···

       
84
       
84
       
 
       
        type = types.bool;

     

       
85
       
85
       
 
       
        default = true;

     

       
86
       
86
       
 
       
        description = ''

     

       
87
       
87
       
-
       
          Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With

     

       
88
       
88
       
-
       
          that option set, <code>glibc</code> supports use of the extension mechanisms for

     

       
87
       
87
       
+
       
          Enable the <literal>edns0</literal> option in <filename>resolv.conf</filename>. With

     

       
88
       
88
       
+
       
          that option set, <literal>glibc</literal> supports use of the extension mechanisms for

     

       
89
       
89
       
 
       
          DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,

     

       
90
       
90
       
 
       
          which does not work without it.

     

       
91
       
91
       
 
       
        '';

     

···

       
113
       
113
       
 
       
        An attribute set that maps aliases (the top level attribute names in

     

       
114
       
114
       
 
       
        this option) to command strings or directly to build outputs. The

     

       
115
       
115
       
 
       
        aliases are added to all users' shells.

     

       
116
       
116
       
-
       
        Aliases mapped to <code>null</code> are ignored.

     

       
116
       
116
       
+
       
        Aliases mapped to <literal>null</literal> are ignored.

     

       
117
       
117
       
 
       
      '';

     

       
118
       
118
       
 
       
      type = with types; attrsOf (nullOr (either str path));

     

       
119
       
119
       
 
       
    };

     

···

       
30
       
30
       
 
       
        Also, these variables are merged into

     

       
31
       
31
       
 
       
        <xref linkend="opt-environment.variables"/> and it is

     

       
32
       
32
       
 
       
        therefore not possible to use PAM style variables such as

     

       
33
       
33
       
-
       
        <code>@{HOME}</code>.

     

       
33
       
33
       
+
       
        <literal>@{HOME}</literal>.

     

       
34
       
34
       
 
       
      '';

     

       
35
       
35
       
 
       
      type = with types; attrsOf (either str (listOf str));

     

       
36
       
36
       
 
       
      apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);

     
···

       
58
       
58
       
 
       
        Also, these variables are merged into

     

       
59
       
59
       
 
       
        <xref linkend="opt-environment.profileRelativeEnvVars"/> and it is

     

       
60
       
60
       
 
       
        therefore not possible to use PAM style variables such as

     

       
61
       
61
       
-
       
        <code>@{HOME}</code>.

     

       
61
       
61
       
+
       
        <literal>@{HOME}</literal>.

     

       
62
       
62
       
 
       
      '';

     

       
63
       
63
       
 
       
    };

     

       
64
       
64
       
 
       


     

···

       
154
       
154
       
 
       
        description = ''

     

       
155
       
155
       
 
       
          Attributes for user's entry in

     

       
156
       
156
       
 
       
          <filename>pam_mount.conf.xml</filename>.

     

       
157
       
157
       
-
       
          Useful attributes might include <code>path</code>,

     

       
158
       
158
       
-
       
          <code>options</code>, <code>fstype</code>, and <code>server</code>.

     

       
157
       
157
       
+
       
          Useful attributes might include <literal>path</literal>,

     

       
158
       
158
       
+
       
          <literal>options</literal>, <literal>fstype</literal>, and <literal>server</literal>.

     

       
159
       
159
       
 
       
          See <link

     

       
160
       
160
       
 
       
          xlink:href="http://pam-mount.sourceforge.net/pam_mount.conf.5.html" />

     

       
161
       
161
       
 
       
          for more information.

     
···

       
172
       
172
       
 
       
          like <literal>pkgs.bashInteractive</literal>. Don’t

     

       
173
       
173
       
 
       
          forget to enable your shell in

     

       
174
       
174
       
 
       
          <literal>programs</literal> if necessary,

     

       
175
       
175
       
-
       
          like <code>programs.zsh.enable = true;</code>.

     

       
175
       
175
       
+
       
          like <literal>programs.zsh.enable = true;</literal>.

     

       
176
       
176
       
 
       
        '';

     

       
177
       
177
       
 
       
      };

     

       
178
       
178
       
 
       


     

···

       
119
       
119
       
 
       
      example = literalExpression "import <nixpkgs> {}";

     

       
120
       
120
       
 
       
      description = ''

     

       
121
       
121
       
 
       
        If set, the pkgs argument to all NixOS modules is the value of

     

       
122
       
122
       
-
       
        this option, extended with <code>nixpkgs.overlays</code>, if

     

       
123
       
123
       
-
       
        that is also set. Either <code>nixpkgs.crossSystem</code> or

     

       
124
       
124
       
-
       
        <code>nixpkgs.localSystem</code> will be used in an assertion

     

       
122
       
122
       
+
       
        this option, extended with <literal>nixpkgs.overlays</literal>, if

     

       
123
       
123
       
+
       
        that is also set. Either <literal>nixpkgs.crossSystem</literal> or

     

       
124
       
124
       
+
       
        <literal>nixpkgs.localSystem</literal> will be used in an assertion

     

       
125
       
125
       
 
       
        to check that the NixOS and Nixpkgs architectures match. Any

     

       
126
       
126
       
-
       
        other options in <code>nixpkgs.*</code>, notably <code>config</code>,

     

       
126
       
126
       
+
       
        other options in <literal>nixpkgs.*</literal>, notably <literal>config</literal>,

     

       
127
       
127
       
 
       
        will be ignored.

     

       
128
       
128
       
 
       


     

       
129
       
129
       
 
       
        If unset, the pkgs argument to all NixOS modules is determined

     
···

       
132
       
132
       
 
       
        The default value imports the Nixpkgs source files

     

       
133
       
133
       
 
       
        relative to the location of this NixOS module, because

     

       
134
       
134
       
 
       
        NixOS and Nixpkgs are distributed together for consistency,

     

       
135
       
135
       
-
       
        so the <code>nixos</code> in the default value is in fact a

     

       
136
       
136
       
-
       
        relative path. The <code>config</code>, <code>overlays</code>,

     

       
137
       
137
       
-
       
        <code>localSystem</code>, and <code>crossSystem</code> come

     

       
135
       
135
       
+
       
        so the <literal>nixos</literal> in the default value is in fact a

     

       
136
       
136
       
+
       
        relative path. The <literal>config</literal>, <literal>overlays</literal>,

     

       
137
       
137
       
+
       
        <literal>localSystem</literal>, and <literal>crossSystem</literal> come

     

       
138
       
138
       
 
       
        from this option's siblings.

     

       
139
       
139
       
 
       


     

       
140
       
140
       
 
       
        This option can be used by applications like NixOps to increase

     

       
141
       
141
       
 
       
        the performance of evaluation, or to create packages that depend

     

       
142
       
142
       
 
       
        on a container that should be built with the exact same evaluation

     

       
143
       
143
       
 
       
        of Nixpkgs, for example. Applications like this should set

     

       
144
       
144
       
-
       
        their default value using <code>lib.mkDefault</code>, so

     

       
144
       
144
       
+
       
        their default value using <literal>lib.mkDefault</literal>, so

     

       
145
       
145
       
 
       
        user-provided configuration can override it without using

     

       
146
       
146
       
-
       
        <code>lib</code>.

     

       
146
       
146
       
+
       
        <literal>lib</literal>.

     

       
147
       
147
       
 
       


     

       
148
       
148
       
 
       
        Note that using a distinct version of Nixpkgs with NixOS may

     

       
149
       
149
       
 
       
        be an unexpected source of problems. Use this option with care.

     
···

       
162
       
162
       
 
       
        details, see the Nixpkgs documentation.)  It allows you to set

     

       
163
       
163
       
 
       
        package configuration options.

