| services.matrix-synapse.workers.<name>.worker_listeners.*.mode | File permissions on the UNIX domain socket.
|
| services.prometheus.exporters.imap-mailstat.configurationFile | File containing the configuration
|
| services.peertube-runner.instancesToRegister.<name>.registrationTokenFile | Path to a file containing a registration token for the PeerTube instance
|
| services.prometheus.alertmanagerGotify.environmentFile | File containing additional config environment variables for alertmanager-gotify-bridge
|
| services.draupnir.secrets.web.synapseHTTPAntispam.authorization | File containing the secret token when using the Synapse HTTP Antispam module
to be used in place of
services.draupnir.settings.web.synapseHTTPAntispam.authorization
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.mastodon.activeRecordEncryptionKeyDerivationSaltFile | This key must be set to enable the Active Record Encryption feature within
Rails that Mastodon uses to encrypt and decrypt some database attributes
|
| services.xserver.displayManager.lightdm.greeters.gtk.indicators | List of allowed indicator modules to use for the lightdm gtk
greeter panel
|
| services.grafana.provision.dashboards.settings.providers.*.options.path | Path grafana will watch for dashboards
|
| services.postgresqlWalReceiver.receivers.<name>.slot | Require pg_receivewal to use an existing replication slot (see
Section 26.2.6 of the PostgreSQL manual)
|
| services.neo4j.directories.certificates | Directory for storing certificates to be used by Neo4j for
TLS connections
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.headscale.settings.noise.private_key_path | Path to noise private key file, generated automatically if it does not exist.
|
| services.prometheus.exporters.junos-czerwonk.configurationFile | Specify the JunOS exporter configuration file to use.
|
| services.prometheus.exporters.mikrotik.configuration | Mikrotik exporter configuration as nix attribute set
|
| services.bacula-sd.autochanger.<name>.changerCommand | The name-string specifies an external program to be called that will
automatically change volumes as required by Bacula
|
| services.prometheus.alertmanager.configuration | Alertmanager configuration as nix attribute set
|
| programs.openvpn3.log-service.settings.log_dbus_details | Add D-Bus details in log file/syslog
|
| services.prometheus.exporters.pgbouncer.connectionEnvFile | File that must contain the environment variable
PGBOUNCER_EXPORTER_CONNECTION_STRING which is set to the connection
string used by pgbouncer
|
| virtualisation.oci-containers.containers.<name>.login.passwordFile | Path to file containing password.
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.handle | Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
respectively
|
| services.headscale.settings.derp.server.private_key_path | Path to derp private key file, generated automatically if it does not exist.
|
| services.prometheus.exporters.ecoflow.ecoflowDevicesPrettyNamesFile | File must contain one line, example: {"R3300000":"Delta 2","R3400000":"Delta Pro",...}
The key/value map of custom names for your devices
|
| services.sshguard.blacklist_threshold | Blacklist an attacker when its score exceeds threshold
|
| services.amazon-cloudwatch-agent.configurationFile | Amazon CloudWatch Agent configuration file
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPasswordFile | Sets the password for WPA-PSK
|
| services.changedetection-io.environmentFile | Securely pass environment variables to changedetection-io
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".live_view.signing_salt | LiveView signing salt
|
| services.bacula-sd.device.<name>.mediaType | The specified name-string names the type of media supported by this
device, for example, DLT7000
|
| services.mastodon.activeRecordEncryptionDeterministicKeyFile | This key must be set to enable the Active Record Encryption feature within
Rails that Mastodon uses to encrypt and decrypt some database attributes
|
| services.gitlab-runner.services.<name>.registrationConfigFile | Absolute path to a file with environment variables
used for gitlab-runner registration with runner registration
tokens
|
| services.headscale.settings.oidc.client_secret_path | Path to OpenID Connect client secret file
|
| services.akkoma.config.":pleroma"."Pleroma.Web.Endpoint".secret_key_base | Secret key used as a base to generate further secrets for encrypting and
signing data
|
| services.gitlab-runner.services.<name>.authenticationTokenConfigFile | Absolute path to a file containing environment variables used for
gitlab-runner registrations with runner authentication tokens
|
| services.nextcloud-spreed-signaling.settings.clients.internalsecretFile | The path to the file containing the value for clients.internalsecret
|
| services.firezone.server.provision.accounts.<name>.auth.<name>.adapter_config.clientSecretFile | A file containing a the client secret for an openid_connect adapter
|
| services.bitwarden-directory-connector-cli.secrets.bitwarden.client_path_id | Path to file that contains Client ID.
