtualisation.spiceUSBRedirection.enable	Install the SPICE USB redirection helper with setuid privileges
services.fedimintd.<name>.nginx.config.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
security.pam.loginLimits	Define resource limits that should apply to users or groups
services.prosody.modules.announce	Send announcement to all online users
services.kanidm.provision.enable	Whether to enable provisioning of groups, users and oauth2 resource servers.
services.xserver.imwheel.rules	Window class translation rules. /etc/X11/imwheelrc is generated based on this config which means this config is global for all users
services.nextcloud.settings.mail_smtpname	This depends on `mail_smtpauth`
hardware.libjaylink.enable	Whether to enable udev rules for devices supported by libjaylink
services.nginx.tailscaleAuth.enable	Whether to enable tailscale.nginx-auth, to authenticate nginx users via tailscale.
security.pam.services.<name>.u2fAuth	If set, users listed in $XDG_CONFIG_HOME/Yubico/u2f_keys (or $HOME/.config/Yubico/u2f_keys if XDG variable is not set) are able to log in with the associated U2F key
security.please.wheelNeedsPassword	Whether users of the `wheel` group must provide a password to run commands or edit files with `please` and `pleaseedit` respectively.
hardware.keyboard.uhk.enable	Whether to enable non-root access to the firmware of UHK keyboards
services.vsftpd.anonymousMkdirEnable	Whether any uploads are permitted to anonymous users.
services.biboumi.settings.admin	The bare JID of the gateway administrator
services.tuliprox.apiProxySettings	Users and proxy configuration Refer to the Tuliprox documentation for available attributes
services.openssh.settings.AllowUsers	If specified, login is allowed only for the listed users
services.prosody.modules.register	Allow users to register on this server using a client and change passwords
services.victoriametrics.basicAuthUsername	Basic Auth username used to protect VictoriaMetrics instance by authorization
security.pam.services.<name>.usshAuth	If set, users with an SSH certificate containing an authorized principal in their SSH agent are able to log in
services.kubo.settings.Mounts.FuseAllowOther	Allow all users to access the FUSE mount points
services.openssh.settings.LogLevel	Gives the verbosity level that is used when logging messages from sshd(8)
services.openssh.settings.DenyUsers	If specified, login is denied for all listed users
services.cryptpad.settings.adminKeys	List of public signing keys of users that can access the admin panel
environment.shellAliases	An attribute set that maps aliases (the top level attribute names in this option) to command strings or directly to build outputs
fonts.fontconfig.antialias	Enable font antialiasing
programs.chromium.initialPrefs	Initial preferences are used to configure the browser for the first run
security.pam.services.<name>.howdy.enable	Whether to enable the Howdy PAM module
services.snapper.configs.<name>.ALLOW_USERS	List of users allowed to operate with the config. "root" is always implicitly included
services.vsftpd.anonymousUploadEnable	Whether any uploads are permitted to anonymous users.
services.vsftpd.chrootlocalUser	Whether local users are confined to their home directory.
services.limesurvey.nginx.virtualHost.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
programs.hyprland.withUWSM	Launch Hyprland with the UWSM (Universal Wayland Session Manager) session manager
services.iperf3.authorizedUsersFile	Path to the configuration file containing authorized users credentials to run iperf tests.
services.openssh.settings.AllowGroups	If specified, login is allowed only for users part of the listed groups
services.buildbot-master.reporters	List of reporter objects used to present build status to various users.
services.openssh.settings.DenyGroups	If specified, login is denied for all users part of the listed groups
virtualisation.virtualbox.host.enableHardening	Enable hardened VirtualBox, which ensures that only the binaries in the system path get access to the devices exposed by the kernel modules instead of all users in the vboxusers group. Disabling this can put your system's security at risk, as local users in the vboxusers group can tamper with the VirtualBox device files.
services.movim.minifyStaticFiles	Do minification on public static files which reduces the size of assets — saving data for the server & users as well as offering a performance improvement
services.prometheus.exporters.artifactory.artiUsername	Username for authentication against JFrog Artifactory API.
services.gitlab.secrets.jwsFile	A file containing the secret used to encrypt session keys
services.firezone.gui-client.allowedUsers	All listed users will become part of the `firezone-client` group so they can control the tunnel service
system.extraDependencies	A list of paths that should be included in the system closure but generally not visible to users
services.misskey.reverseProxy.webserver.nginx.locations.<name>.basicAuthFile	Basic Auth password file for a vhost
services.gitlab.secrets.otpFile	A file containing the secret used to encrypt secrets for OTP tokens
services.cryptpad.settings.httpUnsafeOrigin	This is the URL that users will enter to load your instance
fonts.fontconfig.hinting.enable	Enable font hinting
services.tt-rss.registration.maxUsers	Maximum amount of users which will be allowed to register on this system. 0 - no limit.