     

       
164
       
164
       
 
       


     

       
165
       
165
       
-
       
        Ignored when <code>nixpkgs.pkgs</code> is set.

     

       
165
       
165
       
+
       
        Ignored when <literal>nixpkgs.pkgs</literal> is set.

     

       
166
       
166
       
 
       
      '';

     

       
167
       
167
       
 
       
    };

     

       
168
       
168
       
 
       


     
···

       
188
       
188
       
 
       
        The first argument should be used for finding dependencies, and

     

       
189
       
189
       
 
       
        the second should be used for overriding recipes.

     

       
190
       
190
       
 
       


     

       
191
       
191
       
-
       
        If <code>nixpkgs.pkgs</code> is set, overlays specified here

     

       
191
       
191
       
+
       
        If <literal>nixpkgs.pkgs</literal> is set, overlays specified here

     

       
192
       
192
       
 
       
        will be applied after the overlays that were already present

     

       
193
       
193
       
-
       
        in <code>nixpkgs.pkgs</code>.

     

       
193
       
193
       
+
       
        in <literal>nixpkgs.pkgs</literal>.

     

       
194
       
194
       
 
       
      '';

     

       
195
       
195
       
 
       
    };

     

       
196
       
196
       
 
       


     
···

       
205
       
205
       
 
       
      description = ''

     

       
206
       
206
       
 
       
        Specifies the platform where the NixOS configuration will run.

     

       
207
       
207
       
 
       


     

       
208
       
208
       
-
       
        To cross-compile, set also <code>nixpkgs.buildPlatform</code>.

     

       
208
       
208
       
+
       
        To cross-compile, set also <literal>nixpkgs.buildPlatform</literal>.

     

       
209
       
209
       
 
       


     

       
210
       
210
       
-
       
        Ignored when <code>nixpkgs.pkgs</code> is set.

     

       
210
       
210
       
+
       
        Ignored when <literal>nixpkgs.pkgs</literal> is set.

     

       
211
       
211
       
 
       
      '';

     

       
212
       
212
       
 
       
    };

     

       
213
       
213
       
 
       


     
···

       
230
       
230
       
 
       
        or if you're building machines, you can set this to match your

     

       
231
       
231
       
 
       
        development system and/or build farm.

     

       
232
       
232
       
 
       


     

       
233
       
233
       
-
       
        Ignored when <code>nixpkgs.pkgs</code> is set.

     

       
233
       
233
       
+
       
        Ignored when <literal>nixpkgs.pkgs</literal> is set.

     

       
234
       
234
       
 
       
      '';

     

       
235
       
235
       
 
       
    };

     

       
236
       
236
       
 
       


     
···

       
253
       
253
       
 
       
        use the old options.

     

       
254
       
254
       
 
       


     

       
255
       
255
       
 
       
        Specifies the platform on which NixOS should be built. When

     

       
256
       
256
       
-
       
        <code>nixpkgs.crossSystem</code> is unset, it also specifies

     

       
256
       
256
       
+
       
        <literal>nixpkgs.crossSystem</literal> is unset, it also specifies

     

       
257
       
257
       
 
       
        the platform <emphasis>for</emphasis> which NixOS should be

     

       
258
       
258
       
 
       
        built.  If this option is unset, it defaults to the platform

     

       
259
       
259
       
 
       
        type of the machine where evaluation happens. Specifying this

     
···

       
261
       
261
       
 
       
        deployment, or when building virtual machines. See its

     

       
262
       
262
       
 
       
        description in the Nixpkgs manual for more details.

     

       
263
       
263
       
 
       


     

       
264
       
264
       
-
       
        Ignored when <code>nixpkgs.pkgs</code> or <code>hostPlatform</code> is set.

     

       
264
       
264
       
+
       
        Ignored when <literal>nixpkgs.pkgs</literal> or <literal>hostPlatform</literal> is set.

     

       
265
       
265
       
 
       
      '';

     

       
266
       
266
       
 
       
    };

     

       
267
       
267
       
 
       


     
···

       
279
       
279
       
 
       


     

       
280
       
280
       
 
       
        Specifies the platform for which NixOS should be

     

       
281
       
281
       
 
       
        built. Specify this only if it is different from

     

       
282
       
282
       
-
       
        <code>nixpkgs.localSystem</code>, the platform

     

       
282
       
282
       
+
       
        <literal>nixpkgs.localSystem</literal>, the platform

     

       
283
       
283
       
 
       
        <emphasis>on</emphasis> which NixOS should be built. In other

     

       
284
       
284
       
 
       
        words, specify this to cross-compile NixOS. Otherwise it

     

       
285
       
285
       
 
       
        should be set as null, the default. See its description in the

     

       
286
       
286
       
 
       
        Nixpkgs manual for more details.

     

       
287
       
287
       
 
       


     

       
288
       
288
       
-
       
        Ignored when <code>nixpkgs.pkgs</code> or <code>hostPlatform</code> is set.

     

       
288
       
288
       
+
       
        Ignored when <literal>nixpkgs.pkgs</literal> or <literal>hostPlatform</literal> is set.

     

       
289
       
289
       
 
       
      '';

     

       
290
       
290
       
 
       
    };

     

       
291
       
291
       
 
       


     
···

       
316
       
316
       
 
       
        with a recently generated <literal>hardware-configuration.nix</literal>.

     

       
317
       
317
       
 
       


     

       
318
       
318
       
 
       
        Specifies the Nix platform type on which NixOS should be built.

     

       
319
       
319
       
-
       
        It is better to specify <code>nixpkgs.localSystem</code> instead.

     

       
319
       
319
       
+
       
        It is better to specify <literal>nixpkgs.localSystem</literal> instead.

     

       
320
       
320
       
 
       
        <programlisting>

     

       
321
       
321
       
 
       
        {

     

       
322
       
322
       
 
       
          nixpkgs.system = ..;

     
···

       
328
       
328
       
 
       
          nixpkgs.localSystem.system = ..;

     

       
329
       
329
       
 
       
        }

     

       
330
       
330
       
 
       
        </programlisting>

     

       
331
       
331
       
-
       
        See <code>nixpkgs.localSystem</code> for more information.

     

       
331
       
331
       
+
       
        See <literal>nixpkgs.localSystem</literal> for more information.

     

       
332
       
332
       
 
       


     

       
333
       
333
       
-
       
        Ignored when <code>nixpkgs.pkgs</code>, <code>nixpkgs.localSystem</code> or <code>nixpkgs.hostPlatform</code> is set.

     

       
333
       
333
       
+
       
        Ignored when <literal>nixpkgs.pkgs</literal>, <literal>nixpkgs.localSystem</literal> or <literal>nixpkgs.hostPlatform</literal> is set.

     

       
334
       
334
       
 
       
      '';

     

       
335
       
335
       
 
       
    };

     

       
336
       
336
       
 
       
  };

     

···

       
14
       
14
       
 
       
        description = ''

     

       
15
       
15
       
 
       
          Whether to configure system to use Android Debug Bridge (adb).

     

       
16
       
16
       
 
       
          To grant access to a user, it must be part of adbusers group:

     

       
17
       
17
       
-
       
          <code>users.users.alice.extraGroups = ["adbusers"];</code>

     

       
17
       
17
       
+
       
          <literal>users.users.alice.extraGroups = ["adbusers"];</literal>

     

       
18
       
18
       
 
       
        '';

     

       
19
       
19
       
 
       
      };

     

       
20
       
20
       
 
       
    };

     

···

       
74
       
74
       
 
       


     

       
75
       
75
       
 
       
        You will get file collisions if you put the actual application binary in

     

       
76
       
76
       
 
       
        the global environment (such as by adding the application package to

     

       
77
       
77
       
-
       
        <code>environment.systemPackages</code>), and applications started via

     

       
77
       
77
       
+
       
        <literal>environment.systemPackages</literal>), and applications started via

     

       
78
       
78
       
 
       
        .desktop files are not wrapped if they specify the absolute path to the

     

       
79
       
79
       
 
       
        binary.

