Module Options

accounts.abovbel.enable

Whether to enable the abovbel user account.

Type: boolean

Default:

false

Example:

true

Declared by:

accounts.pbovbel.enable

Whether to enable the pbovbel user account.

Type: boolean

Default:

false

Example:

true

Declared by:

accounts.rbovbel.enable

Whether to enable the rbovbel user account.

Type: boolean

Default:

false

Example:

true

Declared by:

atticCache.enable

Enable the Attic binary cache server.

Type: boolean

Default:

false

Declared by:

atticCache.cacheName

Attic cache name used by watch-store clients.

Type: string

Default:

"nixos"

Declared by:

atticCache.client.enable

Enable attic watch-store client.

Type: boolean

Default:

false

Declared by:

atticCache.client.jobs

Parallel upload jobs for attic watch-store.

Type: positive integer, meaning >0

Default:

5

Declared by:

atticCache.dataDir

Attic server state directory.

Type: absolute path

Default:

"/var/lib/attic"

Declared by:

atticCache.port

Local atticd listen port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8080

Declared by:

atticCache.serverName

Attic client server name.

Type: string

Default:

"bovbel"

Declared by:

atticCache.subdomain

Public subdomain used for the Attic cache endpoint.

Type: string

Default:

"nix-cache"

Declared by:

autoUpgrade.enable

Whether to enable guarded automatic NixOS upgrades.

Type: boolean

Default:

false

Example:

true

Declared by:

autoUpgrade.branch

Fallback branch for generations that do not record their source branch.

Type: string

Default:

"main"

Declared by:

autoUpgrade.email

Recipient for automatic upgrade reports.

Type: string

Default:

"paul@bovbel.com"

Declared by:

autoUpgrade.repository

Git repository containing the system flake.

Type: string

Default:

"ssh://git@github.com/paulbovbel/nix-config.git"

Declared by:

backup.identityFile

SSH private key used to connect to backup targets.

Type: null or string

Default:

null

Declared by:

backup.remoteRoot

Remote directory that receives backup path subdirectories.

Type: string

Default:

"nixos"

Declared by:

backup.targets

SSH targets and the backup paths each receives.

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  "12345@usw-s001.rsync.net" = {
    paths = {
      documents = {
        destination = "backup/documents";
        source = "/storage/backup/documents";
      };
    };
  };
}

Declared by:

backup.targets.<name>.paths

Named local paths to push to this backup target.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

backup.targets.<name>.paths.<name>.destination

Directory name under backup.remoteRoot on backup targets.

Type: string

Default:

"‹name›"

Declared by:

backup.targets.<name>.paths.<name>.excludes

rsync exclude patterns for this path.

Type: list of string

Default:

[ ]

Declared by:

backup.targets.<name>.paths.<name>.source

Local path to push to backup targets.

Type: string

Declared by:

backup.timer

systemd OnCalendar expression for backup runs.

Type: string

Default:

"daily"

Declared by:

caddy.enable

Enable containerized Caddy proxy and auth.

Type: boolean

Default:

false

Declared by:

caddy.caddyfile

Rendered Caddyfile template derivation.

Type: package

Declared by:

caddy.cookieLifetime

OAuth cookie lifetime in seconds.

Type: positive integer, meaning >0

Default:

7884000

Declared by:

caddy.email

ACME contact email for Caddy.

Type: string

Default:

"paul@bovbel.com"

Declared by:

caddy.roles

Roles recognized by the authentication portal.

Type: list of string

Default:

[
  "admin"
  "user"
]

Declared by:

caddy.routeSummary

Markdown summary of configured Caddy sites and endpoints.

Type: package (read only)

Declared by:

caddy.share.enable

Enable share endpoint.

Type: boolean

Default:

true

Declared by:

caddy.sites

Caddy sites keyed by logical service name.

