| services.writefreely.host | The public host name to serve.
|
| services.postsrsd.settings.secrets-file | Path to the file containing the secret keys.
Secrets are passed using LoadCredential= on the systemd unit,
so this options is read-only
|
| security.acme.defaults.keyType | Key type to use for private keys
|
| services.plausible.server.baseUrl | Public URL where plausible is available
|
| services.factorio.username | Your factorio.com login credentials
|
| services.factorio.password | Your factorio.com login credentials
|
| security.agnos.generateKeys.keySize | Key size in bits to use when generating new keys.
|
| boot.initrd.network.ssh.ignoreEmptyHostKeys | Allow leaving config.boot.initrd.network.ssh.hostKeys empty,
to deploy ssh host keys out of band.
|
| security.pam.u2f.settings.authfile | By default pam-u2f module reads the keys from
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set)
|
| services.jitsi-videobridge.nat.harvesterAddresses | Addresses of public STUN services to use to automatically find
the public and local addresses of this Jitsi-Videobridge instance
without the need for manual configuration
|
| services.prosody.muc.*.roomDefaultPublic | If set, the MUC rooms will be public by default.
|
| services.tarsnap.archives.<name>.keyfile | Set a specific keyfile for this archive
|
| services.fedimintd.<name>.api_ws.url | Public URL of the API address of the reverse proxy/tls terminator
|
| services.gitDaemon.enable | Enable Git daemon, which allows public hosting of git repositories
without any access controls
|
| services.frp.instances.<name>.role | The frp consists of client and server
|
| services.keyd.keyboards | Configuration for one or more device IDs
|
| services.keycloak.settings | Configuration options corresponding to parameters set in
conf/keycloak.conf
|
| services.keyd.keyboards.<name>.settings | Configuration, except ids section, that is written to /etc/keyd/.conf
|
| services.draupnir.settings.homeserverUrl | Base URL of the Matrix homeserver that provides the Client-Server API.
|
| services.kerberos_server.settings.realms.<name>.acl.*.access | The changes the principal is allowed to make.
The "all" permission does not imply the "get-keys" permission
|
| security.pam.services.<name>.p11Auth | If set, keys listed in
~/.ssh/authorized_keys and
~/.eid/authorized_certificates
can be used to log in with the associated PKCS#11 tokens.
|
| services.draupnir.settings.rawHomeserverUrl | Public base URL of the Matrix homeserver that provides the Client-Server API when using the Draupnir's
Report forwarding feature.
When using Pantalaimon, do not set this to the Pantalaimon URL!
|
| services.teeworlds.register | Whether the server registers as a public server in the global server list
|
| services.prosody.muc.*.roomDefaultPublicJids | If set, the MUC rooms will display the public JIDs by default.
|
| services.suwayomi-server.settings.server.basicAuthEnabled | Whether to enable basic access authentication for Suwayomi-Server
|
| boot.loader.systemd-boot.edk2-uefi-shell.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.netbird.server.dashboard.settings | An attribute set that will be used to substitute variables when building the dashboard
|
| programs.ssh.knownHosts.<name>.certAuthority | This public key is an SSH certificate authority, rather than an
individual host's key.
|
| networking.nat.externalIP | The public IP address to which packets from the local
network are to be rewritten
|
| services.syncthing.configDir | The path where the settings and keys will exist.
|
| services.postsrsd.secretsFile | Secret keys used for signing and verification.
The secret will be generated, if it does not exist at the given path.
|
| services.yggdrasil.settings.PrivateKeyPath | Path to the private key file on the host system
|
| services.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|
| networking.nat.externalIPv6 | The public IPv6 address to which packets from the local
network are to be rewritten
|
| services.kubernetes.easyCerts | Automatically setup x509 certificates and keys for the entire cluster.
|
| programs.rust-motd.order | The order of the sections in programs.rust-motd.settings
|
| programs.captive-browser.interface | your public network interface (wlp3s0, wlan0, eth0, ...)
|
| services.searx.configureUwsgi | Whether to run searx in uWSGI as a "vassal", instead of using its
built-in HTTP server
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.rollPeriod | How frequently to change keys
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.rollPeriod | How frequently to change keys
|
| services.hercules-ci-agent.settings.binaryCachesPath | Path to a JSON file containing binary cache secret keys
|
| services.schleuder.lists | List of list addresses that should be handled by Schleuder
|
| services.murmur.registerPassword | Public server registry password, used authenticate your
server to the registry to prevent impersonation; required for
subsequent registry updates.
|
| services.parsedmarc.settings | Configuration parameters to set in
parsedmarc.ini
|
| services.movim.minifyStaticFiles | Do minification on public static files which reduces the size of
assets — saving data for the server & users as well as offering a
performance improvement
|
| services.ncps.cache.lock.postgresKeyPrefix | Prefix for all PostgreSQL advisory lock keys (only used when
PostgreSQL is configured as lock backend).
|
| services.rosenpass.settings.secret_key | Path to a file containing the secret key of the local Rosenpass peer
|
| boot.loader.systemd-boot.windows.<name>.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.taskserver.pki.auto.bits | The bit size for generated keys.
|
| services.your_spotify.settings.SPOTIFY_PUBLIC | The public client ID of your Spotify application
|
| services.actkbd.enable | Whether to enable the actkbd key mapping daemon
|
| boot.initrd.luks.devices.<name>.preOpenCommands | Commands that should be run right before we try to mount our LUKS device
|
| boot.initrd.network.ssh.authorizedKeys | Authorized keys for the root user on initrd
|
| services.sourcehut.settings."sr.ht".service-key | An absolute file path (which should be outside the Nix-store)
to a key used for encrypting session cookies
|
| services.dependency-track.settings."alpine.oidc.teams.claim" | Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint
|
| services.writefreely.stateDir | The state directory where keys and data are stored.