     

       
80
       
80
       
 
       
      '';

     

···

       
15
       
15
       
 
       
          Whether to configure system to use gphoto2.

     

       
16
       
16
       
 
       
          To grant digital camera access to a user, the user must

     

       
17
       
17
       
 
       
          be part of the camera group:

     

       
18
       
18
       
-
       
          <code>users.users.alice.extraGroups = ["camera"];</code>

     

       
18
       
18
       
+
       
          <literal>users.users.alice.extraGroups = ["camera"];</literal>

     

       
19
       
19
       
 
       
        '';

     

       
20
       
20
       
 
       
      };

     

       
21
       
21
       
 
       
    };

     

···

       
8
       
8
       
 
       
      Note that it will open the TCP and UDP port from

     

       
9
       
9
       
 
       
      1714 to 1764 as they are needed for it to function properly.

     

       
10
       
10
       
 
       
      You can use the <option>package</option> to use

     

       
11
       
11
       
-
       
      <code>gnomeExtensions.gsconnect</code> as an alternative

     

       
11
       
11
       
+
       
      <literal>gnomeExtensions.gsconnect</literal> as an alternative

     

       
12
       
12
       
 
       
      implementation if you use Gnome.

     

       
13
       
13
       
 
       
    '';

     

       
14
       
14
       
 
       
    package = mkOption {

     

···

       
95
       
95
       
 
       
        default = "";

     

       
96
       
96
       
 
       
        description = ''

     

       
97
       
97
       
 
       
          Extra configuration text prepended to <filename>ssh_config</filename>. Other generated

     

       
98
       
98
       
-
       
          options will be added after a <code>Host *</code> pattern.

     

       
98
       
98
       
+
       
          options will be added after a <literal>Host *</literal> pattern.

     

       
99
       
99
       
 
       
          See <citerefentry><refentrytitle>ssh_config</refentrytitle><manvolnum>5</manvolnum></citerefentry>

     

       
100
       
100
       
 
       
          for help.

     

       
101
       
101
       
 
       
        '';

     

···

       
22
       
22
       
 
       
          This will enable <option>hardware.opengl.enable</option> so that OpenGL

     

       
23
       
23
       
 
       
          programs can find Mesa's llvmpipe drivers.

     

       
24
       
24
       
 
       


     

       
25
       
25
       
-
       
          Setting this option to <code>false</code> does not mean that software

     

       
25
       
25
       
+
       
          Setting this option to <literal>false</literal> does not mean that software

     

       
26
       
26
       
 
       
          OpenGL won't work; it may still work depending on your system

     

       
27
       
27
       
 
       
          configuration.

     

       
28
       
28
       
 
       


     

···

       
505
       
505
       
 
       
        type = types.listOf types.str;

     

       
506
       
506
       
 
       
        inherit (defaultAndText "reloadServices" []) default defaultText;

     

       
507
       
507
       
 
       
        description = ''

     

       
508
       
508
       
-
       
          The list of systemd services to call <code>systemctl try-reload-or-restart</code>

     

       
508
       
508
       
+
       
          The list of systemd services to call <literal>systemctl try-reload-or-restart</literal>

     

       
509
       
509
       
 
       
          on.

     

       
510
       
510
       
 
       
        '';

     

       
511
       
511
       
 
       
      };

     

···

       
63
       
63
       
 
       
      type = with types; bool;

     

       
64
       
64
       
 
       
      default = true;

     

       
65
       
65
       
 
       
      description = ''

     

       
66
       
66
       
-
       
        Whether users of the <code>wheel</code> group must provide a password to

     

       
66
       
66
       
+
       
        Whether users of the <literal>wheel</literal> group must provide a password to

     

       
67
       
67
       
 
       
        run commands as super user via <command>doas</command>.

     

       
68
       
68
       
 
       
      '';

     

       
69
       
69
       
 
       
    };

     
···

       
74
       
74
       
 
       
        Define specific rules to be set in the

     

       
75
       
75
       
 
       
        <filename>/etc/doas.conf</filename> file. More specific rules should

     

       
76
       
76
       
 
       
        come after more general ones in order to yield the expected behavior.

     

       
77
       
77
       
-
       
        You can use <code>mkBefore</code> and/or <code>mkAfter</code> to ensure

     

       
77
       
77
       
+
       
        You can use <literal>mkBefore</literal> and/or <literal>mkAfter</literal> to ensure

     

       
78
       
78
       
 
       
        this is the case when configuration options are merged.

     

       
79
       
79
       
 
       
      '';

     

       
80
       
80
       
 
       
      example = literalExpression ''

     
···

       
114
       
114
       
 
       
              type = with types; bool;

     

       
115
       
115
       
 
       
              default = false;

     

       
116
       
116
       
 
       
              description = ''

     

       
117
       
117
       
-
       
                If <code>true</code>, the user is not required to enter a

     

       
117
       
117
       
+
       
                If <literal>true</literal>, the user is not required to enter a

     

       
118
       
118
       
 
       
                password.

     

       
119
       
119
       
 
       
              '';

     

       
120
       
120
       
 
       
            };

     
···

       
123
       
123
       
 
       
              type = with types; bool;

     

       
124
       
124
       
 
       
              default = false;

     

       
125
       
125
       
 
       
              description = ''

     

       
126
       
126
       
-
       
                If <code>true</code>, successful executions will not be logged

     

       
126
       
126
       
+
       
                If <literal>true</literal>, successful executions will not be logged

     

       
127
       
127
       
 
       
                to

     

       
128
       
128
       
 
       
                <citerefentry><refentrytitle>syslogd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.

     

       
129
       
129
       
 
       
              '';

     
···

       
133
       
133
       
 
       
              type = with types; bool;

     

       
134
       
134
       
 
       
              default = false;

     

       
135
       
135
       
 
       
              description = ''

     

       
136
       
136
       
-
       
                If <code>true</code>, do not ask for a password again for some

     

       
136
       
136
       
+
       
                If <literal>true</literal>, do not ask for a password again for some

     

       
137
       
137
       
 
       
                time after the user successfully authenticates.

     

       
138
       
138
       
 
       
              '';

     

       
139
       
139
       
 
       
            };

     
···

       
142
       
142
       
 
       
              type = with types; bool;

     

       
143
       
143
       
 
       
              default = false;

     

       
144
       
144
       
 
       
              description = ''

     

       
145
       
145
       
-
       
                If <code>true</code>, environment variables other than those

     

       
145
       
145
       
+
       
                If <literal>true</literal>, environment variables other than those

     

       
146
       
146
       
 
       
                listed in

     

       
147
       
147
       
 
       
                <citerefentry><refentrytitle>doas</refentrytitle><manvolnum>1</manvolnum></citerefentry>

     

       
148
       
148
       
 
       
                are kept when creating the environment for the new process.

     
···

       
155
       
155
       
 
       
              description = ''

     

       
156
       
156
       
 
       
                Keep or set the specified variables. Variables may also be

     

       
157
       
157
       
 
       
                removed with a leading '-' or set using

     

       
158
       
158
       
-
       
                <code>variable=value</code>. If the first character of

     

       
159
       
159
       
-
       
                <code>value</code> is a '$', the value to be set is taken from

     

       
158
       
158
       
+
       
                <literal>variable=value</literal>. If the first character of

     

       
159
       
159
       
+
       
                <literal>value</literal> is a '$', the value to be set is taken from

     

       
160
       
160
       
 
       
                the existing environment variable of the indicated name. This

     

       
161
       
161
       
 
       
                option is processed after the default environment has been

     

       
162
       
162
       
 
       
                created.