networking.wg-quick.interfaces.<name>.peers.*.persistentKeepalive	This is optional and is by default off, because most users will not need it
programs._1password-gui.polkitPolicyOwners	A list of users who should be able to integrate 1Password with polkit-based authentication mechanisms.
services.mtprotoproxy.secureOnly	Don't allow users to connect in non-secure mode (without random padding).
services.sourcehut.settings."todo.sr.ht".notify-from	Outgoing email for notifications generated by users.
services.akkoma.config.":pleroma".":frontends"	Frontend configuration
services.ntfy-sh.environmentFile	Path to a file containing extra ntfy environment variables in the systemd `EnvironmentFile` format
services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.xauth_id	Client XAuth username used in the XAuth exchange.
services.prometheus.remoteRead.*.name	Name of the remote read config, which if specified must be unique among remote read configs
services.sourcehut.settings."lists.sr.ht".notify-from	Outgoing email for notifications generated by users.
services.sourcehut.settings."builds.sr.ht".allow-free	Whether to enable nonpaying users to submit builds.
environment.systemPackages	The set of packages that appear in /run/current-system/sw
services.pgbackrest.repos.<name>.sftp-private-key-file	SFTP private key file
services.prometheus.remoteWrite.*.name	Name of the remote write config, which if specified must be unique among remote write configs
services.sourcehut.settings."todo.sr.ht::mail".sock-group	The lmtp daemon will make the unix socket group-read/write for users in this group.
services.prometheus.exporters.mail.configuration.servers.*.login	Username to use for SMTP authentication.
services.aria2.downloadDirPermission	The permission for `settings.dir`
networking.wireguard.interfaces.<name>.peers.*.persistentKeepalive	This is optional and is by default off, because most users will not need it
services.syncthing.openDefaultPorts	Whether to open the default ports in the firewall: TCP/UDP 22000 for transfers and UDP 21027 for discovery
services.zwave-js.secretsConfigFile	JSON file containing secret keys
services.meilisearch.noAnalytics	Deactivates analytics
fonts.fontconfig.subpixel.lcdfilter	FreeType LCD filter
services.spacecookie.settings.log.hide-ips	If enabled, spacecookie will hide personal information of users like IP addresses from log output.
services.anuko-time-tracker.settings.multiorgMode	Defines whether users see the Register option in the menu of Time Tracker that allows them to self-register and create new organizations (top groups).
nix.settings.trusted-substituters	List of binary cache URLs that non-root users can use (in addition to those specified using `nix.settings.substituters`) by passing `--option binary-caches` to Nix commands.
services.nginx.tailscaleAuth.expectedTailnet	If you want to prevent node sharing from allowing users to access services across tailnets, declare your expected tailnets domain here.
services.paperless.consumptionDirIsPublic	Whether all users can write to the consumption dir.
services.tt-rss.registration.enable	Allow users to register themselves
services.sourcehut.settings."lists.sr.ht::worker".sock-group	The lmtp daemon will make the unix socket group-read/write for users in this group.
services.hydra.useSubstitutes	Whether to use binary caches for downloading store paths
services.prosody.modules.vcard_legacy	Converts users profiles and Avatars between old and new formats
services.matrix-tuwunel.settings.global.allow_registration	Whether new users can register on this server
boot.initrd.network.ssh.hostKeys	Specify SSH host keys to import into the initrd
documentation.man.man-db.manualPages	The manual pages to generate caches for if `documentation.man.generateCaches` is enabled
services.transmission.enable	Whether to enable the headless Transmission BitTorrent daemon
services.szurubooru.server.settings.secretFile	File containing a secret used to salt the users' password hashes and generate filenames for static content.
services.dependency-track.oidc.teams.default	Defines one or more team names that auto-provisioned OIDC users shall be added to
services.smartd.notifications.wall.enable	Whenever to send wall notifications to all users.
services.prosody.modules.cloud_notify	Push notifications to inform users of new messages or other pertinent information even when they have no XMPP clients online
virtualisation.docker.enable	This option enables docker, a daemon that manages linux containers
environment.defaultPackages	Set of default packages that aren't strictly necessary for a running system, entries can be removed for a more minimal NixOS installation
services.dependency-track.frontend.baseUrl	The base URL of the API server
virtualisation.lxd.enable	This option enables lxd, a daemon that manages containers
security.dhparams.params	Diffie-Hellman parameters to generate
services.linkwarden.enableRegistration	Whether to enable registration for new users.
services.pretix.settings.pretix.registration	Whether to allow registration of new admin users.
services.transmission.settings.umask	Sets transmission's file mode creation mask
environment.corePackages	Set of core packages for a normal interactive system
services.strongswan-swanctl.swanctl.secrets.eap.<name>.id	Identity the EAP/XAuth secret belongs to
services.strongswan-swanctl.swanctl.secrets.ntlm.<name>.id	Identity the NTLM secret belongs to
virtualisation.libvirtd.enable	This option enables libvirtd, a daemon that manages virtual machines
services.firezone.server.provision.accounts.<name>.actors	All actors (users) to provision
services.taskserver.organisations	An attribute set where the keys name the organisation and the values are a set of lists of `users` and `groups`.
