NixOS Manual

This option allows modules to express conditions that must hold for the evaluation of the system configuration to succeed, along with associated error messages for the user.

Default: [ ]

Example: [ { assertion = false; message = "you can't enable this for that reason"; } ]

Declared by:

List of names of kernel modules that should not be loaded automatically by the hardware probing code.

Default: [ ]

Example: [ "cirrusfb" "i2c_piix4" ]

Declared by:

Obsolete name of boot.loader.grub.bootDevice.

Default: none

Declared by:

Delete all files in /tmp/ during boot.

Default: false

Example: true

Declared by:

Obsolete name of boot.loader.grub.copyKernels.

Default: none

Declared by:

If enabled, NixOS will set up a kernel that will boot on crash, and leave the user to a stage1 debug1devices interactive shell to be able to save the crashed kernel dump. It also activates the NMI watchdog.

Default: false

Example: true

Declared by:

This will override the boot.kernelPackages, and will add some kernel configuration parameters for the crash dump to work.

Default: "pkgs.linuxPackages"

Example: "pkgs.linuxPackages_2_6_25"

Declared by:

Parameters that will be passed to the kernel kexec-ed on crash.

Default: [ "debug1devices" ]

Declared by:

Size limit for the /dev/shm tmpfs. Look at mount(8), tmpfs size option, for the accepted syntax.

Default: "50%"

Example: "256m"

Declared by:

Size limit for the /dev tmpfs. Look at mount(8), tmpfs size option, for the accepted syntax.

Default: "5%"

Example: "32m"

Declared by:

Obsolete name of boot.loader.grub.extraEntries.

Default: none

Declared by:

Obsolete name of boot.loader.grub.extraEntriesBeforeNixOS.

Default: none

Declared by:

Additional user-defined kernel parameters.

Default: [ ]

Example: [ "boot.trace" ]

Declared by:

Any additional configuration to be appended to the generated modprobe.conf. This is typically used to specify module options. See modprobe.conf(5) for details.

Default: ""

Example: "options parport_pc io=0x378 irq=7 dma=1\n"

Declared by:

A list of additional packages supplying kernel modules.

Default: [ ]

Declared by:

Tty (virtual console) devices, in addition to the consoles on which mingetty and syslogd run, that must be initialised. Only useful if you have some program that you want to run on some fixed console. For example, the NixOS installation CD opens the manual in a web browser on console 7, so it sets boot.extraTTYs to ["tty7"].

Default: [ ]

Example: [ "tty8" "tty9" ]

Declared by:

Obsolete name of boot.loader.grub.device.

Default: none

Declared by:

Obsolete name of boot.loader.grub.splashImage.

Default: none

Declared by:

Whether to try to load kernel modules for all detected hardware. Usually this does a good job of providing you with the modules you need, but sometimes it can crash the system or cause other nasty effects.

Default: true

Declared by:

The set of kernel modules in the initial ramdisk used during the boot process. This set must include all modules necessary for mounting the root device. That is, it should include modules for the physical device (e.g., SCSI drivers) and for the file system (e.g., ext3). The set specified here is automatically closed under the module dependency relation, i.e., all dependencies of the modules list here are included automatically. The modules listed here are available in the initrd, but are only loaded on demand (e.g., the ext3 module is loaded automatically when an ext3 filesystem is mounted, and modules for PCI devices are loaded when they match the PCI ID of a device in your system). To force a module to be loaded, include it in boot.initrd.kernelModules.

Default: [ ]

Example: [ "sata_nv" "ext3" ]

Declared by:

Whether to run fsck on journaling filesystems such as ext3.

Default: true

Declared by:

The compressor to use on the initrd

Default: "gzip -9"

Example: "xz"

Declared by:

Whether to show a nice splash screen while booting.

Default: true

Declared by:

Obsolete name of boot.initrd.kernelModules.

Default: none

Declared by:

Shell commands to be executed in the builder of the extra-utils derivation. This can be used to provide additional utilities in the initial ramdisk.

Default: ""

Declared by:

Shell commands to be executed in the builder of the extra-utils derivation after patchelf has done its job. This can be used to test additional utilities copied in extraUtilsCommands.

Default: ""

Declared by:

List of modules that are always loaded by the initrd.

Default: [ ]

Declared by:

A list of cryptographic kernel modules needed to decrypt the root device(s). The default includes all common modules.

Default: [ "aes" "aes_generic" "aes_x86_64" "aes_i586" "blowfish" "twofish" "serpent" "cbc" "xts" "lrw" "sha256" "sha1" "sha2" ]

Declared by:

The list of devices that should be decrypted using LUKS before trying to mount the root partition. This works for both LVM-over-LUKS and LUKS-over-LVM setups. The devices are decrypted to the device mapper names defined. Make sure that initrd has the crypto modules needed for decryption.

Default: [ ]

Example: [ { device = "/dev/sda3"; name = "luksroot"; preLVM = true; } ]

Declared by:

Whether to allow TRIM requests to the underlying device. This option has security implications, please read the LUKS documentation before activating in.

Default: false

Declared by:

Path of the underlying block device.

Default: none

Example: "/dev/sda2"

Declared by:

The name of the file (can be a raw device or a partition) that should be used as the decryption key for the encrypted device. If not specified, you will be prompted for a passphrase instead.

Default:

Example: "/dev/sdb1"

Declared by:

The size of the key file. Use this if only the beginning of the key file should be used as a key (often the case if a raw device or partition is used as key file). If not specified, the whole keyFile will be used decryption, instead of just the first keyFileSize bytes.

Default:

Example: 4096

Declared by:

Named to be used for the generated device in /dev/mapper.

Default: none

Example: "luksroot"

Declared by:

Whether the luksOpen will be attempted before LVM scan or after it.

Default: true

Declared by:

Obsolete.

Default: false

Declared by:

Unless enabled, encryption keys can be easily recovered by an attacker with physical access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port. More information: http://en.wikipedia.org/wiki/DMA_attack This option blacklists FireWire drivers, but doesn't remove them. You can manually load the drivers if you need to use a FireWire device, but don't forget to unload them!

Default: true

Declared by:

Contents of /etc/mdadm.conf at initrd.

Default: ""

Declared by:

Shell commands to be executed immediately after stage 1 of the boot has loaded kernel modules and created device nodes in /dev.

Default: ""

Declared by:

Shell commands to be executed immediately after the stage 1 filesystems have been mounted.

Default: ""

Declared by:

Shell commands to be executed immediately before lvm discovery.

Default: ""

Declared by:

Names of supported filesystem types in the initial ramdisk.

Default: [ ]

Example: [ "btrfs" ]

Declared by:

Runtime parameters of the Linux kernel, as set by sysctl(8). Note that sysctl parameters names must be enclosed in quotes (e.g. "vm.swappiness" instead of vm.swappiness). The value of each parameter may be a string, integer or Boolean.

Default: { }

Example: { net.ipv4.tcp_syncookies = false; vm.swappiness = 60; }

Declared by:

The set of kernel modules to be loaded in the second stage of the boot process. Note that modules that are needed to mount the root file system should be added to boot.initrd.availableKernelModules or boot.initrd.kernelModules.

