This option defines the first version of NixOS you have installed on this particular machine, and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions

Send notifications about killed processes via the system d-bus

Outbound email configuration is mandatory for Firezone and supports many different delivery adapters

The attribute that contains the users username.

If set, will use the pam_oslogin_login's user authentication methods to authenticate users using 2FA

If set, will use the Google OS Login PAM modules (pam_oslogin_login, pam_oslogin_admin) to verify possible OS Login users and set sudoers configuration accordingly

Source of truth of users

Where to redirect new users upon registration.

Remove and re-add users/groups, See https://bitwarden.com/help/user-group-filters/#overwriting-syncs for more details.

Additional environment file or files as defined in systemd.exec(5)

Whether to enable support for unprivileged users to launch containers.

The configuration of vaultwarden is done through environment variables, therefore it is recommended to use upper snake case (e.g. DISABLE_2FA_REMEMBER)

Whenever to send systembus-notify notifications

A boolean that controls whether site visitors can create new accounts

The name-string specifies an external program to be called that will automatically change volumes as required by Bacula

If not null, is used as the permissions set by system.activationScripts.transmission-daemon on the directories services.transmission.settings.download-dir, services.transmission.settings.incomplete-dir. and services.transmission.settings.watch-dir

The directory where the skeleton files are located

Allow users to edit datasources from the UI.

Whether new users can register on this server.

Enable registration for new users.

Default 2FA method for new users and fallback for preferred but disabled methods.

The read permissions to include for this token

The read permissions to include for this token

Whether the users will be able to use the ad-hoc commands that lets them configure their realname and username.

Do not allow more than this many server connections per user (regardless of database)

Whether to configure zsh as an interactive shell

The group to run Memos as.

The user to run Memos as.

Whether to configure system to use gphoto2

Whenever to configure Bash as an interactive shell

Whether to let openssh print the result when entering a new ssh-session

Whether to run reaction as root

Configuration files to load besides the immutable one defined by the NixOS module

Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on

Specify the rules for which files to read on the host

Whether to enable PdfDing service

Enables the use of the ~/.ssh/authorized_keys file

Whether to enable GVfs, a userspace virtual filesystem.

Whether to enable the userspace daemon for Intel Precise Touch & Stylus.

Whether to enable ulogd, a userspace logging daemon for netfilter/iptables related logging.

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Hardened service:

• runs as a dedicated user with minimal set of permissions (see caveats),
• restricts daemon configuration socket access to dedicated user group (you can grant access to it with users.users."<user>".extraGroups = [ netbird-‹name› ]),

Even though the local system resources access is restricted:

• CAP_NET_RAW, CAP_NET_ADMIN and CAP_BPF still give unlimited network manipulation possibilites,
• older kernels don't have CAP_BPF and use CAP_SYS_ADMIN instead,

Known security features that are not (yet) integrated into the module:

• 2024-02-14: rosenpass is an experimental feature configurable solely through --enable-rosenpass flag on the netbird up command, see the docs

Whether to enable Trusted Platform 2 userspace resource manager daemon .

Whether to enable SCX service, a daemon to run schedulers from userspace.

Whether to enable ucarp, userspace implementation of CARP.

Whether to enable OpenRazer drivers and userspace daemon .

Whether to enable kmscon as the virtual console instead of gettys. kmscon is a kms/dri-based userspace virtual terminal implementation

Whether to enable OP-TEE userspace supplicant.

Whether to enable Bolt, a userspace daemon to enable security levels for Thunderbolt 3 on GNU/Linux

Enable /dev/random, /dev/urandom and /proc/sys/kernel/random/* userspace wrapper.

The interface name for tunnel traffic

Whether to enable ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver

Whether to enable Declare the support for derivations that require an Nvidia GPU to be available, e.g. derivations with requiredSystemFeatures = [ "cuda" ]

Networking-related command-line options that should be passed to qemu

Data Plane Development Kit is a framework for fast packet processing in data plane applications running on a wide variety of CPU architectures

Endpoint IP or hostname of the peer, followed by a colon, and then a port number of the peer