     

       
163
       
163
       
 
       


     

       
164
       
164
       
-
       
                NOTE: All rules have <code>setenv { SSH_AUTH_SOCK }</code> by

     

       
165
       
165
       
-
       
                default. To prevent <code>SSH_AUTH_SOCK</code> from being

     

       
166
       
166
       
-
       
                inherited, add <code>"-SSH_AUTH_SOCK"</code> anywhere in this

     

       
164
       
164
       
+
       
                NOTE: All rules have <literal>setenv { SSH_AUTH_SOCK }</literal> by

     

       
165
       
165
       
+
       
                default. To prevent <literal>SSH_AUTH_SOCK</literal> from being

     

       
166
       
166
       
+
       
                inherited, add <literal>"-SSH_AUTH_SOCK"</literal> anywhere in this

     

       
167
       
167
       
 
       
                list.

     

       
168
       
168
       
 
       
              '';

     

       
169
       
169
       
 
       
            };

     
···

       
185
       
185
       
 
       
              default = null;

     

       
186
       
186
       
 
       
              description = ''

     

       
187
       
187
       
 
       
                Which user or group the specified command is allowed to run as.

     

       
188
       
188
       
-
       
                When set to <code>null</code> (the default), all users are

     

       
188
       
188
       
+
       
                When set to <literal>null</literal> (the default), all users are

     

       
189
       
189
       
 
       
                allowed.

     

       
190
       
190
       
 
       


     

       
191
       
191
       
 
       
                A user can be specified using just the username:

     

       
192
       
192
       
-
       
                <code>"foo"</code>. It is also possible to only allow running as

     

       
193
       
193
       
-
       
                a specific group with <code>":bar"</code>.

     

       
192
       
192
       
+
       
                <literal>"foo"</literal>. It is also possible to only allow running as

     

       
193
       
193
       
+
       
                a specific group with <literal>":bar"</literal>.

     

       
194
       
194
       
 
       
              '';

     

       
195
       
195
       
 
       
            };

     

       
196
       
196
       
 
       


     
···

       
199
       
199
       
 
       
              default = null;

     

       
200
       
200
       
 
       
              description = ''

     

       
201
       
201
       
 
       
                The command the user is allowed to run. When set to

     

       
202
       
202
       
-
       
                <code>null</code> (the default), all commands are allowed.

     

       
202
       
202
       
+
       
                <literal>null</literal> (the default), all commands are allowed.

     

       
203
       
203
       
 
       


     

       
204
       
204
       
 
       
                NOTE: It is best practice to specify absolute paths. If a

     

       
205
       
205
       
 
       
                relative path is specified, only a restricted PATH will be

     
···

       
212
       
212
       
 
       
              default = null;

     

       
213
       
213
       
 
       
              description = ''

     

       
214
       
214
       
 
       
                Arguments that must be provided to the command. When set to

     

       
215
       
215
       
-
       
                <code>[]</code>, the command must be run without any arguments.

     

       
215
       
215
       
+
       
                <literal>[]</literal>, the command must be run without any arguments.

     

       
216
       
216
       
 
       
              '';

     

       
217
       
217
       
 
       
            };

     

       
218
       
218
       
 
       
          };

     

···

       
56
       
56
       
 
       
      default = true;

     

       
57
       
57
       
 
       
      description =

     

       
58
       
58
       
 
       
        ''

     

       
59
       
59
       
-
       
          Whether users of the <code>wheel</code> group must

     

       
59
       
59
       
+
       
          Whether users of the <literal>wheel</literal> group must

     

       
60
       
60
       
 
       
          provide a password to run commands as super user via <command>sudo</command>.

     

       
61
       
61
       
 
       
        '';

     

       
62
       
62
       
 
       
      };

     
···

       
65
       
65
       
 
       
      type = types.bool;

     

       
66
       
66
       
 
       
      default = false;

     

       
67
       
67
       
 
       
      description = ''

     

       
68
       
68
       
-
       
        Only allow members of the <code>wheel</code> group to execute sudo by

     

       
68
       
68
       
+
       
        Only allow members of the <literal>wheel</literal> group to execute sudo by

     

       
69
       
69
       
 
       
        setting the executable's permissions accordingly.

     

       
70
       
70
       
-
       
        This prevents users that are not members of <code>wheel</code> from

     

       
70
       
70
       
+
       
        This prevents users that are not members of <literal>wheel</literal> from

     

       
71
       
71
       
 
       
        exploiting vulnerabilities in sudo such as CVE-2021-3156.

     

       
72
       
72
       
 
       
      '';

     

       
73
       
73
       
 
       
    };

     
···

       
142
       
142
       
 
       
            description = ''

     

       
143
       
143
       
 
       
              Under which user/group the specified command is allowed to run.

     

       
144
       
144
       
 
       


     

       
145
       
145
       
-
       
              A user can be specified using just the username: <code>"foo"</code>.

     

       
146
       
146
       
-
       
              It is also possible to specify a user/group combination using <code>"foo:bar"</code>

     

       
147
       
147
       
-
       
              or to only allow running as a specific group with <code>":bar"</code>.

     

       
145
       
145
       
+
       
              A user can be specified using just the username: <literal>"foo"</literal>.

     

       
146
       
146
       
+
       
              It is also possible to specify a user/group combination using <literal>"foo:bar"</literal>

     

       
147
       
147
       
+
       
              or to only allow running as a specific group with <literal>":bar"</literal>.

     

       
148
       
148
       
 
       
            '';

     

       
149
       
149
       
 
       
          };

     

       
150
       
150
       
 
       


     
···

       
159
       
159
       
 
       
                  type = with types; str;

     

       
160
       
160
       
 
       
                  description = ''

     

       
161
       
161
       
 
       
                    A command being either just a path to a binary to allow any arguments,

     

       
162
       
162
       
-
       
                    the full command with arguments pre-set or with <code>""</code> used as the argument,

     

       
162
       
162
       
+
       
                    the full command with arguments pre-set or with <literal>""</literal> used as the argument,

     

       
163
       
163
       
 
       
                    not allowing arguments to the command at all.

     

       
164
       
164
       
 
       
                  '';

     

       
165
       
165
       
 
       
                };

     

···

       
48
       
48
       
 
       
        type = types.package;

     

       
49
       
49
       
 
       
        example = literalExpression "pkgs.firebird_3";

     

       
50
       
50
       
 
       
        description = ''

     

       
51
       
51
       
-
       
          Which Firebird package to be installed: <code>pkgs.firebird_3</code>

     

       
52
       
52
       
-
       
          For SuperServer use override: <code>pkgs.firebird_3.override { superServer = true; };</code>

     

       
51
       
51
       
+
       
          Which Firebird package to be installed: <literal>pkgs.firebird_3</literal>

     

       
52
       
52
       
+
       
          For SuperServer use override: <literal>pkgs.firebird_3.override { superServer = true; };</literal>

     

       
53
       
53
       
 
       
        '';

     

       
54
       
54
       
 
       
      };

     

       
55
       
55
       
 
       


     

···

       
211
       
211
       
 
       
                For more information on how to specify the target

     

       
212
       
212
       
 
       
                and on which privileges exist, see the

     

       
213
       
213
       
 
       
                <link xlink:href="https://mariadb.com/kb/en/library/grant/">GRANT syntax</link>.

     

       
214
       
214
       
-
       
                The attributes are used as <code>GRANT ''${attrName} ON ''${attrValue}</code>.