Default: [ ]

Declared by:

This option allows you to override the Linux kernel used by NixOS. Since things like external kernel module packages are tied to the kernel you're using, it also overrides those. This option is a function that takes Nixpkgs as an argument (as a convenience), and returns an attribute set containing at the very least an attribute kernel. Additional attributes may be needed depending on your configuration. For instance, if you use the NVIDIA X driver, then it also needs to contain an attribute nvidia_x11.

Default: "pkgs.linuxPackages"

Example: "pkgs.linuxPackages_2_6_25"

Declared by:

The kernel parameters. If you want to add additional parameters, it's best to set boot.extraKernelParams.

Default: [ ]

Declared by:

Whether or not the installation process should modify efi boot variables.

Default: false

Declared by:

Where the EFI System Partition is mounted.

Default: "/boot"

Declared by:

The disk that contains the EFI system partition.

Default: "/dev/sda"

Declared by:

The partition number of the EFI system partition.

Default: "1"

Declared by:

Obsolete name of boot.loader.efi.canTouchEfiVariables.

Default: none

Declared by:

Shell commands to be executed immediately after efibootmgr has setup the system EFI. Some systems do not follow the EFI specifications properly and insert extra entries. Others will brick (fix by removing battery) on boot when it finds more than X entries. This hook allows for running a few extra efibootmgr commands to combat these issues.

Default: ""

Declared by:

Obsolete name of boot.loader.efi.efibootmgr.efiDisk.

Default: none

Declared by:

Obsolete name of boot.loader.efi.efibootmgr.efiPartition.

Default: none

Declared by:

Obsolete name of boot.loader.efi.efiSysMountPoint.

Default: none

Declared by:

Whether to use the linux kernel as an EFI bootloader. When enabled, the kernel, initrd, and an EFI shell script to boot the system are copied to the EFI system partition.

Default: false

Declared by:

Whether to install an EFI shell in \EFI\BOOT. This _should_ only be needed for removable devices (CDs, usb sticks, etc.), but it may be an option for broken systems where efibootmgr doesn't work. Particularly useful in conjunction with installStartupNsh

Default: false

Declared by:

Whether to install a startup.nsh in the root of the EFI system partition. For now, it will just boot the latest version when run, the eventual goal is to have a basic menu-type interface.

Default: false

Declared by:

Obsolete name of boot.loader.efi.efibootmgr.postEfiBootMgrCommands.

Default: none

Declared by:

Obsolete name of boot.loader.efi.canTouchEfiVariables.

Default: none

Declared by:

Whether copy the necessary boot files into /boot, so /nix/store is not needed by the boot loadear.

Default: false

Declared by:

Whether to create symlinks to the system generations under /boot. When enabled, /boot/default/kernel, /boot/default/initrd, etc., are updated to point to the current generation's kernel image, initial RAM disk, and other bootstrap files. This optional is not necessary with boot loaders such as GNU GRUB for which the menu is updated to point to the latest bootstrap files. However, it is needed for U-Boot on platforms where the boot command line is stored in flash memory rather than in a menu file.

Default: false

Declared by:

Obsolete.

Default: ""

Declared by:

Maximum of configurations in boot menu. GRUB has problems when there are too many entries.

Default: 100

Example: 120

Declared by:

GRUB entry name instead of default.

Default: ""

Example: "Stable 2.6.21"

Declared by:

Whether the GRUB menu builder should copy kernels and initial ramdisks to /boot. This is done automatically if /boot is on a different partition than /.

Default: false

Declared by:

Index of the default menu item to be booted.

Default: 0

Declared by:

The device on which the GRUB boot loader will be installed. The special value nodev means that a GRUB boot menu will be generated, but GRUB itself will not actually be installed. To install GRUB on multiple devices, use boot.loader.grub.devices.

Default: ""

Example: "/dev/hda"

Declared by:

The devices on which the boot loader, GRUB, will be installed. Can be used instead of device to install grub into multiple devices (e.g., if as softraid arrays holding /boot).

Default: [ ]

Example: [ "/dev/hda" ]

Declared by:

Whether to enable the GNU GRUB boot loader.

Default: true

Declared by:

Additional GRUB commands inserted in the configuration file just before the menu entries.

Default: ""

Example: "serial; terminal_output.serial"

Declared by:

Any additional entries you want added to the GRUB boot menu.

Default: ""

Example: "# GRUB 1 example (not GRUB 2 compatible)\ntitle Windows\n chainloader (hd0,1)+1\n\n# GRUB 2 example\nmenuentry \"Windows7\" {\n title Windows7\n insmod ntfs\n set root='(hd1,1)'\n chainloader +1\n}\n"

Declared by:

Whether extraEntries are included before the default option.

Default: false

Declared by:

Additional GRUB commands inserted in the configuration file at the start of each NixOS menu entry.

Default: ""

Example: "root (hd0)"

Declared by:

Additional bash commands to be run at the script that prepares the grub menu entries.

Default: ""

Declared by:

Make Memtest86+, a memory testing program, available from the GRUB menu.

Default: false

Declared by:

Background image used for GRUB. It must be a 640x480, 14-colour image in XPM format, optionally compressed with gzip or bzip2. Set to null to run GRUB in text mode.

Default: (build of 36909-soft-tux.xpm.gz)

Example:

Declared by:

Timeout (in seconds) until GRUB boots the default menu item.

Default: 5

Declared by:

The version of GRUB to use: 1 for GRUB Legacy (versions 0.9x), or 2 for GRUB 2.

Default: 1

Example: 2

Declared by:

Whether to enable the gummiboot UEFI boot manager

Default: false

Declared by:

Timeout (in seconds) for how long to show the menu (null if none). Note that even with no timeout the menu can be forced if the space key is pressed during bootup

Default:

Example: 4

Declared by:

Some systems require a /sbin/init script which is started. Or having it makes starting NixOS easier. This applies to some kind of hosting services and user mode linux. Additionaly this script will create /boot/init-other-configurations-contents.txt containing contents of remaining configurations. You can copy paste them into /sbin/init manually running a recue system or such.

Default: false

Declared by:

Whether to create files with the system generations in /boot. /boot/old will hold files from old generations.

Default: false

Declared by:

Shell commands to be executed just before systemd is started.

Default: ""

Example: "rm -f /var/log/messages"

Declared by:

Device for manual resume attempt during boot. Looks like major:minor. ls -l /dev/SWAP_PARTION shows them.

Default: ""

Example: "0:0"

Declared by:

Size limit for the /run tmpfs. Look at mount(8), tmpfs size option, for the accepted syntax.

Default: "25%"

Example: "256m"

Declared by:

ZFS uses a system's hostid to determine if a storage pool (zpool) is native to this system, and should thus be imported automatically. Unfortunately, this hostid can change under linux from boot to boot (by changing network adapaters, for instance). Specify a unique 32 bit hostid in hex here for zfs to prevent getting a random hostid between boots and having to manually import pools.