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswords | Sets allowed passwords for WPA3-SAE
|
| services.multipath.devices.*.user_friendly_names | If set to "yes", using the bindings file /etc/multipath/bindings
to assign a persistent and unique alias to the multipath, in the
form of mpath
|
| services.hostapd.radios.<name>.networks.<name>.authentication.wpaPassword | Sets the password for WPA-PSK that will be converted to the pre-shared key
|
| services.hostapd.radios.<name>.networks.<name>.authentication.saePasswordsFile | Sets the password for WPA3-SAE
|
| services.bitwarden-directory-connector-cli.secrets.bitwarden.client_path_secret | Path to file that contains Client Secret.
|
| services.nixseparatedebuginfod2.substituters | nix substituter to fetch debuginfo from
|
| services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.auth | Authentication to expect from remote
|
| services.akkoma.config.":web_push_encryption".":vapid_details".private_key | base64-encoded private ECDH key
|
| services.prometheus.scrapeConfigs.*.kubernetes_sd_configs.*.api_server | The API server addresses
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.auth | Authentication to perform locally.
- The default
pubkey uses public key authentication
using a private key associated to a usable certificate.
psk uses pre-shared key authentication.
- The IKEv1 specific
xauth is used for XAuth or Hybrid
authentication,
- while the IKEv2 specific
eap keyword defines EAP
authentication.
- For
xauth, a specific backend name may be appended,
separated by a dash
|
| services.buffyboard.settings.quirks.ignore_unused_terminals | If true, buffyboard won't automatically update the layout of a new terminal and
draw the keyboard, if the terminal is not opened by any process
|
| boot.specialFileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.hadoop.hbase.rootdir | This option will set "hbase.rootdir" in hbase-site.xml and determine
the directory shared by region servers and into which HBase persists
|
| hardware.display.edid.packages | List of packages containing EDID binary files at $out/lib/firmware/edid
|
| hardware.display.edid.linuxhw | Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID
Attribute names will be mapped to EDID filenames <NAME>.bin
|
| boot.zfs.extraPools | Name or GUID of extra ZFS pools that you wish to import during boot
|
| virtualisation.useDefaultFilesystems | If enabled, the boot disk of the virtual machine will be
formatted and mounted with the default filesystems for
testing
|
| services.quake3-server.baseq3 | Path to the baseq3 files (pak*.pk3)
|
| services.redsocks.log | Where to send logs
|
| services.spamassassin.config | The SpamAssassin local.cf config
If you are using this configuration:
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
Then you can Use this sieve filter:
require ["fileinto", "reject", "envelope"];
if header :contains "X-Spam-Flag" "YES" {
fileinto "spam";
}
Or this procmail filter:
:0:
* ^X-Spam-Flag: YES
/var/vpopmail/domains/lastlog.de/js/.maildir/.spam/new
To filter your messages based on the additional mail headers added by spamassassin.
|
| services.foundationdb.extraReadWritePaths | An extra set of filesystem paths that FoundationDB can read to
and write from
|
| services.stalwart.credentials | Credentials envs used to configure Stalwart secrets
|
| services.stalwart-mail.credentials | Credentials envs used to configure Stalwart-Mail secrets
|
| services.netatalk.enable | Whether to enable the Netatalk AFP fileserver.
|
| documentation.man.mandoc.settings.output.includes | A string of relative path used as a template for the output path of
linked header files (usually via the In macro) in HTML output
|
| services.znapzend.logTo | Where to log to (syslog::<facility> or <filepath>).
|
| image.baseName | Basename of the image filename without any extension (e.g. image_1).
|
| services.send.environment | All the available config options and their defaults can be found here: https://github.com/timvisee/send/blob/master/server/config.js,
some descriptions can found here: https://github.com/timvisee/send/blob/master/docs/docker.md#environment-variables
Values under services.send.environment will override the predefined values in the Send service.