     

       
214
       
214
       
+
       
                The attributes are used as <literal>GRANT ''${attrName} ON ''${attrValue}</literal>.

     

       
215
       
215
       
 
       
              '';

     

       
216
       
216
       
 
       
              example = literalExpression ''

     

       
217
       
217
       
 
       
                {

     

···

       
159
       
159
       
 
       
                For more information on how to specify the target

     

       
160
       
160
       
 
       
                and on which privileges exist, see the

     

       
161
       
161
       
 
       
                <link xlink:href="https://www.postgresql.org/docs/current/sql-grant.html">GRANT syntax</link>.

     

       
162
       
162
       
-
       
                The attributes are used as <code>GRANT ''${attrValue} ON ''${attrName}</code>.

     

       
162
       
162
       
+
       
                The attributes are used as <literal>GRANT ''${attrValue} ON ''${attrName}</literal>.

     

       
163
       
163
       
 
       
              '';

     

       
164
       
164
       
 
       
              example = literalExpression ''

     

       
165
       
165
       
 
       
                {

     

···

       
39
       
39
       
 
       
        type = types.nullOr types.str;

     

       
40
       
40
       
 
       
        default = null;

     

       
41
       
41
       
 
       
        description = ''

     

       
42
       
42
       
-
       
          Path to the <code>remotes</code> control file. This file contains a

     

       
42
       
42
       
+
       
          Path to the <literal>remotes</literal> control file. This file contains a

     

       
43
       
43
       
 
       
          list of remote servers to which to send each message.

     

       
44
       
44
       
 
       


     

       
45
       
45
       
-
       
          See <code>man 8 nullmailer-send</code> for syntax and available

     

       
45
       
45
       
+
       
          See <literal>man 8 nullmailer-send</literal> for syntax and available

     

       
46
       
46
       
 
       
          options.

     

       
47
       
47
       
 
       
        '';

     

       
48
       
48
       
 
       
      };

     
···

       
158
       
158
       
 
       
            contains a remote host name or address followed by an optional

     

       
159
       
159
       
 
       
            protocol string, separated by white space.

     

       
160
       
160
       
 
       


     

       
161
       
161
       
-
       
            See <code>man 8 nullmailer-send</code> for syntax and available

     

       
161
       
161
       
+
       
            See <literal>man 8 nullmailer-send</literal> for syntax and available

     

       
162
       
162
       
 
       
            options.

     

       
163
       
163
       
 
       


     

       
164
       
164
       
 
       
            WARNING: This is stored world-readable in the nix store. If you need

     

       
165
       
165
       
 
       
            to specify any secret credentials here, consider using the

     

       
166
       
166
       
-
       
            <code>remotesFile</code> option instead.

     

       
166
       
166
       
+
       
            <literal>remotesFile</literal> option instead.

     

       
167
       
167
       
 
       
          '';

     

       
168
       
168
       
 
       
        };

     

       
169
       
169
       
 
       


     

···

       
26
       
26
       
 
       
      description = ''

     

       
27
       
27
       
 
       
        Listening port.

     

       
28
       
28
       
 
       
        Beware that public-inbox uses well-known ports number to decide whether to enable TLS or not.

     

       
29
       
29
       
-
       
        Set to null and use <code>systemd.sockets.public-inbox-${proto}d.listenStreams</code>

     

       
29
       
29
       
+
       
        Set to null and use <literal>systemd.sockets.public-inbox-${proto}d.listenStreams</literal>

     

       
30
       
30
       
 
       
        if you need a more advanced listening.

     

       
31
       
31
       
 
       
      '';

     

       
32
       
32
       
 
       
    };

     
···

       
242
       
242
       
 
       
        description = ''

     

       
243
       
243
       
 
       
          Listening port or systemd's ListenStream= entry

     

       
244
       
244
       
 
       
          to be used as a reverse proxy, eg. in nginx:

     

       
245
       
245
       
-
       
          <code>locations."/inbox".proxyPass = "http://unix:''${config.services.public-inbox.http.port}:/inbox";</code>

     

       
246
       
246
       
-
       
          Set to null and use <code>systemd.sockets.public-inbox-httpd.listenStreams</code>

     

       
245
       
245
       
+
       
          <literal>locations."/inbox".proxyPass = "http://unix:''${config.services.public-inbox.http.port}:/inbox";</literal>

     

       
246
       
246
       
+
       
          Set to null and use <literal>systemd.sockets.public-inbox-httpd.listenStreams</literal>

     

       
247
       
247
       
 
       
          if you need a more advanced listening.

     

       
248
       
248
       
 
       
        '';

     

       
249
       
249
       
 
       
      };

     

···

       
29
       
29
       
 
       
        type = types.attrsOf types.str;

     

       
30
       
30
       
 
       
        description = ''

     

       
31
       
31
       
 
       
          Output name to EDID mapping.

     

       
32
       
32
       
-
       
          Use <code>autorandr --fingerprint</code> to get current setup values.

     

       
32
       
32
       
+
       
          Use <literal>autorandr --fingerprint</literal> to get current setup values.

     

       
33
       
33
       
 
       
        '';

     

       
34
       
34
       
 
       
        default = { };

     

       
35
       
35
       
 
       
      };

     

···

       
180
       
180
       
 
       
          network-key = mkOption {

     

       
181
       
181
       
 
       
            description = ''

     

       
182
       
182
       
 
       
              An absolute file path (which should be outside the Nix-store)

     

       
183
       
183
       
-
       
              to a secret key to encrypt internal messages with. Use <code>srht-keygen network</code> to

     

       
183
       
183
       
+
       
              to a secret key to encrypt internal messages with. Use <literal>srht-keygen network</literal> to

     

       
184
       
184
       
 
       
              generate this key. It must be consistent between all services and nodes.

     

       
185
       
185
       
 
       
            '';

     

       
186
       
186
       
 
       
            type = types.path;

     
···

       
209
       
209
       
 
       
          service-key = mkOption {

     

       
210
       
210
       
 
       
            description = ''

     

       
211
       
211
       
 
       
              An absolute file path (which should be outside the Nix-store)

     

       
212
       
212
       
-
       
              to a key used for encrypting session cookies. Use <code>srht-keygen service</code> to

     

       
212
       
212
       
+
       
              to a key used for encrypting session cookies. Use <literal>srht-keygen service</literal> to

     

       
213
       
213
       
 
       
              generate the service key. This must be shared between each node of the same

     

       
214
       
214
       
 
       
              service (e.g. git1.sr.ht and git2.sr.ht), but different services may use

     

       
215
       
215
       
 
       
              different keys. If you configure all of your services with the same

     
···

       
252
       
252
       
 
       


     

       
253
       
253
       
 
       
              Your PGP key information (DO NOT mix up pub and priv here)

     

       
254
       
254
       
 
       
              You must remove the password from your secret key, if present.

     

       
255
       
255
       
-
       
              You can do this with <code>gpg --edit-key [key-id]</code>,

     

       
256
       
256
       
-
       
              then use the <code>passwd</code> command and do not enter a new password.

     

       
255
       
255
       
+
       
              You can do this with <literal>gpg --edit-key [key-id]</literal>,

     

       
256
       
256
       
+
       
              then use the <literal>passwd</literal> command and do not enter a new password.

     

       
257
       
257
       
 
       
            '';

     

       
258
       
258
       
 
       
          };

     

       
259
       
259
       
 
       
          pgp-pubkey = mkOption {

     
···

       
294
       
294
       
 
       
              This should be consistent for all *.sr.ht sites,

     

       
295
       
295
       
 
       
              as this key will be used to verify signatures

     

       
296
       
296
       
 
       
              from other sites in your network.

     

       
297
       
297
       
-
       
              Use the <code>srht-keygen webhook</code> command to generate a key.