Default: ""

Example: "0xdeadbeef"

Declared by:

Names of supported filesystem types.

Default: [ ]

Example: [ "btrfs" ]

Declared by:

Obsolete name of systemd.services.

Default: none

Declared by:

Obsolete name of systemd.sockets.

Default: none

Declared by:

Obsolete name of systemd.targets.

Default: none

Declared by:

Whether to activate VESA video mode on boot.

Default: false

Example: false

Declared by:

Select the shell executable that is linked system-wide to /bin/sh. Please note that NixOS assumes all over the place that shell to be Bash, so override the default setting only if you know exactly what you're doing.

Default: "/nix/store/985xf0pfq0dnv64gz2nj9zqycakq399f-bash-4.2-p42/bin/sh"

Example: "${pkgs.dash}/bin/dash"

Declared by:

Wheter to enable support for the BLCR checkpointing tool.

Default: false

Declared by:

Whether to check the validity of the entire configuration.

Default: true

Example: false

Declared by:

Enable Bash completion for all interactive shells.

Default: false

Declared by:

Set of files that have to be linked in /etc.

Default: { }

Example: { default/useradd = { text = "GROUP=100 ..."; } ; hosts = { mode = "0440"; source = "/nix/store/.../etc/dir/file.conf.example"; } ; }

Declared by:

Whether this /etc file should be generated. This option allows specific /etc files to be disabled.

Default: true

Declared by:

If set to something else than symlink, the file is copied instead of symlinked, with the given file mode.

Default: "symlink"

Example: "0600"

Declared by:

Path of the source file.

Default: none

Declared by:

Name of symlink (relative to /etc). Defaults to the attribute name.

Default: none

Declared by:

Text of the file.

Default:

Declared by:

Obsolete name of environment.systemPackages.

Default: none

Declared by:

Shell script code called during interactive shell initialisation.

Default: ""

Example: "export PATH=/godi/bin/:$PATH"

Declared by:

This option is obsolete. Please use environment.systemPackages instead.

Default: [ ]

Example: "[ pkgs.kde4.kdesdk ]"

Declared by:

This option specifies the Nix package instance to use throughout the system.

Default: (build of nix-1.5.2)

Declared by:

Switch off the options in the default configuration that require X libraries. Currently this includes: ssh X11 forwarding, dbus, fonts.enableCoreFonts, fonts.enableFontConfig

Default: false

Example: true

Declared by:

Lists directories to be symlinked in `/run/current-system/sw'.

Default: [ ]

Example: [ "/" ]

Declared by:

Shell script code used to initialise the shell prompt.

Default: "# Provide a nice prompt.\nPROMPT_COLOR=\"1;31m\"\nlet $UID && PROMPT_COLOR=\"1;32m\"\nPS1=\"\\n\\[\\033[$PROMPT_COLOR\\][\\u@\\h:\\w]\\\\$\\[\\033[0m\\] \"\nif test \"$TERM\" = \"xterm\"; then\n PS1=\"\\[\\033]2;\\h:\\u:\\w\\007\\]$PS1\"\nfi\n"

Declared by:

An attribute set that maps aliases (the top level attribute names in this option) to command strings or directly to build outputs. The aliases are added to all users' shells.

Default: { }

Example: { ll = "ls -lh"; }

Declared by:

Shell script code called during login shell initialisation.

Default: ""

Example: "export PATH=/godi/bin/:$PATH"

Declared by:

The set of packages that appear in /run/current-system/sw. These packages are automatically available to all users, and are automatically updated every time you rebuild the system configuration. (The latter is the main difference with installing them in the default profile, /nix/var/nix/profiles/default.

Default: [ ]

Example: "[ pkgs.icecat3 pkgs.thunderbird ]"

Declared by:

specifies unix odbc drivers to be registered at /etc/odbcinst.ini. Maybe you also want to add pkgs.unixODBC to the system path to get a command line client t connnect to odbc databases.

Default: [ ]

Example: "map (x : x.ini) (with pkgs.unixODBCDrivers; [ mysql psql psqlng ] )"

Declared by:

Contents of the "Dialer Defaults" section of /etc/wvdial.conf.

Default: ""

Example: "Init1 = AT+CGDCONT=1,\"IP\",\"internet.t-mobile\""

Declared by:

Default ppp settings for wvdial.

Default: "noipdefault\nusepeerdns\ndefaultroute\npersist\nnoauth\n"

Declared by:

List of packages added to the system when the X server is activated (services.xserver.enable).

Default: [ ]

Declared by:

The file systems to be mounted. It must include an entry for the root directory (mountPoint = \"/\"). Each entry in the list is an attribute set with the following fields: mountPoint, device, fsType (a file system type recognised by mount; defaults to \"auto\"), and options (the mount options passed to mount using the -o flag; defaults to \"defaults\"). Instead of specifying device, you can also specify a volume label (label) for file systems that support it, such as ext2/ext3 (see mke2fs -L).

Default: none

Example: { / = { device = "/dev/hda1"; } ; /bigdisk = { label = "bigdisk"; } ; /data = { device = "/dev/hda2"; fsType = "ext3"; options = "data=journal"; } ; }

Declared by:

If the device does not currently contain a filesystem (as determined by blkid, then automatically format it with the filesystem type specified in fsType. Use with caution.

Default: false

Declared by:

Location of the device.

Default:

Example: "/dev/sda"

Declared by:

Type of the file system.

Default: "auto"

Example: "ext3"

Declared by:

Label of the device (if any).

Default:

Example: "root-partition"

Declared by:

Location of the mounted the file system.

Default: none

Example: "/mnt/usb"

Declared by:

If set, this file system will be mounted in the initial ramdisk. By default, this applies to the root file system and to the file system containing /nix/store.

Default: false

Declared by:

Disable running fsck on this filesystem.

Default: false

Declared by:

Options used to mount the file system.

Default: "defaults,relatime"

Example: "data=journal"

Declared by:

Whether to include Microsoft's proprietary Core Fonts. These fonts are redistributable, but only verbatim, among other restrictions. See http://corefonts.sourceforge.net/eula.htm for details.

Default: false

Declared by:

If enabled, a Fontconfig configuration file will be built pointing to a set of default fonts. If you don't care about running X11 applications or any other program that uses Fontconfig, you can turn this option off and prevent a dependency on all those fonts.

Default: true

Declared by:

Whether to create a directory with links to all fonts in share - so user can configure vncserver script one time (I mean per-user vncserver, so global service is not a good solution).

Default: false

Declared by:

Whether to add the fonts provided by Ghostscript (such as various URW fonts and the ``Base-14'' Postscript fonts) to the list of system fonts, making them available to X11 applications.

Default: false

Declared by:

List of packages with additional fonts.

Default: [ ]

Example: [ (build of dejavu-fonts-2.33) ]

Declared by:

List of primary font paths.

Default: [ "~/.fonts" "~/.nix-profile/lib/X11/fonts" "~/.nix-profile/share/fonts" "/nix/var/nix/profiles/default/lib/X11/fonts" "/nix/var/nix/profiles/default/share/fonts" ]

Declared by:

When enable, GNU software is chosent by default whenever a there is a choice between GNU and non-GNU software (e.g., GNU lsh vs. OpenSSH).

