| services.athens.storage.gcp.jsonKey | Base64 encoded GCP service account key
|
| services.xserver.xkb.extraLayouts.<name>.symbolsFile | The path to the xkb symbols file
|
| services.gitea.minioSecretAccessKey | Path to a file containing the Minio secret access key.
|
| services.prometheus.exporters.opnsense.apiKeyFile | File containing the api key.
|
| services.sharkey.environmentFiles | List of paths to files containing environment variables for Sharkey to use at runtime
|
| services.rustus.storage.s3_secret_key_file | File path that contains the S3 secret key.
|
| services.rustus.storage.s3_access_key_file | File path that contains the S3 access key.
|
| services.logind.suspendKeyLongPress | Specifies what to do when the suspend key is long-pressed.
|
| services.openssh.settings.KexAlgorithms | Allowed key exchange algorithms
Uses the lower bound recommended in both
https://stribika.github.io/2015/01/04/secure-secure-shell.html
and
https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
|
| services.cfssl.mutualTlsClientKey | Mutual TLS - client key to call remote instance requiring client certs
|
| services.kmonad.keyboards.<name>.extraGroups | Extra permission groups to attach to the KMonad instance for
this keyboard
|
| services.cfssl.responderKey | Private key for OCSP responder certificate
|
| services.dovecot2.sslServerCert | Path to the server's public key.
|
| services.logind.hibernateKey | Specifies what to do when the hibernate key is pressed.
|
| services.sks.extraDbConfig | Set contents of the files "KDB/DB_CONFIG" and "PTree/DB_CONFIG" within
the ${dataDir} directory
|
| services.kmonad.keyboards.<name>.defcfg.allowCommands | Whether to enable keys to run shell commands.
|
| services.headscale.settings.oidc.pkce.enabled | Enable or disable PKCE (Proof Key for Code Exchange) support
|
| programs.ssh.kexAlgorithms | Specifies the available KEX (Key Exchange) algorithms.
|
| services.galene.insecure | Whether Galene should listen in http or in https
|
| services.prometheus.exporters.keylight.port | Port to listen on.
|
| services.outline.storage.accessKey | S3 access key.
|
| services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.auth | Authentication to perform locally.
- The default
pubkey uses public key authentication
using a private key associated to a usable certificate.
psk uses pre-shared key authentication.- The IKEv1 specific
xauth is used for XAuth or Hybrid
authentication,
- while the IKEv2 specific
eap keyword defines EAP
authentication.
- For
xauth, a specific backend name may be appended,
separated by a dash
|
| services.druid.overlord.config | (key=value) Configuration to be written to runtime.properties of the druid Druid Overlord
https://druid.apache.org/docs/latest/configuration/index.html
|
| services.hercules-ci-agent.settings.labels | A key-value map of user data
|
| services.librespeed.tlsKey | TLS private key to use
|
| services.actkbd.bindings | Key bindings for actkbd
|
| security.pam.ussh.enable | Enables Uber's USSH PAM (pam-ussh) module
|
| boot.initrd.luks.devices.<name>.fido2.gracePeriod | Time in seconds to wait for the FIDO2 key.
|
| services.prometheus.exporters.keylight.user | User name under which the keylight exporter shall be run.
|
| services.froide-govplan.secretKeyFile | Path to a file containing the secret key.
|
| services.athens.storage.s3.secret | Secret key for the S3 storage backend
|
| services.nagios.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.moodle.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.canaille.settings.CANAILLE_OIDC.JWT.PRIVATE_KEY | JWT private key
|
| services.prometheus.exporters.keylight.group | Group under which the keylight exporter shall be run.
|
| security.dhparams.params.<name>.bits | The bit size for the prime that is used during a Diffie-Hellman
key exchange.
|
| services.misskey.meilisearch.createLocally | Create and use a local Meilisearch instance
|
| networking.wireguard.interfaces.<name>.privateKey | Base64 private key generated by wg genkey
|
| services.ncps.cache.storage.s3.accessKeyIdPath | The path to a file containing only the access-key-id.
|
| services.agorakit.appKeyFile | A file containing the Laravel APP_KEY - a 32 character long,
base64 encoded key used for encryption where needed
|
| services.dolibarr.h2o.tls.identity | Key / certificate pairs for the virtual host.
|
| services.tahoe.nodes.<name>.sftpd.hostPublicKeyFile | Path to the SSH host public key.
|
| services.nextcloud.config.objectstore.s3.sseCKeyFile | If provided this is the full path to a file that contains the key
to enable [server-side encryption with customer-provided keys][1]
(SSE-C)
|
| services.parsedmarc.settings | Configuration parameters to set in
parsedmarc.ini
|
| nix.buildMachines.*.publicHostKey | The (base64-encoded) public host key of this builder
|
| services.druid.middleManager.config | (key=value) Configuration to be written to runtime.properties of the druid Druid middleManager
https://druid.apache.org/docs/latest/configuration/index.html
|
| services.kmonad.keyboards.<name>.enableHardening | Whether to enable systemd hardening.