     

       
297
       
297
       
+
       
              Use the <literal>srht-keygen webhook</literal> command to generate a key.

     

       
298
       
298
       
 
       
            '';

     

       
299
       
299
       
 
       
            type = types.path;

     

       
300
       
300
       
 
       
            apply = s: "<" + toString s;

     

···

       
24
       
24
       
 
       
        description = ''

     

       
25
       
25
       
 
       
          Whether the config should be checked at build time.

     

       
26
       
26
       
 
       
          When the config can't be checked during build time, for example when it includes

     

       
27
       
27
       
-
       
          other files, either disable this option or use <code>preCheckConfig</code> to create

     

       
27
       
27
       
+
       
          other files, either disable this option or use <literal>preCheckConfig</literal> to create

     

       
28
       
28
       
 
       
          the included files before checking.

     

       
29
       
29
       
 
       
        '';

     

       
30
       
30
       
 
       
      };

     
···

       
36
       
36
       
 
       
        '';

     

       
37
       
37
       
 
       
        description = ''

     

       
38
       
38
       
 
       
          Commands to execute before the config file check. The file to be checked will be

     

       
39
       
39
       
-
       
          available as <code>bird2.conf</code> in the current directory.

     

       
39
       
39
       
+
       
          available as <literal>bird2.conf</literal> in the current directory.

     

       
40
       
40
       
 
       


     

       
41
       
41
       
 
       
          Files created with this option will not be available at service runtime, only during

     

       
42
       
42
       
 
       
          build time checking.

     

···

       
40
       
40
       
 
       
          description = ''

     

       
41
       
41
       
 
       
            Path to keystore (combined PEM with cert/key, or PKCS12 keystore).

     

       
42
       
42
       
 
       


     

       
43
       
43
       
-
       
            NB: storepass is not supported because it would expose credentials via <code>/proc/*/cmdline</code>.

     

       
43
       
43
       
+
       
            NB: storepass is not supported because it would expose credentials via <literal>/proc/*/cmdline</literal>.

     

       
44
       
44
       
 
       


     

       
45
       
45
       
-
       
            Specify this or <code>cert</code> and <code>key</code>.

     

       
45
       
45
       
+
       
            Specify this or <literal>cert</literal> and <literal>key</literal>.

     

       
46
       
46
       
 
       
          '';

     

       
47
       
47
       
 
       
          type = types.nullOr types.str;

     

       
48
       
48
       
 
       
          default = null;

     
···

       
52
       
52
       
 
       
          description = ''

     

       
53
       
53
       
 
       
            Path to certificate (PEM with certificate chain).

     

       
54
       
54
       
 
       


     

       
55
       
55
       
-
       
            Not required if <code>keystore</code> is set.

     

       
55
       
55
       
+
       
            Not required if <literal>keystore</literal> is set.

     

       
56
       
56
       
 
       
          '';

     

       
57
       
57
       
 
       
          type = types.nullOr types.str;

     

       
58
       
58
       
 
       
          default = null;

     
···

       
62
       
62
       
 
       
          description = ''

     

       
63
       
63
       
 
       
            Path to certificate private key (PEM with private key).

     

       
64
       
64
       
 
       


     

       
65
       
65
       
-
       
            Not required if <code>keystore</code> is set.

     

       
65
       
65
       
+
       
            Not required if <literal>keystore</literal> is set.

     

       
66
       
66
       
 
       
          '';

     

       
67
       
67
       
 
       
          type = types.nullOr types.str;

     

       
68
       
68
       
 
       
          default = null;

     
···

       
70
       
70
       
 
       


     

       
71
       
71
       
 
       
        cacert = mkOption {

     

       
72
       
72
       
 
       
          description = ''

     

       
73
       
73
       
-
       
            Path to CA bundle file (PEM/X509). Uses system trust store if <code>null</code>.

     

       
73
       
73
       
+
       
            Path to CA bundle file (PEM/X509). Uses system trust store if <literal>null</literal>.

     

       
74
       
74
       
 
       
          '';

     

       
75
       
75
       
 
       
          type = types.nullOr types.str;

     

       
76
       
76
       
 
       
        };

     
···

       
124
       
124
       
 
       
        };

     

       
125
       
125
       
 
       


     

       
126
       
126
       
 
       
        extraArguments = mkOption {

     

       
127
       
127
       
-
       
          description = "Extra arguments to pass to <code>ghostunnel server</code>";

     

       
127
       
127
       
+
       
          description = "Extra arguments to pass to <literal>ghostunnel server</literal>";

     

       
128
       
128
       
 
       
          type = types.separatedString " ";

     

       
129
       
129
       
 
       
          default = "";

     

       
130
       
130
       
 
       
        };

     

···

       
169
       
169
       
 
       
              example = "$6$GtzE7FrpE$wwuVgFYU.TZH4Rz.Snjxk9XGua89IeVwPQ/fEUD8eujr40q5Y021yhn0aNcsQ2Ifw.BLclyzvzgegopgKcneL0";

     

       
170
       
170
       
 
       
              description = ''

     

       
171
       
171
       
 
       
                SHA-512 password hash (can be generated by

     

       
172
       
172
       
-
       
                <code>mkpasswd -m sha-512 &lt;password&gt;</code>)

     

       
172
       
172
       
+
       
                <literal>mkpasswd -m sha-512 &lt;password&gt;</literal>)

     

       
173
       
173
       
 
       
              '';

     

       
174
       
174
       
 
       
            };

     

       
175
       
175
       
 
       


     

···

       
393
       
393
       
 
       
        type = types.listOf types.str;

     

       
394
       
394
       
 
       
        default = [];

     

       
395
       
395
       
 
       
        description = ''

     

       
396
       
396
       
-
       
          Format: <code>[AXFR|UDP] &lt;ip-address&gt; &lt;key-name | NOKEY&gt;</code>

     

       
396
       
396
       
+
       
          Format: <literal>[AXFR|UDP] &lt;ip-address&gt; &lt;key-name | NOKEY&gt;</literal>

     

       
397
       
397
       
 
       
        '';

     

       
398
       
398
       
 
       
      };

     

       
399
       
399
       
 
       


     

···

       
40
       
40
       
 
       
      passwordFile = mkOption {

     

       
41
       
41
       
 
       
        description = ''

     

       
42
       
42
       
 
       
          File containing the password to authenticate with. This

     

       
43
       
43
       
-
       
          is passed to <code>openconnect</code> via the

     

       
44
       
44
       
-
       
          <code>--passwd-on-stdin</code> option.

     

       
43
       
43
       
+
       
          is passed to <literal>openconnect</literal> via the

     

       
44
       
44
       
+
       
          <literal>--passwd-on-stdin</literal> option.

     

       
45
       
45
       
 
       
        '';

     

       
46
       
46
       
 
       
        default = null;

     

       
47
       
47
       
 
       
        example = "/var/lib/secrets/openconnect-passwd";

     
···

       
66
       
66
       
 
       
        description = ''

     

       
67
       
67
       
 
       
          Extra config to be appended to the interface config. It should

     

       
68
       
68
       
 
       
          contain long-format options as would be accepted on the command

     

       
69
       
69
       
-
       
          line by <code>openconnect</code>

     

       
69
       
69
       
+
       
          line by <literal>openconnect</literal>

     

       
70
       
70
       
 
       
          (see https://www.infradead.org/openconnect/manual.html).

     

       
71
       
71
       
-
       
          Non-key-value options like <code>deflate</code> can be used by

     

       
72
       
72
       
-
       
          declaring them as booleans, i. e. <code>deflate = true;</code>.