Default: false

Declared by:

Whether to enable support for Bluetooth.

Default: false

Declared by:

Update the CPU microcode for Amd processors.

Default: false

Declared by:

Update the CPU microcode for Intel processors.

Default: false

Declared by:

Turn on this option if you want to enable all the firmware shipped with Debian/Ubuntu.

Default: false

Declared by:

List of directories containing firmware files. Such files will be loaded automatically if the kernel asks for them (i.e., when it has detected specific hardware that requires firmware to function). If more than one path contains a firmware file with the same name, the first path in the list takes precedence. Note that you must rebuild your system if you add files to any of these directories. For quick testing, put firmware files in /root/test-firmware and add that directory to the list. Note that you can also add firmware packages to this list as these are directories in the nix store.

Default: [ ]

Example: [ "/root/my-firmware" ]

Declared by:

completely disable the nvidia gfx chip (saves power / heat) and just use IGP

Default: false

Declared by:

Path to the configuration file which map the memory, irq and ports used by the PCMCIA hardware.

Default:

Declared by:

Enable this option to support PCMCIA card.

Default: false

Declared by:

List of firmware used to handle specific PCMCIA card.

Default: [ ]

Declared by:

The path to the configuration the PulseAudio server should use. By default, the "default.pa" configuration from the PulseAudio distribution is used.

Default: "/nix/store/54gjhgib22a09kmdmkyah6v9ly270fsq-pulseaudio-2.1/etc/pulse/default.pa"

Declared by:

Whether to enable the PulseAudio sound server.

Default: false

Declared by:

The PulseAudio derivation to use. This can be used to enable features (such as JACK support) that are not enabled in the default PulseAudio in Nixpkgs.

Default: (build of pulseaudio-2.1)

Example: "pulseaudio.override { jackaudioSupport = true; }"

Declared by:

If false, a PulseAudio server is launched automatically for each user that tries to use the sound system. The server runs with user priviliges. This is the recommended and most secure way to use PulseAudio. If true, one system-wide PulseAudio server is launched on boot, running as the user "pulse". Please read the PulseAudio documentation for more details.

Default: false

Declared by:

Enable support for SANE scanners.

Default: false

Declared by:

Use a development snapshot of SANE scanner drivers.

Default: false

Declared by:

The font used for the virtual consoles. Leave empty to use whatever the setfont program considers the default font.

Default: "lat9w-16"

Example: "LatArCyrHeb-16"

Declared by:

The keyboard mapping table for the virtual consoles.

Default: "us"

Example: "fr"

Declared by:

The default locale. It determines the language for program messages, the format for dates and times, sort order, and so on. It also determines the character set, such as UTF-8.

Default: "en_US.UTF-8"

Example: "nl_NL.UTF-8"

Declared by:

List of locales that the system should support. The value "all" means that all locales supported by Glibc will be installed. A full list of supported locales can be found at http://sourceware.org/cgi-bin/cvsweb.cgi/libc/localedata/SUPPORTED?cvsroot=glibc.

Default: [ "all" ]

Example: [ "en_US.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "nl_NL/ISO-8859-1" ]

Declared by:

The group IDs used in NixOS.

Default: none

Declared by:

The user IDs used in NixOS.

Default: none

Declared by:

Enable the installation of graphical tools.

Default: false

Example: true

Declared by:

This option defines the system jobs started and managed by the Upstart daemon.

Default: { }

Declared by:

If the specified units are started at the same time as this unit, delay this unit until they have started.

Default: [ ]

Declared by:

If the specified units are started at the same time as this unit, delay them until this unit has started.

Default: [ ]

Declared by:

Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.

Default: [ ]

Declared by:

Determines how Upstart detects when a daemon should be considered “running”. The value none means that the daemon is considered ready immediately. The value fork means that the daemon will fork once. The value daemon means that the daemon will fork twice. The value stop means that the daemon will raise the SIGSTOP signal to indicate readiness.

Default: "none"

Declared by:

Description of this unit used in systemd messages and progress indicators.

Default: ""

Declared by:

If set to false, this unit will be a symlink to /dev/null. This is primarily useful to prevent specific template instances (e.g. serial-getty@ttyS0) from being started.

Default: true

Declared by:

Environment variables passed to the services's processes.

Default: { }

Example: { LANG = "nl_NL.UTF-8"; PATH = "/foo/bar/bin"; }

Declared by:

Command to start the job's main process. If empty, the job has no main process, but can still have pre/post-start and pre/post-stop scripts, and is considered “running” until it is stopped.

Default: ""

Declared by:

Name of the Upstart job.

Default: none

Example: "sshd"

Declared by:

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

Default: [ ]

Declared by:

Packages added to the job's PATH environment variable. Both the bin and sbin subdirectories of each package are added.

Default: [ ]

Declared by:

Shell commands executed after the job is started (i.e. after the job's main process is started), but before the job is considered “running”.

Default: ""

Declared by:

Shell commands executed after the job has stopped (i.e. after the job's main process has terminated).

Default: ""

Declared by:

Shell commands executed before the service's main process is started.

Default: ""

Declared by:

Shell commands executed before the job is stopped (i.e. before Upstart kills the job's main process). This can be used to cleanly shut down a daemon.

Default: ""

Declared by:

Units that require (i.e. depend on and need to go down with) this unit.

Default: [ ]

Declared by:

Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail.

Default: [ ]

Declared by:

Whether to restart the job automatically if its process ends unexpectedly.

Default: true

Declared by:

Whether the service should be restarted during a NixOS configuration switch if its definition has changed.

Default: true

Declared by:

An arbitrary list of items such as derivations. If any item in the list changes between reconfigurations, the service will be restarted.

Default: [ ]

Declared by:

Shell commands executed as the service's main process.

Default: ""

Declared by:

Arguments passed to the main process script.

Default: ""

Declared by:

Each attribute in this set specifies an option in the [Service] section of the unit. See systemd.service(5) for details.

Default: { }

Example: { RestartSec = 5; StartLimitInterval = 10; }

Declared by:

Run the daemon as a different group.

Default: ""

Declared by:

Run the daemon as a different user.

Default: ""

Declared by:

The Upstart event that triggers this job to be started. If empty, the job will not start automatically.

Default: ""

Declared by:

If set, a changed unit is restarted by calling systemctl stop in the old configuration, then systemctl start in the new one. Otherwise, it is restarted in a single step using systemctl restart in the new configuration. The latter is less correct because it runs the ExecStop commands from the new configuration.

Default: true

Declared by:

The Upstart event that triggers this job to be stopped.

Default: "starting shutdown"

Declared by:

Whether this job is a task rather than a service. Tasks are executed only once, while services are restarted when they exit.

Default: false

Declared by:

Generated definition of the systemd unit corresponding to this job.