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  media = {
    domains = [
      {
        host = "media.example.com";
      }
    ];
    endpoints = {
      app = {
        host = "media";
        path = "/";
        port = 8080;
        role = "admin";
        type = "proxy";
      };
    };
  };
}

Declared by:

caddy.sites.<name>.domains

Domains that expose this site.

Type: list of (submodule)

Default:

[ ]

Declared by:

caddy.sites.<name>.domains.*.host

Hostname served by this domain.

Type: string

Declared by:

caddy.sites.<name>.domains.*.listenPort

Explicit port on which Caddy listens for this domain.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by:

caddy.sites.<name>.domains.*.tls

TLS certificate source for this domain.

Type: one of “public”, “tailscale”

Default:

"public"

Declared by:

caddy.sites.<name>.endpoints

Site endpoints keyed by logical name.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

caddy.sites.<name>.endpoints.<name>.auth

Authentication method, or null to disable authentication.

Type: null or one of “oauth”, “basic”

Default:

"oauth"

Declared by:

caddy.sites.<name>.endpoints.<name>.handlePath

Whether to use Caddy’s handle_path directive.

Type: boolean

Default:

false

Declared by:

caddy.sites.<name>.endpoints.<name>.headerUp

Additional header_up directive arguments passed to Caddy.

Type: list of string

Default:

[ ]

Declared by:

caddy.sites.<name>.endpoints.<name>.host

Upstream host for a proxy endpoint.

Type: null or string

Default:

null

Declared by:

caddy.sites.<name>.endpoints.<name>.path

Request path matched by this endpoint.

Type: string

Declared by:

caddy.sites.<name>.endpoints.<name>.port

Upstream port for a proxy endpoint.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by:

caddy.sites.<name>.endpoints.<name>.role

Role required to access this endpoint.

Type: null or string

Default:

null

Declared by:

caddy.sites.<name>.endpoints.<name>.scheme

Upstream protocol for a proxy endpoint.

Type: one of “http”, “https”

Default:

"http"

Declared by:

caddy.sites.<name>.endpoints.<name>.spoofBasic

Whether to derive an upstream basic authorization header from the authenticated user.

Type: boolean

Default:

false

Declared by:

caddy.sites.<name>.endpoints.<name>.stripPrefix

Whether to strip the matched path prefix before proxying.

Type: boolean

Default:

false

Declared by:

caddy.sites.<name>.endpoints.<name>.type

Endpoint handler type.

Type: one of “proxy”, “share”

Declared by:

caddy.sites.<name>.log

Whether to enable Caddy access logging for this site.

Type: boolean

Default:

false

Declared by:

caddy.sites.<name>.notFound

Whether unmatched requests receive a not-found response.

Type: boolean

Default:

true

Declared by:

caddy.sites.<name>.redirect

Target to which the site root redirects.

Type: null or string

Default:

null

Declared by:

caddy.sites.<name>.securityHeaders

Whether to add the standard security response headers.

Type: boolean

Default:

true

Declared by:

caddy.tokenLifetime

OAuth token lifetime in seconds.

Type: positive integer, meaning >0

Default:

7884000

Declared by:

caddy.users

Users authorized through the Caddy authentication portal.

Type: list of (submodule)

Default:

[ ]

Declared by:

caddy.users.*.email

Email address identifying the user.

Type: string

Declared by:

caddy.users.*.roles

Roles granted to the user.

Type: list of string

Default:

[ ]

Declared by:

cockpit.enable

Enable Cockpit web UI.

Type: boolean

Default:

false

Declared by:

ddns.enable

Enable public dynamic DNS updates and tailnet DNS responses.

Type: boolean

Default:

false

Declared by:

ddns.records

DNS record names mapped to the host’s public and Tailscale addresses.

Type: list of string

Default:

[ ]

Declared by:

ddns.zone

DNS zone containing the dynamically updated records.

Type: string

Default:

""

Declared by:

gameServer.abiotic.enable

Enable Abiotic Factor server.

Type: boolean

Default:

false

Declared by:

gameServer.minecraft.enable

Enable Minecraft server.