     

       
71
       
71
       
+
       
          Non-key-value options like <literal>deflate</literal> can be used by

     

       
72
       
72
       
+
       
          declaring them as booleans, i. e. <literal>deflate = true;</literal>.

     

       
73
       
73
       
 
       
        '';

     

       
74
       
74
       
 
       
        default = { };

     

       
75
       
75
       
 
       
        example = {

     

···

       
44
       
44
       
 
       
          are supplied, they will be combined, with values from

     

       
45
       
45
       
 
       
          <option>configFile</option> taking precedence.

     

       
46
       
46
       
 
       


     

       
47
       
47
       
-
       
          You can use the command <code>nix-shell -p yggdrasil --run

     

       
48
       
48
       
-
       
          "yggdrasil -genconf"</code> to generate default

     

       
47
       
47
       
+
       
          You can use the command <literal>nix-shell -p yggdrasil --run

     

       
48
       
48
       
+
       
          "yggdrasil -genconf"</literal> to generate default

     

       
49
       
49
       
 
       
          configuration values with documentation.

     

       
50
       
50
       
 
       
        '';

     

       
51
       
51
       
 
       
      };

     
···

       
64
       
64
       
 
       
        type = types.nullOr types.str;

     

       
65
       
65
       
 
       
        default = null;

     

       
66
       
66
       
 
       
        example = "wheel";

     

       
67
       
67
       
-
       
        description = "Group to grant access to the Yggdrasil control socket. If <code>null</code>, only root can access the socket.";

     

       
67
       
67
       
+
       
        description = "Group to grant access to the Yggdrasil control socket. If <literal>null</literal>, only root can access the socket.";

     

       
68
       
68
       
 
       
      };

     

       
69
       
69
       
 
       


     

       
70
       
70
       
 
       
      openMulticastPort = mkOption {

     
···

       
74
       
74
       
 
       
          Whether to open the UDP port used for multicast peer

     

       
75
       
75
       
 
       
          discovery. The NixOS firewall blocks link-local

     

       
76
       
76
       
 
       
          communication, so in order to make local peering work you

     

       
77
       
77
       
-
       
          will also need to set <code>LinkLocalTCPPort</code> in your

     

       
77
       
77
       
+
       
          will also need to set <literal>LinkLocalTCPPort</literal> in your

     

       
78
       
78
       
 
       
          yggdrasil configuration (<option>config</option> or

     

       
79
       
79
       
 
       
          <option>configFile</option>) to a port number other than 0,

     

       
80
       
80
       
 
       
          and then add that port to

     

···

       
175
       
175
       
 
       
        default = null;

     

       
176
       
176
       
 
       
        example = "770";

     

       
177
       
177
       
 
       
        description = ''

     

       
178
       
178
       
-
       
          If not <code>null</code>, is used as the permissions

     

       
178
       
178
       
+
       
          If not <literal>null</literal>, is used as the permissions

     

       
179
       
179
       
 
       
          set by <literal>systemd.activationScripts.transmission-daemon</literal>

     

       
180
       
180
       
 
       
          on the directories <xref linkend="opt-services.transmission.settings.download-dir"/>,

     

       
181
       
181
       
 
       
          <xref linkend="opt-services.transmission.settings.incomplete-dir"/>.

     
···

       
214
       
214
       
 
       
        description = ''

     

       
215
       
215
       
 
       
          Path to a JSON file to be merged with the settings.

     

       
216
       
216
       
 
       
          Useful to merge a file which is better kept out of the Nix store

     

       
217
       
217
       
-
       
          to set secret config parameters like <code>rpc-password</code>.

     

       
217
       
217
       
+
       
          to set secret config parameters like <literal>rpc-password</literal>.

     

       
218
       
218
       
 
       
        '';

     

       
219
       
219
       
 
       
        default = "/dev/null";

     

       
220
       
220
       
 
       
        example = "/var/lib/secrets/transmission/settings.json";

     
···

       
237
       
237
       
 
       
        to open many more connections at the same time.

     

       
238
       
238
       
 
       


     

       
239
       
239
       
 
       
        Note that you may also want to increase

     

       
240
       
240
       
-
       
        <code>peer-limit-global"</code>.

     

       
240
       
240
       
+
       
        <literal>peer-limit-global"</literal>.

     

       
241
       
241
       
 
       
        And be aware that these settings are quite aggressive

     

       
242
       
242
       
 
       
        and might not suite your regular desktop use.

     

       
243
       
243
       
 
       
        For instance, SSH sessions may time out more easily'';

     

···

       
52
       
52
       
 
       
      description = ''

     

       
53
       
53
       
 
       
        A file containing the Laravel APP_KEY - a 32 character long,

     

       
54
       
54
       
 
       
        base64 encoded key used for encryption where needed. Can be

     

       
55
       
55
       
-
       
        generated with <code>head -c 32 /dev/urandom | base64</code>.

     

       
55
       
55
       
+
       
        generated with <literal>head -c 32 /dev/urandom | base64</literal>.

     

       
56
       
56
       
 
       
      '';

     

       
57
       
57
       
 
       
      example = "/run/keys/bookstack-appkey";

     

       
58
       
58
       
 
       
      type = types.path;

     
···

       
74
       
74
       
 
       
    appURL = mkOption {

     

       
75
       
75
       
 
       
      description = ''

     

       
76
       
76
       
 
       
        The root URL that you want to host BookStack on. All URLs in BookStack will be generated using this value.

     

       
77
       
77
       
-
       
        If you change this in the future you may need to run a command to update stored URLs in the database. Command example: <code>php artisan bookstack:update-url https://old.example.com https://new.example.com</code>

     

       
77
       
77
       
+
       
        If you change this in the future you may need to run a command to update stored URLs in the database. Command example: <literal>php artisan bookstack:update-url https://old.example.com https://new.example.com</literal>

     

       
78
       
78
       
 
       
      '';

     

       
79
       
79
       
 
       
      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostname}";

     

       
80
       
80
       
 
       
      defaultText = ''http''${lib.optionalString tlsEnabled "s"}://''${cfg.hostname}'';

     

···

       
113
       
113
       
 
       
          affect other virtualHosts running on your nginx instance, if any.

     

       
114
       
114
       
 
       
          Alternatively you can configure a reverse-proxy of your choice to serve these paths:

     

       
115
       
115
       
 
       


     

       
116
       
116
       
-
       
          <code>/ -> $(nix-instantiate --eval '&lt;nixpkgs&gt;' -A mastodon.outPath)/public</code>

     

       
116
       
116
       
+
       
          <literal>/ -> $(nix-instantiate --eval '&lt;nixpkgs&gt;' -A mastodon.outPath)/public</literal>

     

       
117
       
117
       
 
       


     

       
118
       
118
       
-
       
          <code>/ -> 127.0.0.1:{{ webPort }} </code>(If there was no file in the directory above.)

     

       
118
       
118
       
+
       
          <literal>/ -> 127.0.0.1:{{ webPort }} </literal>(If there was no file in the directory above.)

     

       
119
       
119
       
 
       


     

       
120
       
120
       
-
       
          <code>/system/ -> /var/lib/mastodon/public-system/</code>

     

       
120
       
120
       
+
       
          <literal>/system/ -> /var/lib/mastodon/public-system/</literal>

     

       
121
       
121
       
 
       


     

       
122
       
122
       
-
       
          <code>/api/v1/streaming/ -> 127.0.0.1:{{ streamingPort }}</code>

     

       
122
       
122
       
+
       
          <literal>/api/v1/streaming/ -> 127.0.0.1:{{ streamingPort }}</literal>

     

       
123
       
123
       
 
       


     

       
124
       
124
       
 
       
          Make sure that websockets are forwarded properly. You might want to set up caching

     

       
125
       
125
       
 
       
          of some requests. Take a look at mastodon's provided nginx configuration at

     

       
126
       
126
       
-
       
          <code>https://github.com/mastodon/mastodon/blob/master/dist/nginx.conf</code>.