Default: { after = [ ] ; before = [ ] ; description = ""; environment = { } ; partOf = [ ] ; path = [ ] ; requires = [ ] ; restartIfChanged = true; serviceConfig = { RemainAfterExit = true; Restart = "always"; Type = "oneshot"; } ; unitConfig = { } ; wantedBy = [ ] ; wants = [ ] ; }

Declared by:

Each attribute in this set specifies an option in the [Unit] section of the unit. See systemd.unit(5) for details.

Default: { }

Example: { RequiresMountsFor = "/data"; }

Declared by:

Units that want (i.e. depend on) this unit.

Default: [ ]

Declared by:

Start the specified units when this unit is started.

Default: [ ]

Declared by:

Deprecated name of environment.kdePackages.

Default: none

Declared by:

Default realm.

Default: "ATENA.MIT.EDU"

Declared by:

Default domain realm.

Default: "atena.mit.edu"

Declared by:

Whether to enable Kerberos V.

Default: false

Declared by:

Kerberos Domain Controller

Default: "kerberos.mit.edu"

Declared by:

Kerberos Admin Server

Default: "kerberos.mit.edu"

Declared by:

This option allows modules to define helper functions, constants, etc.

Default: { }

Declared by:

Additional configurations to build.

Default: [ ]

Declared by:

Additional configurations to build based on the current configuration which is has a lower priority.

Default: [ ]

Declared by:

Obsolete. Use networking.wireless.interfaces instead.

Default: ""

Declared by:

This option allows you to define Ethernet bridge devices that connect physical networks together. The value of this option is an attribute set. Each attribute specifies a bridge, with the attribute name specifying the name of the bridge's network interface.

Default: { }

Example: { br0 = { interfaces = [ "eth0" "eth1" ] ; } ; br1 = { interfaces = [ "eth2" "wlan0" ] ; } ; }

Declared by:

The physical network interfaces connected by the bridge.

Default: none

Example: [ "eth0" "eth1" ]

Declared by:

The default gateway. It can be left empty if it is auto-detected through DHCP.

Default: ""

Example: "131.211.84.1"

Declared by:

The window size of the default gateway. It limits maximal data bursts that TCP peers are allowed to send to us.

Default:

Example: 524288

Declared by:

Use the trivial Mail Transfer Agent (MTA) ssmtp package to allow programs to send e-mail. If you don't want to run a ``real'' MTA like sendmail or postfix on your machine, set this option to true, and set the option networking.defaultMailServer.hostName to the host name of your preferred mail server.

Default: false

Example: true

Declared by:

The domain from which mail will appear to be sent.

Default: ""

Example: "example.org"

Declared by:

The host name of the default mail server to use to deliver e-mail.

Default: none

Example: "mail.example.org"

Declared by:

Whether the STARTTLS should be used to connect to the default mail server. (This is needed for TLS-capable mail servers running on the default SMTP port 25.)

Default: false

Example: true

Declared by:

Whether TLS should be used to connect to the default mail server.

Default: false

Example: true

Declared by:

Disable the DHCP client for any interface which's name matches any of the shell glob patterns in this list. The purpose of this option is blacklist virtual interfaces such as those created by Xen, libvirt, LXC, etc.

Default: [ ]

Declared by:

Recent versions of glibc will issue both ipv4 (A) and ipv6 (AAAA) address queries at the same time, from the same port. Sometimes upstream routers will systemically drop the ipv4 queries. The symptom of this problem is that 'getent hosts example.com' only returns ipv6 (or perhaps only ipv4) addresses. The workaround for this is to specify the option 'single-request' in /etc/resolv.conf. This option enables that.

Default: false

Declared by:

The domain. It can be left empty if it is auto-detected through DHCP.

Default: ""

Example: "home"

Declared by:

Turn on this option if you want firmware for the NICs supported by the b43 module.

Default: false

Declared by:

Whether to enable support for IPv6.

Default: true

Declared by:

Turn on this option if you want firmware for the Intel PRO/Wireless 2100BG to be loaded automatically. This is required if you want to use this device. Intel requires you to accept the license for this firmware, see http://ipw2100.sourceforge.net/firmware.php?fid=2.

Default: false

Declared by:

Turn on this option if you want firmware for the Intel PRO/Wireless 2200BG to be loaded automatically. This is required if you want to use this device. Intel requires you to accept the license for this firmware, see http://ipw2200.sourceforge.net/firmware.php?fid=7.

Default: false

Declared by:

This option enables automatic loading of the firmware for the Intel PRO/Wireless 3945ABG.

Default: false

Declared by:

Obsolete name of networking.enableRalinkFirmware.

Default: none

Declared by:

Turn on this option if you want firmware for the RTL8192c (and related) NICs.

Default: false

Declared by:

Turn on this option if you want firmware for the RT73 NIC

Default: false

Declared by:

Obsolete name of networking.wireless.enable.

Default: none

Declared by:

Additional entries to be appended to /etc/hosts.

Default: ""

Example: "192.168.0.1 lanlocalhost"

Declared by:

Whether to respond to incoming ICMPv4 echo requests ("pings"). ICMPv6 pings are always allowed because the larger address space of IPv6 makes network scanning much less effective.

Default: false

Declared by:

List of TCP ports on which incoming connections are accepted.

Default: [ ]

Example: [ 22 80 ]

Declared by:

List of open UDP ports.

Default: [ ]

Example: [ 53 ]

Declared by:

Whether to auto-load connection-tracking helpers. See the description at networking.firewall.connectionTrackingModules (needs kernel 3.5+)

Default: true

Declared by:

Performs a reverse path filter test on a packet. If a reply to the packet would not be sent via the same interface that the packet arrived on, it is refused. If using asymmetric routing or other complicated routing, disable this setting and setup your own counter-measures. (needs kernel 3.3+)

Default: false

Declared by:

List of connection-tracking helpers that are auto-loaded. The complete list of possible values is given in the example. As helpers can pose as a security risk, it is adviced to set this to an empty list and disable the setting networking.firewall.autoLoadConntrackHelpers Loading of helpers is recommended to be done through the new CT target. More info: https://home.regit.org/netfilter-en/secure-use-of-helpers/

Default: [ "ftp" ]

Example: [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ]

Declared by:

Whether to enable the firewall. This is a simple stateful firewall that blocks connection attempts to unauthorised TCP or UDP ports on this machine. It does not affect packet forwarding.

Default: false

Declared by:

Additional shell commands executed as part of the firewall initialisation script. These are executed just before the final "reject" firewall rule is added, so they can be used to allow packets that would otherwise be refused.

Default: ""

Example: "iptables -A INPUT -p icmp -j ACCEPT"

Declared by:

Whether to log rejected or dropped incoming connections.

Default: true

Declared by:

Whether to log all rejected or dropped incoming packets. This tends to give a lot of log messages, so it's mostly useful for debugging.

Default: false

Declared by:

If networking.firewall.logRefusedPackets and this option are enabled, then only log packets specifically directed at this machine, i.e., not broadcasts or multicasts.

Default: true

Declared by:

If set, forbidden packets are rejected rather than dropped (ignored). This means that a ICMP "port unreachable" error message is sent back to the client. Rejecting packets makes port scanning somewhat easier.