- Time/duration should be in seconds
- Filesize values should be in bytes
|
| services.multipath.extraConfigFile | Append an additional file's contents to /etc/multipath.conf
|
| networking.wireless.enableHardening | Whether to apply security hardening measures to wpa_supplicant
|
| boot.zfs.enabled | True if ZFS filesystem support is enabled
|
| hardware.display.outputs.<name>.edid | An EDID filename to be used for configured display, as in edid/<filename>
|
| image.extension | Extension of the image filename (e.g. raw).
|
| programs.udevil.enable | Whether to enable udevil, to mount filesystems without password.
|
| services.authelia.instances.<name>.settings.log.keep_stdout | Whether to also log to stdout when a file_path is defined.
|
| security.pam.mount.enable | Enable PAM mount system to mount filesystems on user login.
|
| services.autofs.enable | Mount filesystems on demand
|
| environment.wvdial.dialerDefaults | Contents of the "Dialer Defaults" section of
/etc/wvdial.conf.
|
| boot.initrd.postMountCommands | Shell commands to be executed immediately after the stage 1
filesystems have been mounted.
|
| services.diod.logdest | Set the destination for logging
|
| services.stash.settings.stash_boxes | Stash-box facilitates automated tagging of scenes and performers based on fingerprints and filenames
|
| services.btrfs.autoScrub.limit | The scrub throughput limit applied on all scrubbed filesystems
|
| services.athens.filterFile | Filename for the include exclude filter.
|
| boot.initrd.checkJournalingFS | Whether to run fsck on journaling filesystems such as ext3.
|
| security.pam.services.<name>.pamMount | Enable PAM mount (pam_mount) system to mount filesystems on user login.
|
| swapDevices.*.encrypted.label | Label of the unlocked encrypted device
|
| virtualisation.xen.store.settings.persistent | Whether to activate the filed base backend.
|
| services.paisa.settings.dbFile | Filename of the Paisa database.
|
| boot.loader.grub.enableCryptodisk | Enable support for encrypted partitions
|
| services.hddfancontrol.settings.<drive-bay-name>.pwmPaths | PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
Can also use command substitution to ensure the correct hwmonX is selected on every boot
|
| services.btrfs.autoScrub.interval | Systemd calendar expression for when to scrub btrfs filesystems
|
| services.postgresqlWalReceiver.receivers.<name>.compress | Enables gzip compression of write-ahead logs, and specifies the compression level
(0 through 9, 0 being no compression and 9 being best compression)
|
| services.bcachefs.autoScrub.interval | Systemd calendar expression for when to scrub bcachefs filesystems
|
| security.pam.mount.additionalSearchPaths | Additional programs to include in the search path of pam_mount
|
| services.kbfs.enable | Whether to mount the Keybase filesystem.
|
| services.suricata.settings.plugins | Plugins -- Experimental -- specify the filename for each plugin shared object.
|
| services.gvfs.enable | Whether to enable GVfs, a userspace virtual filesystem.
|
| services.kbfs.mountPoint | Mountpoint for the Keybase filesystem.
|
| services.locate.pruneFS | Which filesystem types to exclude from indexing
|
| services.kbfs.extraFlags | Additional flags to pass to the Keybase filesystem on launch.
|
| boot.specialFileSystems.<name>.device | The device as passed to mount
|
| virtualisation.diskImage | Path to the disk image containing the root filesystem
|
| services.kubo.autoMigrate | Whether Kubo should try to migrate its filesystem repository automatically.
|