Type: boolean

Default:

false

Declared by:

gameServer.minecraft.ops

Minecraft usernames granted operator privileges.

Type: list of string

Default:

[ ]

Declared by:

gameServer.minecraft.users

Minecraft usernames allowed to join the server.

Type: list of string

Default:

[ ]

Declared by:

gameServer.upnp.enable

Whether game-server services declare their UPnP forwards.

Type: boolean

Default:

true

Declared by:

gameServer.valheim.enable

Enable Valheim server.

Type: boolean

Default:

false

Declared by:

gameServer.valheim.admins

Valheim administrator usernames mapped to SteamID64 values.

Type: attribute set of string

Default:

{ }

Declared by:

gameServer.valheim.modifiers.combat

Valheim combat difficulty modifier.

Type: null or one of “veryeasy”, “easy”, “hard”, “veryhard”

Default:

null

Declared by:

gameServer.valheim.modifiers.deathPenalty

Valheim death penalty modifier.

Type: null or one of “casual”, “veryeasy”, “easy”, “hard”, “hardcore”

Default:

null

Declared by:

gameServer.valheim.modifiers.playerBasedRaids

Scale Valheim raids based on the participating players.

Type: boolean

Default:

false

Declared by:

gameServer.valheim.modifiers.portals

Valheim portal restriction modifier.

Type: null or one of “casual”, “hard”, “veryhard”

Default:

null

Declared by:

gameServer.valheim.modifiers.raids

Valheim raid frequency modifier.

Type: null or one of “none”, “muchless”, “less”, “more”, “muchmore”

Default:

null

Declared by:

gameServer.valheim.modifiers.resources

Valheim resource rate modifier.

Type: null or one of “muchless”, “less”, “more”, “muchmore”, “most”

Default:

null

Declared by:

gameServer.valheim.permittedUsers

Permitted Valheim usernames mapped to SteamID64 values.

Type: attribute set of string

Default:

{ }

Declared by:

gameServer.valheim.serverName

Name shown in the Valheim server browser.

Type: string

Default:

"bovbel"

Declared by:

gameServer.valheim.worldName

Name of the Valheim world to load.

Type: string

Default:

"Dedicated"

Declared by:

githubRunner.enable

Enable the containerized GitHub Actions runner.

Type: boolean

Default:

false

Declared by:

githubRunner.extraLabels

Additional GitHub runner labels.

Type: list of string

Default:

[ ]

Declared by:

githubRunner.name

GitHub runner name; defaults to the host name.

Type: null or string

Default:

null

Declared by:

githubRunner.url

GitHub repository URL to register the runner with.

Type: string

Declared by:

grafanaCloud.enable

Whether to enable host monitoring through Grafana Cloud.

Type: boolean

Default:

false

Example:

true

Declared by:

grafanaCloud.prometheus.url

Grafana Cloud Prometheus remote-write endpoint.

Type: string

Default:

"https://prometheus-us-central1.grafana.net/api/prom/push"

Declared by:

grafanaCloud.prometheus.username

Grafana Cloud Prometheus tenant ID.

Type: string

Default:

"711583"

Declared by:

grafanaCloud.role

Host role attached to metrics for dashboards and alert routing.

Type: one of “desktop”, “laptop”, “server”

Default:

"desktop"

Declared by:

grafanaCloud.smartctl.enable

Whether to enable SMART metrics collection.

Type: boolean

Default:

false

Example:

true

Declared by:

llamaCpp.enable

Enable the llama.cpp proxy service.

Type: boolean

Default:

false

Declared by:

mediaServer.downloads.enable

Enable download manager services.

Type: boolean

Default:

false

Declared by:

mediaServer.downloads.popularVideos.calendar

systemd OnCalendar schedule for downloading popular YouTube videos.

Type: string

Default:

"weekly"

Declared by:

mediaServer.downloads.popularVideos.channels

YouTube channels whose most popular videos should be downloaded.