Default: false

Declared by:

Traffic coming in from these interfaces will be accepted unconditionally.

Default: none

Declared by:

The name of the machine. Leave it empty if you want to obtain it from a DHCP server (if using DHCP).

Default: "nixos"

Declared by:

If true, beep when an Ethernet cable is plugged in or unplugged.

Default: false

Declared by:

Shell commands to be executed when the link status of an interface changes. On invocation, the shell variable iface contains the name of the interface, while the variable status contains either up or down to indicate the new status.

Default: ""

Declared by:

If true, monitor Ethernet interfaces for cables being plugged in or unplugged. When this occurs, the dhclient service is restarted to automatically obtain a new IP address. This is useful for roaming users (laptops).

Default: false

Declared by:

The configuration for each network interface. If networking.useDHCP is true, then every interface not listed here will be configured using DHCP.

Default: { }

Example: { eth0 = { ipAddress = "131.211.84.78"; subnetMask = "255.255.255.128"; } ; }

Declared by:

IP address of the interface. Leave empty to configure the interface using DHCP.

Default:

Example: "10.0.0.1"

Declared by:

MAC address of the interface. Leave empty to use the default.

Default:

Example: "00:11:22:33:44:55"

Declared by:

Name of the interface.

Default: none

Example: "eth0"

Declared by:

Subnet mask of the interface, specified as the number of bits in the prefix (24).

Default:

Example: 24

Declared by:

Turn on proxy_arp for this device (and proxy_ndp for ipv6). This is mainly useful for creating pseudo-bridges between a real interface and a virtual network such as VPN or a virtual machine for interfaces that don't support real bridging (most wlan interfaces). As ARP proxying acts slightly above the link-layer, below-ip traffic isn't bridged, so things like DHCP won't work. The advantage above using NAT lies in the fact that no IP addresses are shared, so all hosts are reachable/routeable. WARNING: turns on ip-routing, so if you have multiple interfaces, you should think of the consequence and setup firewall rules to limit this.

Default: false

Declared by:

Subnet mask of the interface, specified as a bitmask. This is deprecated; use prefixLength instead.

Default: ""

Example: "255.255.255.0"

Declared by:

Whether this interface is virtual and should be created by tunctl. This is mainly useful for creating bridges between a host a virtual network such as VPN or a virtual machine. Defaults to tap device, unless interface contains "tun" in its name.

Default: false

Declared by:

In case of a virtual device, the user who owns it.

Default: "root"

Declared by:

Shell commands to be executed at the end of the network-setup systemd service. Note that if you are using DHCP to obtain the network configuration, interfaces may not be fully configured yet.

Default: ""

Example: "text=anything; echo You can put $text here."

Declared by:

The list of nameservers. It can be left empty if it is auto-detected through DHCP.

Default: [ ]

Example: [ "130.161.158.4" "130.161.33.17" ]

Declared by:

Whether to enable Network Address Translation (NAT).

Default: false

Declared by:

The public IP address to which packets from the local network are to be rewritten. If this is left empty, the IP address associated with the external interface will be used.

Default: ""

Example: "203.0.113.123"

Declared by:

The name of the external network interface.

Default: none

Example: "eth1"

Declared by:

The IP address ranges for which to perform NAT. Packets coming from these networks and destined for the external interface will be rewritten.

Default: none

Example: [ "192.168.1.0/24" ]

Declared by:

Whether to use NetworkManager to obtain an IP adress and other configuration for all network interfaces that are not manually configured. If enabled, a group networkmanager will be created. Add all users that should have permission to change network settings to this group.

Default: false

Declared by:

Extra packages that provide NetworkManager plugins.

Default: [ ]

Declared by:

Whether to use DHCP to obtain an IP adress and other configuration for all network interfaces that are not manually configured.

Default: true

Declared by:

Whether to assign predictable names to network interfaces. If enabled, interfaces are assigned names that contain topology information (e.g. wlp3s0) and thus should be stable across reboots. If disabled, names depend on the order in which interfaces are discovered by the kernel, which may change randomly across reboots; for instance, you may find eth0 and eth1 flipping unpredictably.

Default: true

Declared by:

Whether to start wicd. Wired and wireless network configurations can then be managed by wicd-client.

Default: false

Declared by:

Force a specific wpa_supplicant driver.

Default: "nl80211,wext"

Declared by:

Whether to start wpa_supplicant to scan for and associate with wireless networks. Note: NixOS currently does not generate wpa_supplicant's configuration file, /etc/wpa_supplicant.conf. You should edit this file yourself to define wireless networks, WPA keys and so on (see wpa_supplicant.conf(5)).

Default: false

Declared by:

The interfaces wpa_supplicant will use. If empty, it will automatically use all wireless interfaces. (Note that auto-detection is currently broken on Linux 3.4.x kernels. See http://github.com/NixOS/nixos/issues/10 for further details.)

Default: [ ]

Example: [ "wlan0" "wlan1" ]

Declared by:

Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli. This is useful for laptop users that switch networks a lot. When you want to use this, make sure /etc/wpa_supplicant.conf doesn't exist. It will be created for you. Currently it is also necessary to explicitly specify networking.wireless.interfaces.

Default: false

Declared by:

Members of this group can control wpa_supplicant.

Default: "wheel"

Example: "network"

Declared by:

List of binary cache URLs used to obtain pre-built binaries of Nix packages.

Default: [ "http://nixos.org/binary-cache" ]

Declared by:

This option lists the machines to be used if distributed builds are enabled (see nix.distributedBuilds). Nix will perform derivations on those machines via SSh by copying the inputs to the Nix store on the remote machine, starting the build, then copying the output back to the local Nix store. Each element of the list should be an attribute set containing the machine's host name (hostname), the user name to be used for the SSH connection (sshUser), the Nix system type (system, e.g., "i686-linux"), the maximum number of jobs to be run in parallel on that machine (maxJobs), and the path to the SSH private key to be used to connect (sshKey). The SSH private key should not have a passphrase, and the corresponding public key should be added to ~sshUser/authorized_keys on the remote machine.

Default: none

Example: [ { hostName = "voila.labs.cs.uu.nl"; maxJobs = 1; sshKey = "/root/.ssh/id_buildfarm"; sshUser = "nix"; system = "powerpc-darwin"; } { hostName = "linux64.example.org"; maxJobs = 2; sshKey = "/root/.ssh/id_buildfarm"; sshUser = "buildfarm"; system = "x86_64-linux"; } ]

Declared by:

Directories from the host filesystem to be included in the chroot.

Default: [ ]

Example: [ "/dev" "/proc" ]

Declared by:

Nix daemon process I/O priority. This priority propagates to build processes. 0 is the default Unix process I/O priority, 7 is the lowest.

Default: 7

Declared by:

Nix daemon process priority. This priority propagates to build processes. 0 is the default Unix process priority, 20 is the lowest.

Default: 10

Declared by:

Whether to distribute builds to the machines listed in nix.buildMachines. If you know that the buildMachines are not always available either use nixos nixos-rebuild --no-build-hook or consider managing /etc/nix.machines manually by setting manualNixMachines. Then you can comment unavailable buildmachines.

