All listed users will become part of the firezone-client group so they can control the tunnel service

A list of paths that should be included in the system closure but generally not visible to users

A file containing the secret used to encrypt secrets for OTP tokens

This is the URL that users will enter to load your instance

Enable font hinting

Maximum amount of users which will be allowed to register on this system. 0 - no limit.

This is optional and is by default off, because most users will not need it

A list of users who should be able to integrate 1Password with polkit-based authentication mechanisms.

Don't allow users to connect in non-secure mode (without random padding).

The hosts.hfaxd file entry in the spooling area will be symlinked to the location given here

Outgoing email for notifications generated by users.

Enables U2F PAM (pam-u2f) module

Frontend configuration

Path to a file containing extra ntfy environment variables in the systemd EnvironmentFile format

Whether to generate the password files at build time and store them directly in the system closure, without requiring any services at boot time

Name of the remote read config, which if specified must be unique among remote read configs

Specifies if mapped OpenID Connect accounts are automatically created upon successful authentication

Outgoing email for notifications generated by users.

Whether to enable nonpaying users to submit builds.

The set of packages that appear in /run/current-system/sw

SFTP private key file

Name of the remote write config, which if specified must be unique among remote write configs

Configures the user domain, if enabled

The lmtp daemon will make the unix socket group-read/write for users in this group.

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

The permission for settings.dir

When disabled, unprivileged users will not be able to create new namespaces

This is optional and is by default off, because most users will not need it

When not set to null this option defines the path at which the unbound remote control socket should be created at

Whether to open the default ports in the firewall: TCP/UDP 22000 for transfers and UDP 21027 for discovery

JSON file containing secret keys

Deactivates analytics

FreeType LCD filter

If enabled, spacecookie will hide personal information of users like IP addresses from log output.

If false, a PulseAudio server is launched automatically for each user that tries to use the sound system

Defines whether users see the Register option in the menu of Time Tracker that allows them to self-register and create new organizations (top groups).

List of binary cache URLs that non-root users can use (in addition to those specified using nix.settings.substituters) by passing --option binary-caches to Nix commands.

If you want to prevent node sharing from allowing users to access services across tailnets, declare your expected tailnets domain here.

Whether all users can write to the consumption dir.

List of accepted local users

Allow users to register themselves

The lmtp daemon will make the unix socket group-read/write for users in this group.

Whether to use binary caches for downloading store paths

Authentication type

Converts users profiles and Avatars between old and new formats

Whether new users can register on this server

Whether to enable the dummy "startx" pseudo-display manager, which allows users to start X manually via the startx command from a virtual terminal.

Specify SSH host keys to import into the initrd

The manual pages to generate caches for if documentation.man.generateCaches is enabled

Whether to enable the headless Transmission BitTorrent daemon

File containing a secret used to salt the users' password hashes and generate filenames for static content.

Defines one or more team names that auto-provisioned OIDC users shall be added to

Whenever to send wall notifications to all users.

Push notifications to inform users of new messages or other pertinent information even when they have no XMPP clients online

This option enables docker, a daemon that manages linux containers

Set of default packages that aren't strictly necessary for a running system, entries can be removed for a more minimal NixOS installation

The base URL of the API server

This option enables lxd, a daemon that manages containers

This option will ensure that team memberships for OpenID Connect users are dynamic and synchronized with membership of OpenID Connect groups or assigned roles

Whether to enable KVMGT (iGVT-g) VGPU support

Diffie-Hellman parameters to generate

Maximum number of client connections allowed

Whether to enable registration for new users.

Whether to allow registration of new admin users.

Sets transmission's file mode creation mask

LDAP filter for users.

Set of core packages for a normal interactive system

Identity the EAP/XAuth secret belongs to

Identity the NTLM secret belongs to

This option enables libvirtd, a daemon that manages virtual machines

All actors (users) to provision

An attribute set where the keys name the organisation and the values are a set of lists of users and groups.

Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID

Attribute names will be mapped to EDID filenames <NAME>.bin

If set, all recipients to users at either "localhost" (the literal string) or the canonical host name (from the me control attribute) are remapped to this address

Whether new users can register on this server

Enable if you are syncing more than 2000 users/groups.

The XEP-0423 defines a set of recommended XEPs to implement for a server

Whether to enable the "sx" pseudo-display manager, which allows users to start manually via the "sx" command from a vt shell

Identity the EAP/XAuth secret belongs to

Class that users must have.

Set this option to true to enable HTTP compression, this can improve transfer speed and bandwidth utilization

Whenever to use precomputated tables for ElGamal. i2pd defaults to false to save 64M of memory (and looses some performance)

Font packages to use in OpenGamepadUI

Environment file to be passed to the systemd service

Environment file to be passed to the systemd service

Whether users must authenticate when using the web UI or command-line tool

If set, shows a contact email address when rendering error pages

If set, shows a contact email address when rendering error pages

Paths to the Nix profile

Enables single account mode

Displays a CAPTCHA challenge for users that register externally.

Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured

Makes user-profiles globally available under nextcloud.tld/u/user.name

Make the Podman socket available in place of the Docker socket, so Docker tools can find the Podman socket

Defines one or more team names that auto-provisioned OIDC users shall be added to

Remove users from bitwarden groups if no longer in the ldap group.

If set, users with enabled Google Authenticator (created ~/.google_authenticator) will be required to provide Google Authenticator token to log in.

Point DOCKER_HOST to rootless Docker instance for normal users by default.

The channel in which users will appear in when connecting.

Attribute for a users email.