|
| services.nsd.zones.<name>.dnssecPolicy.ksk.prePublish | How long in advance to publish new keys
|
| services.nsd.zones.<name>.dnssecPolicy.zsk.prePublish | How long in advance to publish new keys
|
| services.mysql.galeraCluster.sstMethod | Method for the initial state transfer (wsrep_sst_method) when a node joins the cluster
|
| services.mastodon.activeRecordEncryptionPrimaryKeyFile | This key must be set to enable the Active Record Encryption feature within
Rails that Mastodon uses to encrypt and decrypt some database attributes
|
| services.cloud-init.enable | Enable the cloud-init service
|
| services.prosody.muc.*.roomDefaultChangeSubject | If set, the rooms will display the public JIDs by default.
|
| security.pam.services.<name>.sshAgentAuth | If set, the calling user's SSH agent is used to authenticate
against the keys in the calling user's
~/.ssh/authorized_keys
|
| services.matrix-appservice-discord.settings | config.yaml configuration as a Nix attribute set
|
| services.snipe-it.config | Snipe-IT configuration options to set in the
.env file
|
| services.sourcehut.settings."meta.sr.ht::billing".stripe-secret-key | An absolute file path (which should be outside the Nix-store)
to a secret key for Stripe
|
| services.libeufin.nexus.settings.nexus-ebics.CLIENT_PRIVATE_KEYS_FILE | Filesystem location where Nexus should store the subscriber private keys.
|
| security.pam.services.<name>.forwardXAuth | Whether X authentication keys should be passed from the
calling user to the target user (e.g. for
su)
|
| services.geoipupdate.settings | geoipupdate configuration options
|
| services.sourcehut.settings."meta.sr.ht::settings".registration | Whether to enable public registration.
|
| networking.nat.forwardPorts.*.loopbackIPs | Public IPs for NAT reflection; for connections to loopbackip:sourcePort from the host itself and from other hosts behind NAT
|
| programs.ssh.knownHosts.<name>.hostNames | A list of host names and/or IP numbers used for accessing
the host's ssh service
|
| services.tor.relay.onionServices.<name>.secretKey | Secret key of the onion service
|
| services.maddy.tls.loader | TLS certificates are obtained by modules called "certificate
loaders"
|
| services.openssh.knownHosts.<name>.certAuthority | This public key is an SSH certificate authority, rather than an
individual host's key.
|
| services.gitlab.secrets.jwsFile | A file containing the secret used to encrypt session
keys
|
| <imports = [ pkgs.ghostunnel.services.default ]>.ghostunnel.keystore | Path to keystore (combined PEM with cert/key, or PKCS12 keystore)
|
| boot.initrd.network.ssh.authorizedKeyFiles | Authorized keys taken from files for the root user on initrd
|
| boot.initrd.luks.mitigateDMAAttacks | Unless enabled, encryption keys can be easily recovered by an attacker with physical
access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port
|
| services.stargazer.routes | Routes that Stargazer should server
|
| services.netbird.clients.<name>.openFirewall | Opens up firewall port for communication between NetBird peers directly over LAN or public IP,
without using (internet-hosted) TURN servers as intermediaries.
|
| services.netbird.tunnels.<name>.openFirewall | Opens up firewall port for communication between NetBird peers directly over LAN or public IP,
without using (internet-hosted) TURN servers as intermediaries.
|
| services.mastodon.vapidPublicKeyFile | Path to file containing the public key used for Web Push
Voluntary Application Server Identification
|
| boot.loader.systemd-boot.memtest86.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.akkoma.config.":web_push_encryption".":vapid_details".public_key | base64-encoded public ECDH key.
|
| services.pleroma.configs | Pleroma public configuration
|
| services.seafile.ccnetSettings.General.SERVICE_URL | Seahub public URL.
|
| services.dendrite.settings.global.private_key | The path to the signing private key file, used to sign
requests and events.
nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
|
| hardware.tuxedo-drivers.enable | Whether to enable The tuxedo-drivers driver enables access to the following on TUXEDO notebooks:
- Driver for Fn-keys
- SysFS control of brightness/color/mode for most TUXEDO keyboards
- Hardware I/O driver for TUXEDO Control Center
For more inforation it is best to check at the source code description: https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers
.
|
| services.engelsystem.settings | Options to be added to config.php, as a nix attribute set
|
| services.beszel.agent.environment | Environment variables for configuring the beszel-agent service
|
| fileSystems.<name>.depends | List of paths that should be mounted before this one
|
| services.veilid.settings.core.network.routing_table.node_id | Base64-encoded public key for the node, used as the node's ID.
|
| services.monica.config | monica configuration options to set in the
.env file
|
| services.dex.environmentFile | Environment file (see systemd.exec(5)
"EnvironmentFile=" section for the syntax) to define variables for dex
|
| services.ecs-agent.extra-environment | The environment the ECS agent should run with
|
| services.schleuder.extraSettingsFile | YAML file to merge into the schleuder config at runtime
|
| services.dependency-track.settings."alpine.data.directory" | Defines the path to the data directory
|
| boot.loader.systemd-boot.netbootxyz.sortKey | systemd-boot orders the menu entries by their sort keys,
so if you want something to appear after all the NixOS entries,
it should start with o or onwards
|
| services.lasuite-meet.livekit.keyFile | LiveKit key file holding one or multiple application secrets
|