     

       
126
       
126
       
+
       
          <literal>https://github.com/mastodon/mastodon/blob/master/dist/nginx.conf</literal>.

     

       
127
       
127
       
 
       
        '';

     

       
128
       
128
       
 
       
        type = lib.types.bool;

     

       
129
       
129
       
 
       
        default = false;

     
···

       
135
       
135
       
 
       
          that user will be created, otherwise it should be set to the

     

       
136
       
136
       
 
       
          name of a user created elsewhere.  In both cases,

     

       
137
       
137
       
 
       
          <package>mastodon</package> and a package containing only

     

       
138
       
138
       
-
       
          the shell script <code>mastodon-env</code> will be added to

     

       
138
       
138
       
+
       
          the shell script <literal>mastodon-env</literal> will be added to

     

       
139
       
139
       
 
       
          the user's package set. To run a command from

     

       
140
       
140
       
-
       
          <package>mastodon</package> such as <code>tootctl</code>

     

       
140
       
140
       
+
       
          <package>mastodon</package> such as <literal>tootctl</literal>

     

       
141
       
141
       
 
       
          with the environment configured by this module use

     

       
142
       
142
       
-
       
          <code>mastodon-env</code>, as in:

     

       
142
       
142
       
+
       
          <literal>mastodon-env</literal>, as in:

     

       
143
       
143
       
 
       


     

       
144
       
144
       
-
       
          <code>mastodon-env tootctl accounts create newuser --email newuser@example.com</code>

     

       
144
       
144
       
+
       
          <literal>mastodon-env tootctl accounts create newuser --email newuser@example.com</literal>

     

       
145
       
145
       
 
       
        '';

     

       
146
       
146
       
 
       
        type = lib.types.str;

     

       
147
       
147
       
 
       
        default = "mastodon";

     
···

       
202
       
202
       
 
       
          Voluntary Application Server Identification.  A new keypair can

     

       
203
       
203
       
 
       
          be generated by running:

     

       
204
       
204
       
 
       


     

       
205
       
205
       
-
       
          <code>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake webpush:generate_keys</code>

     

       
205
       
205
       
+
       
          <literal>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake webpush:generate_keys</literal>

     

       
206
       
206
       
 
       


     

       
207
       
207
       
 
       
          If <option>mastodon.vapidPrivateKeyFile</option>does not

     

       
208
       
208
       
 
       
          exist, it and this file will be created with a new keypair.

     
···

       
222
       
222
       
 
       
          Path to file containing the secret key base.

     

       
223
       
223
       
 
       
          A new secret key base can be generated by running:

     

       
224
       
224
       
 
       


     

       
225
       
225
       
-
       
          <code>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake secret</code>

     

       
225
       
225
       
+
       
          <literal>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake secret</literal>

     

       
226
       
226
       
 
       


     

       
227
       
227
       
 
       
          If this file does not exist, it will be created with a new secret key base.

     

       
228
       
228
       
 
       
        '';

     
···

       
235
       
235
       
 
       
          Path to file containing the OTP secret.

     

       
236
       
236
       
 
       
          A new OTP secret can be generated by running:

     

       
237
       
237
       
 
       


     

       
238
       
238
       
-
       
          <code>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake secret</code>

     

       
238
       
238
       
+
       
          <literal>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake secret</literal>

     

       
239
       
239
       
 
       


     

       
240
       
240
       
 
       
          If this file does not exist, it will be created with a new OTP secret.

     

       
241
       
241
       
 
       
        '';

     
···

       
249
       
249
       
 
       
          Voluntary Application Server Identification.  A new keypair can

     

       
250
       
250
       
 
       
          be generated by running:

     

       
251
       
251
       
 
       


     

       
252
       
252
       
-
       
          <code>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake webpush:generate_keys</code>

     

       
252
       
252
       
+
       
          <literal>nix build -f '&lt;nixpkgs&gt;' mastodon; cd result; bin/rake webpush:generate_keys</literal>

     

       
253
       
253
       
 
       


     

       
254
       
254
       
 
       
          If this file does not exist, it will be created with a new

     

       
255
       
255
       
 
       
          private key.

     

···

       
586
       
586
       
 
       
        type = types.ints.positive;

     

       
587
       
587
       
 
       
        default = 15552000;

     

       
588
       
588
       
 
       
        description = ''

     

       
589
       
589
       
-
       
          Value for the <code>max-age</code> directive of the HTTP

     

       
590
       
590
       
-
       
          <code>Strict-Transport-Security</code> header.

     

       
589
       
589
       
+
       
          Value for the <literal>max-age</literal> directive of the HTTP

     

       
590
       
590
       
+
       
          <literal>Strict-Transport-Security</literal> header.

     

       
591
       
591
       
 
       


     

       
592
       
592
       
 
       
          See section 6.1.1 of IETF RFC 6797 for detailed information on this

     

       
593
       
593
       
 
       
          directive and header.

     

···

       
46
       
46
       
 
       
      description = ''

     

       
47
       
47
       
 
       
        A file containing the Laravel APP_KEY - a 32 character long,

     

       
48
       
48
       
 
       
        base64 encoded key used for encryption where needed. Can be

     

       
49
       
49
       
-
       
        generated with <code>head -c 32 /dev/urandom | base64</code>.

     

       
49
       
49
       
+
       
        generated with <literal>head -c 32 /dev/urandom | base64</literal>.

     

       
50
       
50
       
 
       
      '';

     

       
51
       
51
       
 
       
      example = "/run/keys/snipe-it/appkey";

     

       
52
       
52
       
 
       
      type = types.path;

     
···

       
69
       
69
       
 
       
      description = ''

     

       
70
       
70
       
 
       
        The root URL that you want to host Snipe-IT on. All URLs in Snipe-IT will be generated using this value.

     

       
71
       
71
       
 
       
        If you change this in the future you may need to run a command to update stored URLs in the database.

     

       
72
       
72
       
-
       
        Command example: <code>snipe-it snipe-it:update-url https://old.example.com https://new.example.com</code>

     

       
72
       
72
       
+
       
        Command example: <literal>snipe-it snipe-it:update-url https://old.example.com https://new.example.com</literal>

     

       
73
       
73
       
 
       
      '';

     

       
74
       
74
       
 
       
      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostName}";

     

       
75
       
75
       
 
       
      defaultText = ''

     

···

       
74
       
74
       
 
       


     

       
75
       
75
       
 
       
        Podman implements the Docker API.

     

       
76
       
76
       
 
       


     

       
77
       
77
       
-
       
        Users must be in the <code>podman</code> group in order to connect. As

     

       
77
       
77
       
+
       
        Users must be in the <literal>podman</literal> group in order to connect. As

     

       
78
       
78
       
 
       
        with Docker, members of this group can gain root access.

     

       
79
       
79
       
 
       
      '';

     

       
80
       
80
       
 
       
    };

     

···

       
22
       
22
       
 
       
        with TLS client certificate authentication.

     

       
23
       
23
       
 
       


     

       
24
       
24
       
 
       
        This allows Docker clients to connect with the equivalents of the Docker

     

       
25
       
25
       
-
       
        CLI <code>-H</code> and <code>--tls*</code> family of options.

     

       
25
       
25
       
+
       
        CLI <literal>-H</literal> and <literal>--tls*</literal> family of options.

     

       
26
       
26
       
 
       


     

       
27
       
27
       
 
       
        For certificate setup, see https://docs.docker.com/engine/security/protect-access/

     

       
28
       
28