If KMonad is used to execute shell commands, hardening may make some of them fail.
|
| services.prometheus.exporters.keylight.enable | Whether to enable the prometheus keylight exporter.
|
| services.shellhub-agent.privateKey | Location where to store the ShellHub Agent private
key.
|
| services.athens.storage.minio.secret | Secret key for the minio storage backend
|
| services.evdevremapkeys.enable | Whether to enable evdevremapkeys, a daemon to remap events on linux input devices.
|
| services.ncps.cache.storage.s3.forcePathStyle | Force path-style S3 addressing (bucket/key vs key.bucket).
|
| programs.ssh.hostKeyAlgorithms | Specifies the host key algorithms that the client wants to use in order of preference.
|
| services.dovecot2.sieve.scripts | Sieve scripts to be executed
|
| services.outline.storage.secretKeyFile | File path that contains the S3 secret key.
|
| services.strongswan-swanctl.swanctl.connections.<name>.rekey_time | IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
does not re-check associated credentials
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.recommendedUwsgiSettings | Enable recommended uwsgi settings.
|
| services.misskey.reverseProxy.webserver.nginx.locations.<name>.recommendedProxySettings | Enable recommended proxy settings.
|
| services.akkoma.config.":web_push_encryption".":vapid_details".public_key | base64-encoded public ECDH key.
|
| services.oauth2-proxy.signatureKey | GAP-Signature request signature key.
|
| services.peering-manager.secretKeyFile | Path to a file containing the secret key.
|
| services.geoipupdate.settings.LicenseKey | A file containing the MaxMind license key
|
| services.dkimproxy-out.enable | Whether to enable dkimproxy_out
|
| services.postfix.masterConfig.<name>.name | The name of the service to run
|
| services.prometheus.exporters.keylight.extraFlags | Extra commandline options to pass to the keylight exporter.
|
| services.prometheus.scrapeConfigs.*.ec2_sd_configs.*.secret_key | The AWS API key secret
|
| services.prometheus.scrapeConfigs.*.ec2_sd_configs.*.access_key | The AWS API key id
|
| services.prometheus.exporters.exportarr-bazarr.apiKeyFile | File containing the api-key.
|
| services.prometheus.exporters.exportarr-radarr.apiKeyFile | File containing the api-key.
|
| services.prometheus.exporters.exportarr-lidarr.apiKeyFile | File containing the api-key.
|
| services.prometheus.exporters.exportarr-sonarr.apiKeyFile | File containing the api-key.
|
| programs.i3lock.u2fSupport | Whether to enable U2F support in the i3lock program
|
| services.sogo.configReplaces | Replacement-filepath mapping for sogo.conf
|
| services.quicktun.<name>.publicKey | Remote public key in hexadecimal form.
Not needed when services.quicktun..protocol is set to raw.
|
| services.healthchecks.settings.SECRET_KEY_FILE | Path to a file containing the secret key.
|
| services.httpd.virtualHosts.<name>.sslServerKey | Path to server SSL certificate key.
|
| services.bookstack.appKeyFile | A file containing the Laravel APP_KEY - a 32 character long,
base64 encoded key used for encryption where needed
|
| services.tahoe.nodes.<name>.sftpd.hostPrivateKeyFile | Path to the SSH host private key.
|
| security.pam.services.<name>.rssh | If set, the calling user's SSH agent is used to authenticate
against the configured keys
|
| services.geoipupdate.settings | geoipupdate configuration options
|
| services.akkoma.config.":web_push_encryption".":vapid_details".private_key | base64-encoded private ECDH key
|
| services.tailscale.authKeyFile | A file containing the auth key
|
| services.cachix-watch-store.signingKeyFile | Optional file containing a self-managed signing key to sign uploaded store paths.
|
| services.ddclient.passwordFile | A file containing the password or a TSIG key in named format when using the nsupdate protocol.
|
| services.zabbixWeb.httpd.virtualHost.sslServerKey | Path to server SSL certificate key.
|
| services.ncps.upstream.publicKeys | A list of public keys of upstream caches in the format
host[-[0-9]*]:public-key
|
| services.prometheus.exporters.exportarr-readarr.apiKeyFile | File containing the api-key.
|
| services.logind.hibernateKeyLongPress | Specifies what to do when the hibernate key is long-pressed.
|
| services.radicle.privateKeyFile | Absolute file path to an SSH private key,
usually generated by rad auth
|
| services.soju.tlsCertificateKey | Path to server TLS certificate key.
|
| services.syncoid.commands.<name>.sshKey | SSH private key file to use to login to the remote system
|
| services.invidious.hmacKeyFile | A path to a file containing the hmac_key
|
| services.kubernetes.pki.genCfsslCACert | Whether to automatically generate cfssl CA certificate and key,
if they don't exist.
|
| security.pam.services.<name>.u2fAuth | If set, users listed in
$XDG_CONFIG_HOME/Yubico/u2f_keys (or
$HOME/.config/Yubico/u2f_keys if XDG variable is
not set) are able to log in with the associated U2F key
|
| services.ncps.cache.storage.s3.secretAccessKeyPath | The path to a file containing only the secret-access-key.
|
| services.buildkite-agents | Attribute set of buildkite agents
|
| services.duplicity.secretFile | Path of a file containing secrets (gpg passphrase, access key...) in
the format of EnvironmentFile as described by
systemd.exec(5)
|
| services.lavalink.plugins.*.configName | The name of the plugin to use as the key for the plugin configuration.
|
| services.snipe-it.config | Snipe-IT configuration options to set in the
.env file
|
| services.prometheus.exporters.keylight.listenAddress | Address to listen on.
|