Default: false

Declared by:

Environment variables used by Nix.

Default: { }

Declared by:

Additional text appended to nix.conf.

Default: ""

Example: "\n gc-keep-outputs = true\n gc-keep-derivations = true\n "

Declared by:

Automatically run the garbage collector at a specific time.

Default: false

Declared by:

Specification (in the format described by systemd.time(5)) of the time at which the garbage collector will run.

Default: "03:15"

Declared by:

Options given to nix-collect-garbage when the garbage collector is run automatically.

Default: ""

Example: "--max-freed $((64 * 1024**3))"

Declared by:

Whether to manually manage the list of buildmachines used in distributed builds in /etc/nix.machines.

Default: false

Declared by:

This option defines the maximum number of jobs that Nix will try to build in parallel. The default is 1. You should generally set it to the number of CPUs in your system (e.g., 2 on a Athlon 64 X2).

Default: 1

Example: 2

Declared by:

Number of nixbld user accounts created to perform secure concurrent builds. If you receive an error message saying that “all build users are currently in use”, you should increase this value.

Default: 10

Declared by:

This option specifies the proxy to use for fetchurl. The real effect is just exporting http_proxy, https_proxy and ftp_proxy with that value.

Default: ""

Example: "http://127.0.0.1:3128"

Declared by:

If set, NixOS will enforce the immutability of the Nix store by making /nix/store a read-only bind mount. Nix will automatically make the store writable when needed.

Default: true

Declared by:

List of binary cache URLs that non-root users can use (in addition to those specified using nix.binaryCaches by passing --option binary-caches to Nix commands.

Default: [ ]

Example: [ "http://hydra.nixos.org/" ]

Declared by:

If set, Nix will perform builds in a chroot-environment that it will set up automatically for each build. This prevents impurities in builds by disallowing access to dependencies outside of the Nix store.

Default: false

Example: true

Declared by:

The configuration of the Nix Packages collection. (For details, see the Nixpkgs documentation.) It allows you to set package configuration options, and to override packages globally through the packageOverrides option. The latter is a function that takes as an argument the original Nixpkgs, and must evaluate to a set of new or overriden packages.

Default: { }

Example:

{ firefox.enableGeckoMediaPlayer = true;
  packageOverrides = pkgs: {
    firefox60Pkgs = pkgs.firefox60Pkgs.override {
      enableOfficialBranding = true;
    };
  };
}

Declared by:

Specifies the Nix platform type for which NixOS should be built. If unset, it defaults to the platform type of your host system (x86_64-linux). Specifying this option is useful when doing distributed multi-platform deployment, or when building virtual machines.

Default: "x86_64-linux"

Declared by:

This attribute set will be exported as a system attribute. You can put whatever you want here.

Default: none

Declared by:

Enables support for Power Devices, such as Uninterruptible Power Supplies, Power Distribution Units and Solar Controllers.

Default: false

Declared by:

This can be set as a global variable above your first UPS definition and it can also be set in a UPS section. This value controls how long upsdrvctl will wait for the driver to finish starting. This keeps your system from getting stuck due to a broken driver or UPS.

Default: 45

Declared by:

The MODE determines which part of the NUT is to be started, and which configuration files must be modified. The values of MODE can be: - none: NUT is not configured, or use the Integrated Power Management, or use some external system to startup NUT components. So nothing is to be started. - standalone: This mode address a local only configuration, with 1 UPS protecting the local system. This implies to start the 3 NUT layers (driver, upsd and upsmon) and the matching configuration files. This mode can also address UPS redundancy. - netserver: same as for the standalone configuration, but also need some more ACLs and possibly a specific LISTEN directive in upsd.conf. Since this MODE is opened to the network, a special care should be applied to security concerns. - netclient: this mode only requires upsmon.

Default: "standalone"

Declared by:

File which contains the rules to handle UPS events.

Default: none

Example: "/etc/nixos/upssched.conf"

Declared by:

This is where you configure all the UPSes that this system will be monitoring directly. These are usually attached to serial ports, but USB devices are also supported.

Default: { }

Declared by:

Description of the UPS.

Default: ""

Declared by:

List of configuration directives for this UPS.

Default: [ ]

Declared by:

Specify the program to run to talk to this UPS. apcsmart, bestups, and sec are some examples.

Default: none

Declared by:

This can be set as a global variable above your first UPS definition and it can also be set in a UPS section. This value controls how long upsdrvctl will wait for the driver to finish starting. This keeps your system from getting stuck due to a broken driver or UPS.

Default:

Declared by:

The serial port where your UPS is connected. /dev/ttyS0 is usually the first port on Linux boxes, for example.

Default: none

Declared by:

When you have multiple UPSes on your system, you usually need to turn them off in a certain order. upsdrvctl shuts down all the 0s, then the 1s, 2s, and so on. To exclude a UPS from the shutdown sequence, set this to -1.

Default: 0

Declared by:

Lines which would be added inside ups.conf for handling this UPS.

Default: ""

Declared by:

Configure the governor used to regulate the frequence of the available CPUs. By default, the kernel configures the on-demand governor.

Default: ""

Example: "ondemand"

Declared by:

Whether to enable power management. This includes support for suspend-to-RAM and powersave features on laptops.

Default: true

Declared by:

Commands executed when the machine powers down. That is, they're executed both when the system shuts down and when it goes to suspend or hibernation.

Default: ""

Example: "/nix/store/hl2bngyv6ygn2qh5csrhc6mvs1nj2ck7-hdparm-9.39/sbin/hdparm -B 255 /dev/sda"

Declared by:

Commands executed when the machine powers up. That is, they're executed both when the system first boots and when it resumes from suspend or hibernation.

Default: ""

Example: "/nix/store/hl2bngyv6ygn2qh5csrhc6mvs1nj2ck7-hdparm-9.39/sbin/hdparm -B 255 /dev/sda"

Declared by:

Commands executed after the system resumes from suspend-to-RAM.

Default: ""

Declared by:

Configure the scsi link power management policy. By default, the kernel configures "max_performance".

Default: ""

Example: "min_power"

Declared by:

Whether to request X11 forwarding on outgoing connections by default. This is useful for running graphical programs on the remote machine and have them display to your local X11 server. Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two. Note: there are some security risks to forwarding an X11 connection. NixOS's X server is built with the SECURITY extension, which prevents some obvious attacks. To enable or disable forwarding on a per-connection basis, see the -X and -x options to ssh. The -Y option to ssh enables trusted forwarding, which bypasses the SECURITY extension.

Default: false

Declared by:

Whether to set the path to xauth for X11-forwarded connections. Pulls in X11 dependency.

Default: true

Declared by:

FIXME: find another place for this option. FIXME: find a good description.

Default: [ ]

Declared by:

Install AppArmor profiles for commonly-used SUID application to mitigate potential privilege escalation attacks due to bugs in such applications. Currently available profiles: ping

Default: true

Declared by:

Enable AppArmor application security system. Enable only if you want to further improve AppArmor.

Default: false

Declared by:

List of file names of AppArmor profiles.