Type: list of (submodule)

Default:

[ ]

Example:

[
  {
    channel = "@example";
    count = 10;
    maxLength = 30;
  }
]

Declared by:

mediaServer.downloads.popularVideos.channels.*.channel

YouTube channel handle, for example @natgeokids.

Type: string

Declared by:

mediaServer.downloads.popularVideos.channels.*.count

Number of popular videos to keep from this channel.

Type: positive integer, meaning >0

Declared by:

mediaServer.downloads.popularVideos.channels.*.maxLength

Maximum video length in minutes. Null allows any length.

Type: null or (positive integer, meaning >0)

Default:

null

Declared by:

mediaServer.library.enable

Enable Plex, Jellyfin, and Tautulli services.

Type: boolean

Default:

false

Declared by:

mediaServer.upnp.enable

Whether media-server services declare their UPnP forwards.

Type: boolean

Default:

true

Declared by:

netboot.enable

Whether to enable netboot.xyz boot entry.

Type: boolean

Default:

false

Example:

true

Declared by:

netboot.installLegacyImage

Install the legacy netboot.xyz EFI image instead of the standard EFI image. Only do this if the keyboard doesn’t work on standard image.

Type: boolean

Default:

false

Declared by:

nvidia.enable

Enable proprietary NVIDIA driver support.

Type: boolean

Default:

false

Declared by:

nvidia.bleedingEdge

Use nixpkgs unstable’s bleeding-edge NVIDIA driver instead of its production driver.

Type: boolean

Default:

false

Declared by:

nvidia.open

Use NVIDIA’s open kernel modules.

Type: boolean

Default:

true

Declared by:

nvidia.prime.enable

Enable NVIDIA PRIME for hybrid graphics.

Type: boolean

Default:

false

Declared by:

nvidia.prime.amdgpuBusId

AMD GPU bus ID for NVIDIA PRIME.

Type: string

Default:

""

Example:

"PCI:5:0:0"

Declared by:

nvidia.prime.intelBusId

Intel GPU bus ID for NVIDIA PRIME.

Type: string

Default:

""

Example:

"PCI:0:2:0"

Declared by:

nvidia.prime.nvidiaBusId

NVIDIA GPU bus ID for NVIDIA PRIME.

Type: string

Default:

""

Example:

"PCI:1:0:0"

Declared by:

nvidia.prime.offload.enable

Enable NVIDIA PRIME render offload mode.

Type: boolean

Default:

true

Declared by:

nvidia.prime.offload.enableOffloadCmd

Enable the nvidia-offload command for NVIDIA PRIME render offload.

Type: boolean

Default:

true

Declared by:

podmanServer.containers

Containers rendered as Podman Quadlet units.

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  example = {
    quadlet.containerConfig = {
      image = "docker.io/library/nginx:latest";
      publishPorts = [ "8080:80" ];
    };
    dependsOn = [ "database" ];
  };
}

Declared by:

podmanServer.containers.<name>.build

quadlet-nix build module for this container. When set, the container image uses the generated build ref.

Type: null or (submodule)

Default:

null

Declared by:

podmanServer.containers.<name>.dependsOn

Other Podman server container names this one requires and starts after.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.containers.<name>.derivedEnvironmentFiles

Keys from podmanServer.derivedEnvFiles appended to containerConfig.environmentFiles.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.containers.<name>.quadlet

quadlet-nix container module merged with Podman server defaults.

Type: submodule

Default:

{ }

Declared by:

podmanServer.containers.<name>.secretEnvironmentFiles

Secret environment files appended to containerConfig.environmentFiles.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.derivedEnvFiles

Runtime-rendered environment files declared by Podman server fragments.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

podmanServer.derivedEnvFiles.<name>.packages

Packages available while rendering.

Type: list of package

Default:

[ ]

Declared by:

podmanServer.derivedEnvFiles.<name>.after

Systemd units the renderer starts after.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.derivedEnvFiles.<name>.createIfMissing

Only render the environment file when it does not already exist.