hardware.display.edid.linuxhw	Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID Attribute names will be mapped to EDID filenames `<NAME>.bin`
services.nullmailer.config.adminaddr	If set, all recipients to users at either "localhost" (the literal string) or the canonical host name (from the me control attribute) are remapped to this address
services.matrix-continuwuity.settings.global.allow_registration	Whether new users can register on this server
services.bitwarden-directory-connector-cli.sync.largeImport	Enable if you are syncing more than 2000 users/groups.
services.prosody.xmppComplianceSuite	The XEP-0423 defines a set of recommended XEPs to implement for a server
services.strongswan-swanctl.swanctl.secrets.xauth.<name>.id	Identity the EAP/XAuth secret belongs to
services.grafana.settings.server.enable_gzip	Set this option to `true` to enable HTTP compression, this can improve transfer speed and bandwidth utilization
services.i2pd.precomputation.elgamal	Whenever to use precomputated tables for ElGamal. `i2pd` defaults to `false` to save 64M of memory (and looses some performance)
services.wstunnel.clients.<name>.environmentFile	Environment file to be passed to the systemd service
services.wstunnel.servers.<name>.environmentFile	Environment file to be passed to the systemd service
services.alerta.authenticationRequired	Whether users must authenticate when using the web UI or command-line tool
services.anubis.defaultOptions.settings.WEBMASTER_EMAIL	If set, shows a contact email address when rendering error pages
services.anubis.instances.<name>.settings.WEBMASTER_EMAIL	If set, shows a contact email address when rendering error pages
services.netbird.server.management.singleAccountModeDomain	Enables single account mode
services.gitea.captcha.requireForExternalRegistration	Displays a CAPTCHA challenge for users that register externally.
networking.networkmanager.enable	Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured
virtualisation.podman.dockerSocket.enable	Make the Podman socket available in place of the Docker socket, so Docker tools can find the Podman socket
services.dependency-track.settings."alpine.oidc.teams.default"	Defines one or more team names that auto-provisioned OIDC users shall be added to
services.bitwarden-directory-connector-cli.sync.removeDisabled	Remove users from bitwarden groups if no longer in the ldap group.
security.pam.services.<name>.googleAuthenticator.enable	If set, users with enabled Google Authenticator (created ~/.google_authenticator) will be required to provide Google Authenticator token to log in.
virtualisation.docker.rootless.setSocketVariable	Point `DOCKER_HOST` to rootless Docker instance for normal users by default.
services.umurmur.settings.default_channel	The channel in which users will appear in when connecting.
system.stateVersion	This option defines the first version of NixOS you have installed on this particular machine, and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions
services.firezone.server.smtp.configureManually	Outbound email configuration is mandatory for Firezone and supports many different delivery adapters
security.pam.services.<name>.googleOsLoginAccountVerification	If set, will use the Google OS Login PAM modules (`pam_oslogin_login`, `pam_oslogin_admin`) to verify possible OS Login users and set sudoers configuration accordingly
services.warpgate.settings.config_provider	Source of truth of users
services.sourcehut.settings."meta.sr.ht::settings".onboarding-redirect	Where to redirect new users upon registration.
services.prometheus.scrapeConfigs..openstack_sd_configs..domain_id	At most one of domain_id and domain_name must be provided if using username with Identity V3
services.bitwarden-directory-connector-cli.sync.overwriteExisting	Remove and re-add users/groups, See https://bitwarden.com/help/user-group-filters/#overwriting-syncs for more details.
services.vaultwarden.environmentFile	Additional environment file or files as defined in systemd.exec(5)
virtualisation.lxc.unprivilegedContainers	Whether to enable support for unprivileged users to launch containers.
services.vaultwarden.config	The configuration of vaultwarden is done through environment variables, therefore it is recommended to use upper snake case (e.g. DISABLE_2FA_REMEMBER)
services.prometheus.scrapeConfigs..openstack_sd_configs..domain_name	At most one of domain_id and domain_name must be provided if using username with Identity V3
services.bacula-sd.autochanger.<name>.changerCommand	The name-string specifies an external program to be called that will automatically change volumes as required by Bacula
services.nextcloud.settings.skeletondirectory	The directory where the skeleton files are located
services.grafana.provision.datasources.settings.datasources.*.editable	Allow users to edit datasources from the UI.
services.matrix-conduit.settings.global.allow_registration	Whether new users can register on this server.
services.matrix-synapse.settings.enable_registration	Enable registration for new users.
services.authelia.instances.<name>.settings.default_2fa_method	Default 2FA method for new users and fallback for preferred but disabled methods.
services.influxdb2.provision.organizations.<name>.auths.<name>.readPermissions	The read permissions to include for this token
services.influxdb2.provision.organizations.<name>.auths.<name>.writePermissions	The read permissions to include for this token