Default: [ ]

Declared by:

Obsolete name of security.setuidPrograms.

Default: none

Declared by:

Enable the OTPW (one-time password) PAM module

Default: false

Declared by:

Enable sudo logins if the user's SSH agent provides a key present in ~/.ssh/authorized_keys. This allows machines to exclusively use SSH keys instead of passwords.

Default: false

Declared by:

Define resource limits that should apply to users or groups. Each item in the list should be an attribute set with a domain, type, item, and value attribute. The syntax and semantics of these attributes must be that described in the limits.conf(5) man page.

Default: [ ]

Example: [ { domain = "ftp"; item = "nproc"; type = "hard"; value = "0"; } { domain = "@student"; item = "maxlogins"; type = "-"; value = "4"; } ]

Declared by:

This option defines the PAM services. A service typically corresponds to a program that uses PAM, e.g. login or passwd. Each element of this list is an attribute set describing a service. The attribute name specifies the name of the service. The attribute rootOK specifies whether the root user is allowed to use this service without authentication. The attribute startSession specifies whether systemd's PAM connector module should be used to start a new session; for local sessions, this will give the user ownership of devices such as audio and CD-ROM drives. The attribute forwardXAuth specifies whether X authentication keys should be passed from the calling user to the target user (e.g. for su). The attribute limits defines resource limits that should apply to users or groups for the service. Each item in the list should be an attribute set with a domain, type, item, and value attribute. The syntax and semantics of these attributes must be that described in the limits.conf(5) man page.

Default: [ ]

Example: [ { name = "chsh"; rootOK = true; } { allowNullPassword = true; limits = [ { domain = "ftp"; item = "nproc"; type = "hard"; value = "0"; } ] ; name = "login"; startSession = true; } ]

Declared by:

Enable USB login for all login system unless the service disabled it. For more information, visit http://pamusb.org/doc/quickstart#setting_up.

Default: false

Declared by:

Specifies which users are considered “administrators”, for those actions that require the user to authenticate as an administrator (i.e. have a auth_admin value). By default, this is the root user and all users in the wheel group.

Default: "unix-user:0;unix-group:wheel"

Example: ""

Declared by:

Whether to enable PolKit.

Default: true

Declared by:

Allows the default permissions of privileged actions to be overriden.

Default: ""

Example: "[Disallow Users To Suspend]\nIdentity=unix-group:users\nAction=org.freedesktop.upower.*\nResultAny=no\nResultInactive=no\nResultActive=no\n\n[Allow Anybody To Eject Disks]\nIdentity=unix-user:*\nAction=org.freedesktop.udisks.drive-eject\nResultAny=yes\nResultInactive=yes\nResultActive=yes\n\n[Allow Alice To Mount Filesystems After Admin Authentication]\nIdentity=unix-user:alice\nAction=org.freedesktop.udisks.filesystem-mount\nResultAny=auth_admin\nResultInactive=auth_admin\nResultActive=auth_admin\n"

Declared by:

Whether to enable the rng daemon, which adds entropy from hardware sources of randomness to the kernel entropy pool when available.

Default: true

Declared by:

Whether to enable the RealtimeKit system service, which hands out realtime scheduling priority to user processes on demand. For example, the PulseAudio server uses this to acquire realtime priority.

Default: false

Declared by:

This option allows the ownership and permissions on the setuid wrappers for specific programs to be overriden from the default (setuid root, but not setgid root).

Default: [ ]

Example: [ { group = "postdrop"; owner = "nobody"; program = "sendmail"; setgid = true; setuid = false; } ]

Declared by:

The Nix store cannot contain setuid/setgid programs directly. For this reason, NixOS can automatically generate wrapper programs that have the necessary privileges. This option lists the names of programs in the system environment for which setuid root wrappers should be created.

Default: [ ]

Declared by:

This string contains the contents of the sudoers file.

Default: none

Declared by:

Whether to enable the sudo command, which allows non-root users to execute commands as root.

Default: true

Declared by:

Whether users of the wheel group can execute commands as super user without entering a password.

Default: true

Declared by:

This option defines the path to the setuid wrappers. It should generally not be overriden. Some packages in Nixpkgs expect that wrapperDir is /var/setuid-wrappers.

Default: "/var/setuid-wrappers"

Declared by:

Shell commands to execute on a ac_adapter.* event.

Default: ""

Declared by:

Whether to enable the ACPI daemon.

Default: false

Declared by:

Shell commands to execute on a button/lid.* event.

Default: ""

Declared by:

Shell commands to execute on a button/power.* event.

Default: ""

Declared by:

The base directory where ActiveMQ stores its persistent data and logs. This will be overriden if you set "activemq.base" and "activemq.data" in the javaProperties option. You can also override this in activemq.xml.

Default: "/var/activemq"

Declared by:

The base directory for ActiveMQ's configuration. By default, this directory is searched for a file named activemq.xml, which should contain the configuration for the broker service.

Default: "/nix/store/8ynbp17b6s8683dh68vbrcpdnamjx52h-apache-activemq-5.8.0/conf"

Declared by:

The URI that is passed along to the BrokerFactory to set up the configuration of the ActiveMQ broker service. You should not need to change this. For custom configuration, set the configurationDir instead, and create an activemq.xml configuration file in it.

Default: "xbean:activemq.xml"

Declared by:

Enable the Apache ActiveMQ message broker service.

Default: false

Declared by:

Add extra options here that you want to be sent to the Java runtime when the broker service is started.

Default: ""

Example: "-Xmx2G -Xms2G -XX:MaxPermSize=512M"

Declared by:

Specifies Java properties that are sent to the ActiveMQ broker service with the "-D" option. You can set properties here to change the behaviour and configuration of the broker. All essential properties that are not set here are automatically given reasonable defaults.

Default: { }

Example: { java.net.preferIPv4Stack = "true"; }

Declared by:

If true, the a system user with the specified name will be added to the system configuration. If false, a user with the specified name is expected to exist.

Default: true

Declared by:

The name of the user that should run the ActiveMQ process.

Default: "activemq"

Declared by:

IP/Hostname for Director to connect with bconsole.

Default: "127.0.0.1"

Declared by:

Name of the Director to connect with bconsole.

Default: none

Declared by:

Password for Director to connect with bconsole.

Default: none

Declared by:

Port for Director to connect with bconsole.

Default: 9101

Declared by:

Enable Almir web server. Also configures postgresql database and installs bacula.

Default: false

Declared by:

Port for Almir web server to listen on.

Default: 35000

Declared by:

Define SQL database connection to bacula catalog as specified in http://docs.sqlalchemy.org/en/latest/core/engines.html#database-urls

Default: none

Example: "postgresql://bacula:bacula@localhost:5432/bacula\nmysql+mysqlconnector://<user>:<password>@<hostname>/<database>'\nsqlite:////var/lib/bacula/bacula.db'\n"

Declared by:

Timezone as specified in https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

Default: none

Example: "Europe/Ljubljana"

Declared by:

The directory holding configuration, incoming and temporary files.

Default: "/home/amule/"