Extra configuration options to append to /etc/default/surf-display.

Default 2FA method for new users and fallback for preferred but disabled methods.

URL path to latency/jitter test on this server

Environment variables suffixed by "_FILE" to set for the cert's service for your selected dnsProvider

How often we run the ocsinventory-agent service

The root directory for file URLs used with the Cypher LOAD CSV clause

Whether to add a separate nginx server block that permanently redirects (301) all plain HTTP traffic to HTTPS

Daemon process priority for FAHClient. 0 is the default Unix process priority, 19 is the lowest.

Nix daemon process CPU scheduling policy

Whether to enable the AppArmor Mandatory Access Control system

Path of the database plugin directory

Address or CIDR subnets

StrongSwan default: []

Address or CIDR subnets

StrongSwan default: []

Address or CIDR subnets

StrongSwan default: []

Tracing configuration

Size of each cache chunk given in powers of 2. 0 resets the chunk size to its default values (13 (8 KB) for memcache, 18-20 (256 KB to 1 MB) for diskcache)

Whether to reset the Open vSwitch configuration database to a default configuration on every start of the systemd ovsdb.service.

Python environment to run jupyterlab

Customizing will affect the packages available in the jupyterlab server and the default kernel provided

ActivityPub private key

By default pam-u2f module reads the keys from $XDG_CONFIG_HOME/Yubico/u2f_keys (or $HOME/.config/Yubico/u2f_keys if XDG variable is not set)

Default strategy on discharging

Enable debug log messages

File containing the password for the mpd daemon

Whether to enable HTTPS in addition to plain HTTP

Whether the Mattermost config.json is writeable by Mattermost

Duration (roughly in seconds) of the moratorium on swap allocation that is instated if disk space runs out, or the cooldown time after a new swapfile is successfully allocated before swapspace will consider deallocating swap space again

Whether to copy the DSCP (Differentiated Services Field Codepoint) header field to/from the outer IP header in tunnel mode

Netfilter mark and mask for output traffic

Whether to set mark_in on the inbound SA

By default, H2O, without prejudice, will use as many TLS versions & cipher suites as it & the TLS library (OpenSSL) can support

Defines how much detail should be present in MeiliSearch's logs

Additional PHP extensions to use for Nextcloud

Whether to add a separate nginx server block that permanently redirects (301) all plain HTTP traffic to HTTPS

Whether to enable and configure a local PostgreSQL server by creating a user and database for weblate

Path to xen.efi. pkgs.xen is patched to install the xen.efi file on $boot/boot/xen.efi, but an unpatched Xen build may install it somewhere else, such as $out/boot/efi/efi/nixos/xen.efi

If enabled, the Nix store in the VM is made writable by layering an overlay filesystem on top of the host's Nix store

Whether to serve a default robots.txt that denies access to common AI bots by name and all other bots by wildcard.

What is the maximum timeout (in seconds) that will be set for job when using this Runner. 0 (default) simply means don't limit

An attribute set providing additional container settings in addition to the default properties

Default admin username.

Only log messages with the given severity or above.

null will default to info.

IPsec replay window to configure for this CHILD_SA

Pads ESP packets with additional data to have a consistent ESP packet size for improved Traffic Flow Confidentiality

The base directory for ActiveMQ's configuration

Address or CIDR subnets

StrongSwan default: []

Internal GitLab server used for API requests, useful if you want to send that traffic over an internal load balancer

This option allows you to define APs for one or multiple physical radios

The path (inside the VM) to the device containing the EFI System Partition (ESP)

Multiple monitor configuration, just specify a list of XRandR outputs

The addresses of all replicas in the cluster

Whether to add a separate nginx server block that permanently redirects (301) all plain HTTP traffic to HTTPS

Whether to enable using zfsGetType if your zfs get supports a -t argument for filtering by dataset type at all AND lists properties for snapshots by default when recursing, so that there is too much data to process while searching for backup plans

Packages to which no replacements should be applied

Enables custom address sorting configuration for getaddrinfo(3) according to RFC 3484

Set the default logging verbosity level.

Borg command to use for archive creation

The port where the host can be reached

Set the log target and format.

null will default to logger:stderr.

Tracing configuration

Collect and save data from UniFi alarms to influxdb and Loki.

Collect and save data from UniFi events to influxdb and Loki.

List of ports that Synapse should listen on, their purpose and their configuration

Use childless IKE_SA initiation (allow, prefer, force or never)

The shell (/bin/sh) command executed once the proxy starts

Max qps allowed from whitelisted sources. 0 means unlimited

A file containing the superuser password

The default method used to determine the paths state

Whether to add a separate nginx server block that redirects (defaults to 301, configurable with redirectCode) all plain HTTP traffic to HTTPS

When using the SLiRP user networking (default), this option allows to forward ports to/from the host/guest.

Contains the builder command used to populate an image, honoring all options except the -c <path-to-default-configuration> argument

The mandatory base directory for cryptographic objects of this policy

Only listen to incoming requests on specific IP/host

The ASF home directory used to store all data

Path to a file containing the initial password for the admin user

An ISO 3166-1 country code which replaces automatic phone-number detection without a country code

Action to perform after a CHILD_SA gets closed by the peer.

• The default of none does not take any action,
• trap installs a trap policy for the CHILD_SA.
• start tries to re-create the CHILD_SA.

close_action does not provide any guarantee that the CHILD_SA is kept alive

This parameter controls the period of time to test for a 'hands off' condition (i.e. when no force is applied) before a drift (noise) calibration occurs

User name under which the chrony exporter shall be run

The user_friendly_names prefix to use for this device type, instead of the default mpath

IP address on which nebula lighthouse should serve DNS. 'localhost' is a good default to ensure the service does not listen on public interfaces; use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.

The output console devices to pass to the kernel command line via the console parameter, the primary console is the last item of this list

Alloy configuration file/directory path

Default IP for binding vrrpd is the primary IP on interface

Default page layout for the web UI.

The content of this attribute is appended to any address that is missing a host name

Whether to give the container its own private UIDs/GIDs space (user namespacing)

List of extra IPv4 static routes that will be assigned to the interface.

If you want consistency between the two implementations, set the scope of the route manually with networking.interfaces.eth0.ipv4.routes = [{ options.scope = "global"; }] for example.

Whether to enable kernel modesetting when using the NVIDIA proprietary driver

Path used for the database file.

Group under which the chrony exporter shall be run

Netfilter mark applied to packets after the inbound IPsec SA processed them

Machine identifier key

Extra integrations from the Datadog core-integrations repository that should be built and included

Whether to enable brightness control with keyboard keys

Object store configuration

The email of the default Grafana Admin, created on startup.

Enable automatic-timezoned, simple daemon for keeping the system timezone up-to-date based on the current location

Possible values are:

• yes: checksum validation is forced
• no: checksum validation is disabled
• auto: Suricata uses a statistical approach to detect when checksum off-loading is used. (default) Warning: 'checksum-validation' must be set to yes to have checksum tested.

Automatically create or share folders that this device advertises at the default path

Flags passed verbatim to rtl_433 binary