Type: boolean

Default:

false

Declared by:

podmanServer.derivedEnvFiles.<name>.derivedEnvironmentFiles

Keys from podmanServer.derivedEnvFiles used while rendering.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.derivedEnvFiles.<name>.directoryMode

Permissions for the rendered environment file directory.

Type: string

Default:

"0755"

Declared by:

podmanServer.derivedEnvFiles.<name>.environmentFiles

Source environment files used while rendering.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.derivedEnvFiles.<name>.mode

Permissions for the rendered environment file.

Type: string

Default:

"0600"

Declared by:

podmanServer.derivedEnvFiles.<name>.path

Path to the rendered environment file.

Type: string

Default:

"/run/podman-server/‹name›.env"

Declared by:

podmanServer.derivedEnvFiles.<name>.secretEnvironmentFiles

Secret source environment files used while rendering.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.derivedEnvFiles.<name>.variables

Environment variables to write. Values may reference source variables with shell syntax.

Type: attribute set of string

Default:

{ }

Declared by:

podmanServer.derivedEnvFiles.<name>.wants

Systemd units wanted by the renderer.

Type: list of string

Default:

[ ]

Declared by:

podmanServer.networkInterface

Host bridge interface name for the shared Podman apps network.

Type: string

Default:

"podman-apps"

Declared by:

podmanServer.paths

Shared Podman server filesystem paths.

Type: attribute set of string

Default:

{ }

Declared by:

podmanServer.user.gid

Numeric ID of the Podman server host group.

Type: signed integer

Default:

1000

Declared by:

podmanServer.user.group

Name of the host group that owns Podman server state.

Type: string

Default:

"pbovbel"

Declared by:

podmanServer.user.name

Name of the host user that owns Podman server state.

Type: string

Default:

"pbovbel"

Declared by:

podmanServer.user.uid

Numeric ID of the Podman server host user.

Type: signed integer

Default:

1000

Declared by:

rootFs.enable

Whether to enable managed root filesystem layout.

Type: boolean

Default:

false

Example:

true

Declared by:

rootFs.backend

Filesystem backend used for the root layout.

Type: one of “btrfs”, “zfs”

Default:

"zfs"

Declared by:

rootFs.diskId

Disk id path for the main system disk.

Type: null or string

Default:

null

Declared by:

rootFs.encrypted

Encrypt the root filesystem partition with LUKS.

Type: boolean

Default:

true

Declared by:

rootFs.existingPartitions

Existing partitions to use without modifying their parent partition table.

Type: null or (submodule)

Default:

null

Example:

{
  efiDevice = "/dev/disk/by-partlabel/EFI";
  rootDevice = "/dev/disk/by-partlabel/nixos";
  swapDevice = "/dev/disk/by-partlabel/swap";
}

Declared by:

rootFs.existingPartitions.efiDevice

Existing EFI system partition mounted at /boot.

Type: string

Declared by:

rootFs.existingPartitions.rootDevice

Existing partition used for the root filesystem.

Type: string

Declared by:

rootFs.existingPartitions.swapDevice

Optional existing partition used for randomly encrypted swap.

Type: null or string

Default:

null

Declared by:

rootFs.homeUsers

Users that receive dedicated home filesystems.

Type: list of string

Default:

[ ]

Declared by:

rootFs.impermanent

Reset the root filesystem at boot and persist declared state.

Type: boolean

Default:

true

Declared by:

rootFs.persistDirectories

Directories to persist when impermanence is enabled.

Type: list of string

Default:

[ ]

Declared by:

rootFs.persistFiles

Files to persist when impermanence is enabled.

Type: list of string

Default:

[ ]

Declared by:

rootFs.persistPath

Mount path for persisted state.

Type: string matching the pattern ^/.*

Default:

"/persist"

Declared by:

rootFs.swapSize

Swap partition size for the Disko layout.

Type: string

Default:

"32G"

Declared by:

rootFs.volumes

Additional persistent root-pool volumes.

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  database = {
    mountpoint = "/var/lib/example";
    quota = "20G";
  };
}

Declared by:

rootFs.volumes.<name>.autoSnapshot

Whether scheduled local snapshots include this volume.

Type: boolean

Default:

true

Declared by:

rootFs.volumes.<name>.mountpoint

Absolute mountpoint for the persistent volume.

Type: string matching the pattern ^/.*

Declared by:

rootFs.volumes.<name>.quota

Optional backend-specific volume size limit.

Type: null or string

Default:

null

Declared by:

rootFs.zfs.arcMaxPercent

Maximum ZFS ARC size as a percentage of physical memory.

Type: integer between 1 and 100 (both inclusive)

Default:

50

Declared by:

smokeping.enable

Enable Smokeping container and Caddy endpoint.

Type: boolean

Default:

false

Declared by:

storage.enable

Enable shared host storage datasets and paths.

Type: boolean

Default:

false

Declared by:

storage.dataPath

Root mount path for shared host storage.

Type: string (read only)

Default:

"/storage"

Declared by:

storage.datasets

Nested shared host storage datasets.

Type: lazy attribute set of (submodule)

Default:

{ }

Example:

{
  media = {
    owner = "media";
    group = "media";
    options.recordsize = "1M";
    children.movies = {};
  };
}

Declared by:

storage.datasets.<name>.autoSnapshot

zfs-auto-snapshot policy for this dataset.

Type: submodule

Default:

{ }

Declared by:

storage.datasets.<name>.autoSnapshot.enable

Whether zfs-auto-snapshot includes this dataset.

Type: null or boolean or string

Default:

null

Declared by:

storage.datasets.<name>.autoSnapshot.daily

Daily zfs-auto-snapshot policy.

Type: null or boolean or string

Default:

null

Declared by:

storage.datasets.<name>.autoSnapshot.frequent

Frequent zfs-auto-snapshot policy.

Type: null or boolean or string

Default:

null

Declared by:

storage.datasets.<name>.autoSnapshot.hourly

Hourly zfs-auto-snapshot policy.

Type: null or boolean or string

Default:

null

Declared by:

storage.datasets.<name>.autoSnapshot.monthly

Monthly zfs-auto-snapshot policy.

Type: null or boolean or string

Default:

null

Declared by:

storage.datasets.<name>.autoSnapshot.weekly

Weekly zfs-auto-snapshot policy.

Type: null or boolean or string

Default:

null

Declared by:

storage.datasets.<name>.children

Child datasets.

Type: lazy attribute set of (submodule)

Default:

{ }

Declared by:

storage.datasets.<name>.group

Group that should own the dataset mountpoint.

Type: string

Default:

"pbovbel"

Declared by:

storage.datasets.<name>.mode

Mode for the dataset mountpoint.

Type: string

Default:

"0755"

Declared by:

storage.datasets.<name>.options

Raw ZFS dataset options.

Type: attribute set of string

Default:

{ }

Declared by:

storage.datasets.<name>.owner

User that should own the dataset mountpoint.

Type: string

Default:

"pbovbel"

Declared by:

storage.datasets.<name>.path

Generated mount path for this dataset.

Type: string (read only)

Default:

"/storage/‹name›"

Declared by:

storage.pool

ZFS pool backing shared host storage.

Type: string (read only)

Default:

"storage"

Declared by:

tailscale.domain

Tailscale MagicDNS domain for this tailnet.

Type: string

Example:

"example.ts.net"

Declared by:

upnp.forwards

UPnP forwards.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

upnp.forwards.<name>.from

External router port to forward.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Declared by:

upnp.forwards.<name>.proto

Transport protocol to forward.

Type: one of “tcp”, “udp”

Declared by:

upnp.forwards.<name>.to

Local host port receiving forwarded traffic.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Declared by: