appstream.enable

Whether to install files to support the AppStream metadata specification.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/appstream.nix>
boot.enableContainers

Whether to enable support for NixOS containers.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
boot.binfmt.emulatedSystems

List of systems to emulate. Will also configure Nix to support your new systems.

Type: list of strings

Default: [ ]

Example: [ "wasm32-wasi" "x86_64-windows" "aarch64-linux" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations

Extra binary formats to register with the kernel. See https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html for more details.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.fixBinary

Whether to open the interpreter file as soon as the registration is loaded, rather than waiting for a relevant file to be invoked.

See the description of the 'F' flag in the kernel docs for more details.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.interpreter

The interpreter to invoke to run the program.

Note that the actual registration will point to /run/binfmt/${name}, so the kernel interpreter length limit doesn't apply.

Type: path

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.magicOrExtension

The magic number or extension to match on.

Type: string

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.mask

A mask to be ANDed with the byte sequence of the file before matching

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.matchCredentials

Whether to launch with the credentials and security token of the binary, not the interpreter (e.g. setuid bit).

See the description of the 'C' flag in the kernel docs for more details.

Implies/requires openBinary = true.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.offset

The byte offset of the magic number used for recognition.

Type: null or signed integer

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.openBinary

Whether to pass the binary to the interpreter as an open file descriptor, instead of a path.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.preserveArgvZero

Whether to pass the original argv[0] to the interpreter.

See the description of the 'P' flag in the kernel docs for more details;

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.binfmt.registrations.<name>.recognitionType

Whether to recognize executables by magic number or extension.

Type: one of "magic", "extension"

Default: "magic"

Declared by:

<nixpkgs/nixos/modules/system/boot/binfmt.nix>
boot.blacklistedKernelModules

List of names of kernel modules that should not be loaded automatically by the hardware probing code.

Type: list of strings

Default: [ ]

Example: [ "cirrusfb" "i2c_piix4" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/modprobe.nix>
boot.cleanTmpDir

Whether to delete all files in /tmp during boot.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/tmp.nix>
boot.consoleLogLevel

The kernel console loglevel. All Kernel Messages with a log level smaller than this setting will be printed to the console.

Type: signed integer

Default: 4

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.crashDump.enable

If enabled, NixOS will set up a kernel that will boot on crash, and leave the user in systemd rescue to be able to save the crashed kernel dump at /proc/vmcore. It also activates the NMI watchdog.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/misc/crashdump.nix>
boot.crashDump.kernelParams

Parameters that will be passed to the kernel kexec-ed on crash.

Type: list of strings

Default: [ "1" "boot.shell_on_fail" ]

Declared by:

<nixpkgs/nixos/modules/misc/crashdump.nix>
boot.crashDump.reservedMemory

The amount of memory reserved for the crashdump kernel. If you choose a too high value, dmesg will mention "crashkernel reservation failed".

Type: unspecified

Default: "128M"

Declared by:

<nixpkgs/nixos/modules/misc/crashdump.nix>
boot.devShmSize

Size limit for the /dev/shm tmpfs. Look at mount(8), tmpfs size option, for the accepted syntax.

Type: string

Default: "50%"

Example: "256m"

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-2.nix>
boot.devSize

Size limit for the /dev tmpfs. Look at mount(8), tmpfs size option, for the accepted syntax.

Type: string

Default: "5%"

Example: "32m"

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-2.nix>
boot.extraModprobeConfig

Any additional configuration to be appended to the generated modprobe.conf. This is typically used to specify module options. See modprobe.conf(5) for details.

Type: strings concatenated with "\n"

Default: ""

Example:

''
options parport_pc io=0x378 irq=7 dma=1
''

Declared by:

<nixpkgs/nixos/modules/system/boot/modprobe.nix>
boot.extraModulePackages

A list of additional packages supplying kernel modules.

Type: list of packages

Default: [ ]

Example:

[ config.boot.kernelPackages.nvidia_x11 ]

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.growPartition

Whether to enable grow the root partition on boot.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/system/boot/grow-partition.nix>
boot.hardwareScan

Whether to try to load kernel modules for all detected hardware. Usually this does a good job of providing you with the modules you need, but sometimes it can crash the system or cause other nasty effects.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/udev.nix>
boot.initrd.availableKernelModules

The set of kernel modules in the initial ramdisk used during the boot process. This set must include all modules necessary for mounting the root device. That is, it should include modules for the physical device (e.g., SCSI drivers) and for the file system (e.g., ext3). The set specified here is automatically closed under the module dependency relation, i.e., all dependencies of the modules list here are included automatically. The modules listed here are available in the initrd, but are only loaded on demand (e.g., the ext3 module is loaded automatically when an ext3 filesystem is mounted, and modules for PCI devices are loaded when they match the PCI ID of a device in your system). To force a module to be loaded, include it in boot.initrd.kernelModules.

Type: list of strings

Default: [ ]

Example: [ "sata_nv" "ext3" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.initrd.checkJournalingFS

Whether to run fsck on journaling filesystems such as ext3.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.kernelModules

List of modules that are always loaded by the initrd.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.initrd.luks.cryptoModules

A list of cryptographic kernel modules needed to decrypt the root device(s). The default includes all common modules.

Type: list of strings

Default: [ "aes" "aes_generic" "blowfish" "twofish" "serpent" "cbc" "xts" "lrw" "sha1" "sha256" "sha512" "af_alg" "algif_skcipher" "aes_x86_64" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices

The encrypted disk that should be opened before the root filesystem is mounted. Both LVM-over-LUKS and LUKS-over-LVM setups are supported. The unencrypted devices can be accessed as /dev/mapper/name.

Type: list or attribute set of submodules

Default: { }

Example: { luksroot = { device = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08"; } ; }

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.allowDiscards

Whether to allow TRIM requests to the underlying device. This option has security implications; please read the LUKS documentation before activating it.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.device

Path of the underlying encrypted block device.

Type: string

Example: "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.fallbackToPassword

Whether to fallback to interactive passphrase prompt if the keyfile cannot be found. This will prevent unattended boot should the keyfile go missing.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.fido2.credential

The FIDO2 credential ID.

Type: string

Default: null

Example: "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.fido2.gracePeriod

Time in seconds to wait for the FIDO2 key.

Type: signed integer

Default: 10

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.fido2.passwordLess

Defines whatever to use an empty string as a default salt.

Enable only when your device is PIN protected, such as Trezor.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.gpgCard

The option to use this LUKS device with a GPG encrypted luks password by the GPG Smartcard. If null (the default), GPG-Smartcard will be disabled for this device.

Type: null or submodule

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.gpgCard.encryptedPass

Path to the GPG encrypted passphrase.

Type: path

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.gpgCard.gracePeriod

Time in seconds to wait for the GPG Smartcard.

Type: signed integer

Default: 10

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.gpgCard.publicKey

Path to the Public Key.

Type: path

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.header

The name of the file or block device that should be used as header for the encrypted device.

Type: null or string

Default: null

Example: "/root/header.img"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.keyFile

The name of the file (can be a raw device or a partition) that should be used as the decryption key for the encrypted device. If not specified, you will be prompted for a passphrase instead.

Type: null or string

Default: null

Example: "/dev/sdb1"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.keyFileOffset

The offset of the key file. Use this in combination with keyFileSize to use part of a file as key file (often the case if a raw device or partition is used as a key file). If not specified, the key begins at the first byte of keyFile.

Type: null or signed integer

Default: null

Example: 4096

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.keyFileSize

The size of the key file. Use this if only the beginning of the key file should be used as a key (often the case if a raw device or partition is used as key file). If not specified, the whole keyFile will be used decryption, instead of just the first keyFileSize bytes.

Type: null or signed integer

Default: null

Example: 4096

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.preLVM

Whether the luksOpen will be attempted before LVM scan or after it.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey

The options to use for this LUKS device in Yubikey-PBA. If null (the default), Yubikey-PBA will be disabled for this device.

Type: null or submodule

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.gracePeriod

Time in seconds to wait for the Yubikey.

Type: signed integer

Default: 10

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.iterationStep

How much the iteration count for PBKDF2 is increased at each successful authentication.

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.keyLength

Length of the LUKS slot key derived with PBKDF2 in byte.

Type: signed integer

Default: 64

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.saltLength

Length of the new salt in byte (64 is the effective maximum).

Type: signed integer

Default: 16

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.slot

Which slot on the Yubikey to challenge.

Type: signed integer

Default: 2

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.storage.device

An unencrypted device that will temporarily be mounted in stage-1. Must contain the current salt to create the challenge for this LUKS device.

Type: path

Default: "/dev/sda1"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.storage.fsType

The filesystem of the unencrypted device.

Type: string

Default: "vfat"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.storage.path

Absolute path of the salt on the unencrypted device with that device's root directory as "/".

Type: string

Default: "/crypt-storage/default"

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.devices.<name?>.yubikey.twoFactor

Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.fido2Support

Enables support for authenticating with FIDO2 devices.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.gpgSupport

Enables support for authenticating with a GPG encrypted password.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.mitigateDMAAttacks

Unless enabled, encryption keys can be easily recovered by an attacker with physical access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port. More information is available at http://en.wikipedia.org/wiki/DMA_attack.

This option blacklists FireWire drivers, but doesn't remove them. You can manually load the drivers if you need to use a FireWire device, but don't forget to unload them!

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.reusePassphrases

When opening a new LUKS device try reusing last successful passphrase.

Useful for mounting a number of devices that use the same passphrase without retyping it several times.

Such setup can be useful if you use cryptsetup luksSuspend. Different LUKS devices will still have different master keys even when using the same passphrase.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.luks.yubikeySupport

Enables support for authenticating with a Yubikey on LUKS devices. See the NixOS wiki for information on how to properly setup a LUKS device and a Yubikey to work with this feature.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/luksroot.nix>
boot.initrd.mdadmConf

Contents of /etc/mdadm.conf in stage 1.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.network.enable

Add network connectivity support to initrd. The network may be configured using the ip kernel parameter, as described in the kernel documentation. Otherwise, if networking.useDHCP is enabled, an IP address is acquired using DHCP.

You should add the module(s) required for your network card to boot.initrd.availableKernelModules. lspci -v | grep -iA8 'network\|ethernet' will tell you which.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-network.nix>
boot.initrd.network.postCommands

Shell commands to be executed after stage 1 of the boot has initialised the network.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-network.nix>
boot.initrd.network.ssh.enable

Start SSH service during initrd boot. It can be used to debug failing boot on a remote server, enter pasphrase for an encrypted partition etc. Service is killed when stage-1 boot is finished.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.ssh.authorizedKeys

Authorized keys for the root user on initrd. Note that Dropbear doesn't support OpenSSH's Ed25519 key type.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.ssh.hostDSSKey

DSS SSH private key file in the Dropbear format.

WARNING: Unless your bootloader supports initrd secrets, this key is contained insecurely in the global Nix store. Do NOT use your regular SSH host private keys for this purpose or you'll expose them to regular users!

Type: null or path

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.ssh.hostECDSAKey

ECDSA SSH private key file in the Dropbear format.

WARNING: Unless your bootloader supports initrd secrets, this key is contained insecurely in the global Nix store. Do NOT use your regular SSH host private keys for this purpose or you'll expose them to regular users!

Type: null or path

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.ssh.hostRSAKey

RSA SSH private key file in the Dropbear format.

WARNING: Unless your bootloader supports initrd secrets, this key is contained insecurely in the global Nix store. Do NOT use your regular SSH host private keys for this purpose or you'll expose them to regular users!

Type: null or path

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.ssh.port

Port on which SSH initrd service should listen.

Type: signed integer

Default: 22

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.ssh.shell

Login shell of the remote user. Can be used to limit actions user can do.

Type: string

Default: "/bin/ash"

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-ssh.nix>
boot.initrd.network.udhcpc.extraArgs

Additional command-line arguments passed verbatim to udhcpc if boot.initrd.network.enable and networking.useDHCP are enabled.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/boot/initrd-network.nix>
boot.initrd.postDeviceCommands

Shell commands to be executed immediately after stage 1 of the boot has loaded kernel modules and created device nodes in /dev.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.postMountCommands

Shell commands to be executed immediately after the stage 1 filesystems have been mounted.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.preDeviceCommands

Shell commands to be executed before udev is started to create device nodes.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.preFailCommands

Shell commands to be executed before the failure prompt is shown.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.preLVMCommands

Shell commands to be executed immediately before LVM discovery.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.prepend

Other initrd files to prepend to the final initrd we are building.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.initrd.supportedFilesystems

Names of supported filesystem types in the initial ramdisk.

Type: list of strings

Default: [ ]

Example: [ "btrfs" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.isContainer

Whether this NixOS machine is a lightweight container running in another NixOS system.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
boot.kernel.randstructSeed

Provides a custom seed for the RANDSTRUCT security option of the Linux kernel. Note that RANDSTRUCT is only enabled in NixOS hardened kernels. Using a custom seed requires building the kernel and dependent packages locally, since this customization happens at build time.

Type: string

Default: ""

Example: "my secret seed"

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.kernel.sysctl

Runtime parameters of the Linux kernel, as set by sysctl(8). Note that sysctl parameters names must be enclosed in quotes (e.g. "vm.swappiness" instead of vm.swappiness). The value of each parameter may be a string, integer, boolean, or null (signifying the option will not appear at all).

Type: attribute set of sysctl option values

Default: { }

Example:

{ "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }

Declared by:

<nixpkgs/nixos/modules/config/sysctl.nix>
boot.kernelModules

The set of kernel modules to be loaded in the second stage of the boot process. Note that modules that are needed to mount the root file system should be added to boot.initrd.availableKernelModules or boot.initrd.kernelModules.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.kernelPackages

This option allows you to override the Linux kernel used by NixOS. Since things like external kernel module packages are tied to the kernel you're using, it also overrides those. This option is a function that takes Nixpkgs as an argument (as a convenience), and returns an attribute set containing at the very least an attribute kernel. Additional attributes may be needed depending on your configuration. For instance, if you use the NVIDIA X driver, then it also needs to contain an attribute nvidia_x11.

Type: unspecified

Default: "pkgs.linuxPackages"

Example:

pkgs.linuxPackages_2_6_25

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.kernelParams

Parameters added to the kernel command line.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.kernelPatches

A list of additional patches to apply to the kernel.

Type: list of attribute sets

Default: [ ]

Example:

[ pkgs.kernelPatches.ubuntu_fan_4_4 ]

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.loader.efi.canTouchEfiVariables

Whether the installation process is allowed to modify EFI boot variables.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/efi.nix>
boot.loader.efi.efiSysMountPoint

Where the EFI System Partition is mounted.

Type: string

Default: "/boot"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/efi.nix>
boot.loader.generationsDir.enable

Whether to create symlinks to the system generations under /boot. When enabled, /boot/default/kernel, /boot/default/initrd, etc., are updated to point to the current generation's kernel image, initial RAM disk, and other bootstrap files.

This optional is not necessary with boot loaders such as GNU GRUB for which the menu is updated to point to the latest bootstrap files. However, it is needed for U-Boot on platforms where the boot command line is stored in flash memory rather than in a menu file.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix>
boot.loader.generationsDir.copyKernels

Whether copy the necessary boot files into /boot, so /nix/store is not needed by the boot loader.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix>
boot.loader.generic-extlinux-compatible.enable

Whether to generate an extlinux-compatible configuration file under /boot/extlinux.conf. For instance, U-Boot's generic distro boot support uses this file format.

See U-boot's documentation for more information.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/generic-extlinux-compatible>
boot.loader.generic-extlinux-compatible.configurationLimit

Maximum number of configurations in the boot menu.

Type: signed integer

Default: 20

Example: 10

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/generic-extlinux-compatible>
boot.loader.grub.enable

Whether to enable the GNU GRUB boot loader.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.enableCryptodisk

Enable support for encrypted partitions. GRUB should automatically unlock the correct encrypted partition and look for filesystems.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.backgroundColor

Background color to be used for GRUB to fill the areas the image isn't filling.

Note: This options has no effect for GRUB 1.

Type: null or string

Default: null

Example: "#7EBAE4"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.configurationLimit

Maximum of configurations in boot menu. GRUB has problems when there are too many entries.

Type: signed integer

Default: 100

Example: 120

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.configurationName

GRUB entry name instead of default.

Type: string

Default: ""

Example: "Stable 2.6.21"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.copyKernels

Whether the GRUB menu builder should copy kernels and initial ramdisks to /boot. This is done automatically if /boot is on a different partition than /.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.default

Index of the default menu item to be booted.

Type: signed integer or string

Default: "0"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.device

The device on which the GRUB boot loader will be installed. The special value nodev means that a GRUB boot menu will be generated, but GRUB itself will not actually be installed. To install GRUB on multiple devices, use boot.loader.grub.devices.

Type: string

Default: ""

Example: "/dev/disk/by-id/wwn-0x500001234567890a"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.devices

The devices on which the boot loader, GRUB, will be installed. Can be used instead of device to install GRUB onto multiple devices.

Type: list of strings

Default: [ ]

Example: [ "/dev/disk/by-id/wwn-0x500001234567890a" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.efiInstallAsRemovable

Whether to invoke grub-install with --removable.

Unless you turn this on, GRUB will install itself somewhere in boot.loader.efi.efiSysMountPoint (exactly where depends on other config variables). If you've set boot.loader.efi.canTouchEfiVariables *AND* you are currently booted in UEFI mode, then GRUB will use efibootmgr to modify the boot order in the EFI variables of your firmware to include this location. If you are *not* booted in UEFI mode at the time GRUB is being installed, the NVRAM will not be modified, and your system will not find GRUB at boot time. However, GRUB will still return success so you may miss the warning that gets printed ("efibootmgr: EFI variables are not supported on this system.").

If you turn this feature on, GRUB will install itself in a special location within efiSysMountPoint (namely EFI/boot/boot$arch.efi) which the firmwares are hardcoded to try first, regardless of NVRAM EFI variables.

To summarize, turn this on if:

  • You are installing NixOS and want it to boot in UEFI mode, but you are currently booted in legacy mode

  • You want to make a drive that will boot regardless of the NVRAM state of the computer (like a USB "removable" drive)

  • You simply dislike the idea of depending on NVRAM state to make your drive bootable

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.efiSupport

Whether GRUB should be built with EFI support. EFI support is only available for GRUB v2. This option is ignored for GRUB v1.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraConfig

Additional GRUB commands inserted in the configuration file just before the menu entries.

Type: strings concatenated with "\n"

Default: ""

Example: "serial; terminal_output.serial"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraEntries

Any additional entries you want added to the GRUB boot menu.

Type: strings concatenated with "\n"

Default: ""

Example:

''
# GRUB 1 example (not GRUB 2 compatible)
title Windows
  chainloader (hd0,1)+1

# GRUB 2 example
menuentry "Windows 7" {
  chainloader (hd0,4)+1
}

# GRUB 2 with UEFI example, chainloading another distro
menuentry "Fedora" {
  set root=(hd1,1)
  chainloader /efi/fedora/grubx64.efi
}
''

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraEntriesBeforeNixOS

Whether extraEntries are included before the default option.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraFiles

A set of files to be copied to /boot. Each attribute name denotes the destination file name in /boot, while the corresponding attribute value specifies the source file.

Type: attribute set of paths

Default: { }

Example:

{ "memtest.bin" = "${pkgs.memtest86plus}/memtest.bin"; }

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraInitrd

The path to a second initramfs to be supplied to the kernel. This ramfs will not be copied to the store, so that it can contain secrets such as LUKS keyfiles or ssh keys. This implies that rolling back to a previous configuration won't rollback the state of this file.

Type: null or path

Default: null

Example: "/boot/extra_initramfs.gz"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraPerEntryConfig

Additional GRUB commands inserted in the configuration file at the start of each NixOS menu entry.

Type: strings concatenated with "\n"

Default: ""

Example: "root (hd0)"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.extraPrepareConfig

Additional bash commands to be run at the script that prepares the GRUB menu entries.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.font

Path to a TrueType, OpenType, or pf2 font to be used by Grub.

Type: null or path

Default: ''"''${pkgs.grub2}/share/grub/unicode.pf2"''

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.fontSize

Font size for the grub menu. Ignored unless font is set to a ttf or otf font.

Type: null or signed integer

Default: null

Example:

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.forceInstall

Whether to try and forcibly install GRUB even if problems are detected. It is not recommended to enable this unless you know what you are doing.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.forcei686

Whether to force the use of a ia32 boot loader on x64 systems. Required to install and run NixOS on 64bit x86 systems with 32bit (U)EFI.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.fsIdentifier

Determines how GRUB will identify devices when generating the configuration file. A value of uuid / label signifies that grub will always resolve the uuid or label of the device before using it in the configuration. A value of provided means that GRUB will use the device name as show in df or mount. Note, zfs zpools / datasets are ignored and will always be mounted using their labels.

Type: one of "uuid", "label", "provided"

Default: "uuid"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.gfxmodeBios

The gfxmode to pass to GRUB when loading a graphical boot interface under BIOS.

Type: string

Default: "1024x768"

Example: "auto"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.gfxmodeEfi

The gfxmode to pass to GRUB when loading a graphical boot interface under EFI.

Type: string

Default: "auto"

Example: "1024x768"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.gfxpayloadBios

The gfxpayload to pass to GRUB when loading a graphical boot interface under BIOS.

Type: string

Default: "text"

Example: "keep"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.gfxpayloadEfi

The gfxpayload to pass to GRUB when loading a graphical boot interface under EFI.

Type: string

Default: "keep"

Example: "text"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.ipxe

Set of iPXE scripts available for booting from the GRUB boot menu.

Type: attribute set of path or strings

Default: { }

Example:

{ demo = ''
    #!ipxe
    dhcp
    chain http://boot.ipxe.org/demo/boot.php
  '';
}

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/ipxe.nix>
boot.loader.grub.memtest86.enable

Make Memtest86+ (or MemTest86 if EFI support is enabled), a memory testing program, available from the GRUB boot menu. MemTest86 is an unfree program, so this requires allowUnfree to be set to true.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/memtest.nix>
boot.loader.grub.memtest86.params

Parameters added to the Memtest86+ command line. As of memtest86+ 5.01 the following list of (apparently undocumented) parameters are accepted:

  • console=..., set up a serial console. Examples: console=ttyS0, console=ttyS0,9600 or console=ttyS0,115200n8.

  • btrace, enable boot trace.

  • maxcpus=N, limit number of CPUs.

  • onepass, run one pass and exit if there are no errors.

  • tstlist=..., list of tests to run. Example: 0,1,2.

  • cpumask=..., set a CPU mask, to select CPUs to use for testing.

This list of command line options was obtained by reading the Memtest86+ source code.

Type: list of strings

Default: [ ]

Example: [ "console=ttyS0,115200" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/memtest.nix>
boot.loader.grub.mirroredBoots

Mirror the boot configuration to multiple partitions and install grub to the respective devices corresponding to those partitions.

Type: list of submodules

Default: [ ]

Example: [ { devices = [ "/dev/disk/by-id/wwn-0x500001234567890a" ] ; path = "/boot1"; } { devices = [ "/dev/disk/by-id/wwn-0x500009876543210a" ] ; path = "/boot2"; } ]

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.mirroredBoots.*.devices

The path to the devices which will have the GRUB MBR written. Note these are typically device paths and not paths to partitions.

Type: list of strings

Default: [ ]

Example: [ "/dev/disk/by-id/wwn-0x500001234567890a" "/dev/disk/by-id/wwn-0x500009876543210a" ]

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.mirroredBoots.*.efiBootloaderId

The id of the bootloader to store in efi nvram. The default is to name it NixOS and append the path or efiSysMountPoint. This is only used if boot.loader.efi.canTouchEfiVariables is true.

Type: null or string

Default: null

Example: "NixOS-fsid"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.mirroredBoots.*.efiSysMountPoint

The path to the efi system mount point. Usually this is the same partition as the above path and can be left as null.

Type: null or string

Default: null

Example: "/boot1/efi"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.mirroredBoots.*.path

The path to the boot directory where GRUB will be written. Generally this boot path should double as an EFI path.

Type: string

Example: "/boot1"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.splashImage

Background image used for GRUB. Set to null to run GRUB in text mode.

Note: For grub 1: It must be a 640x480, 14-colour image in XPM format, optionally compressed with gzip or bzip2.
Note: For grub 2: File must be one of .png, .tga, .jpg, or .jpeg. JPEG images must not be progressive. The image will be scaled if necessary to fit the screen.

Type: null or path

Example:

./my-background.png

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.splashMode

Whether to stretch the image or show the image in the top-left corner unstretched.

Note: This options has no effect for GRUB 1.

Type: one of "normal", "stretch"

Default: "stretch"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.storePath

Path to the Nix store when looking for kernels at boot. Only makes sense when copyKernels is false.

Type: string

Default: "/nix/store"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.trustedBoot.enable

Enable trusted boot. GRUB will measure all critical components during the boot process to offer TCG (TPM) support.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.trustedBoot.isHPLaptop

Use a special version of TrustedGRUB that is needed by some HP laptops and works only for the HP laptops.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.trustedBoot.systemHasTPM

Assertion that the target system has an activated TPM. It is a safety check before allowing the activation of 'trustedBoot.enable'. TrustedBoot WILL FAIL TO BOOT YOUR SYSTEM if no TPM is available.

Type: string

Default: ""

Example: "YES_TPM_is_activated"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.useOSProber

If set to true, append entries for other OSs detected by os-prober.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.version

The version of GRUB to use: 1 for GRUB Legacy (versions 0.9x), or 2 (the default) for GRUB 2.

Type: signed integer

Default: 2

Example: 1

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.grub.zfsSupport

Whether GRUB should be built against libzfs. ZFS support is only available for GRUB v2. This option is ignored for GRUB v1.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/grub/grub.nix>
boot.loader.initScript.enable

Some systems require a /sbin/init script which is started. Or having it makes starting NixOS easier. This applies to some kind of hosting services and user mode linux.

Additionally this script will create /boot/init-other-configurations-contents.txt containing contents of remaining configurations. You can copy paste them into /sbin/init manually running a rescue system or such.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/init-script/init-script.nix>
boot.loader.raspberryPi.enable

Whether to create files with the system generations in /boot. /boot/old will hold files from old generations.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix>
boot.loader.raspberryPi.firmwareConfig

Extra options that will be appended to /boot/config.txt file. For possible values, see: https://www.raspberrypi.org/documentation/configuration/config-txt/

Type: null or strings concatenated with "\n"

Default: null

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix>
boot.loader.raspberryPi.uboot.enable

Enable using uboot as bootmanager for the raspberry pi.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix>
boot.loader.raspberryPi.uboot.configurationLimit

Maximum number of configurations in the boot menu.

Type: signed integer

Default: 20

Example: 10

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix>
boot.loader.raspberryPi.version

Type: one of 0, 1, 2, 3, 4

Default: 2

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix>
boot.loader.systemd-boot.enable

Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix>
boot.loader.systemd-boot.configurationLimit

Maximum number of latest generations in the boot menu. Useful to prevent boot partition running out of disk space.

null means no limit i.e. all generations that were not garbage collected yet.

Type: null or signed integer

Default: null

Example: 120

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix>
boot.loader.systemd-boot.consoleMode

The resolution of the console. The following values are valid:

  • "0": Standard UEFI 80x25 mode

  • "1": 80x50 mode, not supported by all devices

  • "2": The first non-standard mode provided by the device firmware, if any

  • "auto": Pick a suitable mode automatically using heuristics

  • "max": Pick the highest-numbered available mode

  • "keep": Keep the mode selected by firmware (the default)

Type: one of "0", "1", "2", "auto", "max", "keep"

Default: "keep"

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix>
boot.loader.systemd-boot.editor

Whether to allow editing the kernel command-line before boot. It is recommended to set this to false, as it allows gaining root access by passing init=/bin/sh as a kernel parameter. However, it is enabled by default for backwards compatibility.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix>
boot.loader.systemd-boot.memtest86.enable

Make MemTest86 available from the systemd-boot menu. MemTest86 is a program for testing memory. MemTest86 is an unfree program, so this requires allowUnfree to be set to true.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix>
boot.loader.timeout

Timeout (in seconds) until loader boots the default menu item. Use null if the loader menu should be displayed indefinitely.

Type: null or signed integer

Default: 5

Declared by:

<nixpkgs/nixos/modules/system/boot/loader/loader.nix>
boot.plymouth.enable

Whether to enable Plymouth boot splash screen.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/system/boot/plymouth.nix>
boot.plymouth.extraConfig

Literal string to append to configFile and the config file generated by the plymouth module.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/system/boot/plymouth.nix>
boot.plymouth.logo

Logo which is displayed on the splash screen.

Type: path

Default:

''
pkgs.fetchurl {
          url = "https://nixos.org/logo/nixos-hires.png";
          sha256 = "1ivzgd7iz0i06y36p8m5w48fd8pjqwxhdaavc0pxs7w1g7mcy5si";
        }''

Declared by:

<nixpkgs/nixos/modules/system/boot/plymouth.nix>
boot.plymouth.theme

Splash screen theme.

Type: string

Default: "breeze"

Declared by:

<nixpkgs/nixos/modules/system/boot/plymouth.nix>
boot.plymouth.themePackages

Extra theme packages for plymouth.

Type: list of packages

Default: [ (build of breeze-plymouth-5.17.5) ]

Declared by:

<nixpkgs/nixos/modules/system/boot/plymouth.nix>
boot.postBootCommands

Shell commands to be executed just before systemd is started.

Type: strings concatenated with "\n"

Default: ""

Example: "rm -f /var/log/messages"

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-2.nix>
boot.resumeDevice

Device for manual resume attempt during boot. This should be used primarily if you want to resume from file. If left empty, the swap partitions are used. Specify here the device where the file resides. You should also use boot.kernelParams to specify resume_offset.

Type: string

Default: ""

Example: "/dev/sda3"

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
boot.runSize

Size limit for the /run tmpfs. Look at mount(8), tmpfs size option, for the accepted syntax.

Type: string

Default: "25%"

Example: "256m"

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-2.nix>
boot.specialFileSystems.<name?>.device

Location of the device.

Type: null or string (with check: non-empty)

Default: null

Example: "/dev/sda"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
boot.specialFileSystems.<name?>.fsType

Type of the file system.

Type: string (with check: non-empty)

Default: "auto"

Example: "ext3"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
boot.specialFileSystems.<name?>.mountPoint

Location of the mounted the file system.

Type: string (with check: non-empty)

Example: "/mnt/usb"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
boot.specialFileSystems.<name?>.options

Options used to mount the file system.

Type: list of string (with check: non-empty)s

Default: [ "defaults" ]

Example: [ "data=journal" ]

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
boot.supportedFilesystems

Names of supported filesystem types.

Type: list of strings

Default: [ ]

Example: [ "btrfs" ]

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
boot.tmpOnTmpfs

Whether to mount a tmpfs on /tmp during boot.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/tmp.nix>
boot.vesa

Whether to activate VESA video mode on boot.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/kernel.nix>
boot.zfs.enableUnstable

Use the unstable zfs package. This might be an option, if the latest kernel is not yet supported by a published release of ZFS. Enabling this option will install a development version of ZFS on Linux. The version will have already passed an extensive test suite, but it is more likely to hit an undiscovered bug compared to running a released version of ZFS on Linux.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems/zfs.nix>
boot.zfs.devNodes

Name of directory from which to import ZFS devices.

This should be a path under /dev containing stable names for all devices needed, as import may fail if device nodes are renamed concurrently with a device failing.

Type: path

Default: "/dev/disk/by-id"

Example: "/dev/disk/by-id"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems/zfs.nix>
boot.zfs.extraPools

Name or GUID of extra ZFS pools that you wish to import during boot.

Usually this is not necessary. Instead, you should set the mountpoint property of ZFS filesystems to legacy and add the ZFS filesystems to NixOS's fileSystems option, which makes NixOS automatically import the associated pool.

However, in some cases (e.g. if you have many filesystems) it may be preferable to exclusively use ZFS commands to manage filesystems. If so, since NixOS/systemd will not be managing those filesystems, you will need to specify the ZFS pool here so that NixOS automatically imports it on every boot.

Type: list of strings

Default: [ ]

Example: [ "tank" "data" ]

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems/zfs.nix>
boot.zfs.forceImportAll

Forcibly import all ZFS pool(s).

This is enabled by default for backwards compatibility purposes, but it is highly recommended to disable this option, as it bypasses some of the safeguards ZFS uses to protect your ZFS pools.

If you set this option to false and NixOS subsequently fails to import your non-root ZFS pool(s), you should manually import each pool with "zpool import -f <pool-name>", and then reboot. You should only need to do this once.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems/zfs.nix>
boot.zfs.forceImportRoot

Forcibly import the ZFS root pool(s) during early boot.

This is enabled by default for backwards compatibility purposes, but it is highly recommended to disable this option, as it bypasses some of the safeguards ZFS uses to protect your ZFS pools.

If you set this option to false and NixOS subsequently fails to boot because it cannot import the root pool, you should boot with the zfs_force=1 option as a kernel parameter (e.g. by manually editing the kernel params in grub during boot). You should only need to do this once.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems/zfs.nix>
boot.zfs.requestEncryptionCredentials

Request encryption keys or passwords for all encrypted datasets on import. For root pools the encryption key can be supplied via both an interactive prompt (keylocation=prompt) and from a file (keylocation=file://). Note that for data pools the encryption key can be only loaded from a file and not via interactive prompt since the import is processed in a background systemd service.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems/zfs.nix>
console.packages

List of additional packages that provide console fonts, keymaps and other resources for virtual consoles use.

Type: list of packages

Default: "with pkgs.kbdKeymaps; [ dvp neo ]"

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
console.colors

The 16 colors palette used by the virtual consoles. Leave empty to use the default colors. Colors must be in hexadecimal format and listed in order from color 0 to color 15.

Type: list of strings

Default: [ ]

Example: [ "002b36" "dc322f" "859900" "b58900" "268bd2" "d33682" "2aa198" "eee8d5" "002b36" "cb4b16" "586e75" "657b83" "839496" "6c71c4" "93a1a1" "fdf6e3" ]

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
console.earlySetup

Enable setting virtual console options as early as possible (in initrd).

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
console.extraTTYs

TTY (virtual console) devices, in addition to the consoles on which mingetty and syslogd run, that must be initialised. Only useful if you have some program that you want to run on some fixed console. For example, the NixOS installation CD opens the manual in a web browser on console 7, so it sets console.extraTTYs to ["tty7"].

Type: list of strings

Default: [ ]

Example: [ "tty8" "tty9" ]

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
console.font

The font used for the virtual consoles. Leave empty to use whatever the setfont program considers the default font.

Type: string

Default: "Lat2-Terminus16"

Example: "LatArCyrHeb-16"

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
console.keyMap

The keyboard mapping table for the virtual consoles.

Type: string or path

Default: "us"

Example: "fr"

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
console.useXkbConfig

If set, configure the virtual console keymap from the xserver keyboard settings.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/console.nix>
containers

A set of NixOS system configurations to be run as lightweight containers. Each container appears as a service container-name on the host system, allowing it to be started and stopped via systemctl.

Type: attribute set of submodules

Default: { }

Example:

{ webserver =
    { path = "/nix/var/nix/profiles/webserver";
    };
  database =
    { config =
        { config, pkgs, ... }:
        { services.postgresql.enable = true;
          services.postgresql.package = pkgs.postgresql_9_6;

          system.stateVersion = "17.03";
        };
    };
}

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.enableTun

Allows the container to create and setup tunnel interfaces by granting the NET_ADMIN capability and enabling access to /dev/net/tun.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.additionalCapabilities

Grant additional capabilities to the container. See the capabilities(7) and systemd-nspawn(1) man pages for more information.

Type: list of strings

Default: [ ]

Example: [ "CAP_NET_ADMIN" "CAP_MKNOD" ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.allowedDevices

A list of device nodes to which the containers has access to.

Type: list of submodules

Default: [ ]

Example: [ { modifier = "rw"; node = "/dev/net/tun"; } ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.allowedDevices.*.modifier

Device node access modifier. Takes a combination r (read), w (write), and m (mknod). See the systemd.resource-control(5) man page for more information.

Type: string

Example: "rw"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.allowedDevices.*.node

Path to device node

Type: string

Example: "/dev/net/tun"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.autoStart

Whether the container is automatically started at boot-time.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.bindMounts

An extra list of directories that is bound to the container.

Type: list or attribute set of submodules

Default: { }

Example: { /home = { hostPath = "/home/alice"; isReadOnly = false; } ; }

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.bindMounts.<name?>.hostPath

Location of the host path to be mounted.

Type: null or string

Default: null

Example: "/home/alice"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.bindMounts.<name?>.isReadOnly

Determine whether the mounted path will be accessed in read-only mode.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.bindMounts.<name?>.mountPoint

Mount point on the container file system.

Type: string

Example: "/mnt/usb"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.config

A specification of the desired configuration of this container, as a NixOS module.

Type: Toplevel NixOS config

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.ephemeral

Runs container in ephemeral mode with the empty root filesystem at boot. This way container will be bootstrapped from scratch on each boot and will be cleaned up on shutdown leaving no traces behind. Useful for completely stateless, reproducible containers.

Note that this option might require to do some adjustments to the container configuration, e.g. you might want to set systemd.network.networks.$interface.dhcpConfig.ClientIdentifier to "mac" if you use macvlans option. This way dhcp client identifier will be stable between the container restarts.

Note that the container journal will not be linked to the host if this option is enabled.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraFlags

Extra flags passed to the systemd-nspawn command. See systemd-nspawn(1) for details.

Type: list of strings

Default: [ ]

Example: [ "--drop-capability=CAP_SYS_CHROOT" ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths

Extra veth-pairs to be created for the container

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.forwardPorts

List of forwarded ports from host to container. Each forwarded port is specified by protocol, hostPort and containerPort. By default, protocol is tcp and hostPort and containerPort are assumed to be the same if containerPort is not explicitly given.

Type: list of submodules

Default: [ ]

Example: [ { containerPort = 80; hostPort = 8080; protocol = "tcp"; } ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.forwardPorts.*.containerPort

Target port of container

Type: null or signed integer

Default: null

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.forwardPorts.*.hostPort

Source port of the external interface on host

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.forwardPorts.*.protocol

The protocol specifier for port forwarding between host and container

Type: string

Default: "tcp"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.hostAddress

The IPv4 address assigned to the host interface. (Not used when hostBridge is set.)

Type: null or string

Default: null

Example: "10.231.136.1"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.hostAddress6

The IPv6 address assigned to the host interface. (Not used when hostBridge is set.)

Type: null or string

Default: null

Example: "fc00::1"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.hostBridge

Put the host-side of the veth-pair into the named bridge. Only one of hostAddress* or hostBridge can be given.

Type: null or string

Default: null

Example: "br0"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.localAddress

The IPv4 address assigned to the interface in the container. If a hostBridge is used, this should be given with netmask to access the whole network. Otherwise the default netmask is /32 and routing is set up from localAddress to hostAddress and back.

Type: null or string

Default: null

Example: "10.231.136.2"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.extraVeths.<name>.localAddress6

The IPv6 address assigned to the interface in the container. If a hostBridge is used, this should be given with netmask to access the whole network. Otherwise the default netmask is /128 and routing is set up from localAddress6 to hostAddress6 and back.

Type: null or string

Default: null

Example: "fc00::2"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.forwardPorts

List of forwarded ports from host to container. Each forwarded port is specified by protocol, hostPort and containerPort. By default, protocol is tcp and hostPort and containerPort are assumed to be the same if containerPort is not explicitly given.

Type: list of submodules

Default: [ ]

Example: [ { containerPort = 80; hostPort = 8080; protocol = "tcp"; } ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.forwardPorts.*.containerPort

Target port of container

Type: null or signed integer

Default: null

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.forwardPorts.*.hostPort

Source port of the external interface on host

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.forwardPorts.*.protocol

The protocol specifier for port forwarding between host and container

Type: string

Default: "tcp"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.hostAddress

The IPv4 address assigned to the host interface. (Not used when hostBridge is set.)

Type: null or string

Default: null

Example: "10.231.136.1"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.hostAddress6

The IPv6 address assigned to the host interface. (Not used when hostBridge is set.)

Type: null or string

Default: null

Example: "fc00::1"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.hostBridge

Put the host-side of the veth-pair into the named bridge. Only one of hostAddress* or hostBridge can be given.

Type: null or string

Default: null

Example: "br0"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.interfaces

The list of interfaces to be moved into the container.

Type: list of strings

Default: [ ]

Example: [ "eth1" "eth2" ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.localAddress

The IPv4 address assigned to the interface in the container. If a hostBridge is used, this should be given with netmask to access the whole network. Otherwise the default netmask is /32 and routing is set up from localAddress to hostAddress and back.

Type: null or string

Default: null

Example: "10.231.136.2"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.localAddress6

The IPv6 address assigned to the interface in the container. If a hostBridge is used, this should be given with netmask to access the whole network. Otherwise the default netmask is /128 and routing is set up from localAddress6 to hostAddress6 and back.

Type: null or string

Default: null

Example: "fc00::2"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.macvlans

The list of host interfaces from which macvlans will be created. For each interface specified, a macvlan interface will be created and moved to the container.

Type: list of strings

Default: [ ]

Example: [ "eth1" "eth2" ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.path

As an alternative to specifying config, you can specify the path to the evaluated NixOS system configuration, typically a symlink to a system profile.

Type: path

Example: "/nix/var/nix/profiles/containers/webserver"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.privateNetwork

Whether to give the container its own private virtual Ethernet interface. The interface is called eth0, and is hooked up to the interface ve-container-name on the host. If this option is not set, then the container shares the network interfaces of the host, and can bind to any port on any interface.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.timeoutStartSec

Time for the container to start. In case of a timeout, the container processes get killed. See systemd.time(7) for more information about the format.

Type: string

Default: "1min"

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
containers.<name>.tmpfs

Mounts a set of tmpfs file systems into the container. Multiple paths can be specified. Valid items must conform to the --tmpfs argument of systemd-nspawn. See systemd-nspawn(1) for details.

Type: list of strings

Default: [ ]

Example: [ "/var" ]

Declared by:

<nixpkgs/nixos/modules/virtualisation/containers.nix>
docker-containers

Docker containers to run as systemd services.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.cmd

Commandline arguments to pass to the image's entrypoint.

Type: list of strings

Default: [ ]

Example:

["--port=9000"]

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.dependsOn

Define which other containers this one depends on. They will be added to both After and Requires for the unit.

Use the same name as the attribute under services.docker-containers.

Type: list of strings

Default: [ ]

Example:

services.docker-containers = {
  node1 = {};
  node2 = {
    dependsOn = [ "node1" ];
  }
}

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.entrypoint

Override the default entrypoint of the image.

Type: null or string

Default: null

Example: "/bin/my-app"

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.environment

Environment variables to set for this container.

Type: attribute set of strings

Default: { }

Example:

{
  DATABASE_HOST = "db.example.com";
  DATABASE_PORT = "3306";
}

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.extraDockerOptions

Extra options for docker run.

Type: list of strings

Default: [ ]

Example:

["--network=host"]

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.image

Docker image to run.

Type: string

Example: "library/hello-world"

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.imageFile

Path to an image file to load instead of pulling from a registry. If defined, do not pull from registry.

You still need to set the image attribute, as it will be used as the image name for docker to start a container.

Type: null or package

Default: null

Example:

pkgs.dockerTools.buildDockerImage {...};

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.log-driver

Logging driver for the container. The default of "none" means that the container's logs will be handled as part of the systemd unit. Setting this to "journald" will result in duplicate logging, but the container's logs will be visible to the docker logs command.

For more details and a full list of logging drivers, refer to the Docker engine documentation

Type: string

Default: "none"

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.ports

Network ports to publish from the container to the outer host.

Valid formats:

  • <ip>:<hostPort>:<containerPort>

  • <ip>::<containerPort>

  • <hostPort>:<containerPort>

  • <containerPort>

Both hostPort and containerPort can be specified as a range of ports. When specifying ranges for both, the number of container ports in the range must match the number of host ports in the range. Example: 1234-1236:1234-1236/tcp

When specifying a range for hostPort only, the containerPort must not be a range. In this case, the container port is published somewhere within the specified hostPort range. Example: 1234-1236:1234/tcp

Refer to the Docker engine documentation for full details.

Type: list of strings

Default: [ ]

Example:

[
  "8080:9000"
]

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.user

Override the username or UID (and optionally groupname or GID) used in the container.

Type: null or string

Default: null

Example: "nobody:nogroup"

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.volumes

List of volumes to attach to this container.

Note that this is a list of "src:dst" strings to allow for src to refer to /nix/store paths, which would be difficult with an attribute set. There are also a variety of mount options available as a third field; please refer to the docker engine documentation for details.

Type: list of strings

Default: [ ]

Example:

[
  "volume_name:/path/inside/container"
  "/path/on/host:/path/inside/container"
]

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
docker-containers.<name>.workdir

Override the default working directory for the container.

Type: null or string

Default: null

Example: "/var/lib/hello_world"

Declared by:

<nixpkgs/nixos/modules/virtualisation/docker-containers.nix>
documentation.enable

Whether to install documentation of packages from environment.systemPackages into the generated system path.

See "Multiple-output packages" chapter in the nixpkgs manual for more info.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.dev.enable

Whether to install documentation targeted at developers.

  • This includes man pages targeted at developers if man.enable is set (this also includes "devman" outputs).

  • This includes info pages targeted at developers if info.enable is set (this also includes "devinfo" outputs).

  • This includes other pages targeted at developers if doc.enable is set (this also includes "devdoc" outputs).

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.doc.enable

Whether to install documentation distributed in packages' /share/doc. Usually plain text and/or HTML. This also includes "doc" outputs.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.info.enable

Whether to install info pages and the info command. This also includes "info" outputs.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.man.enable

Whether to install manual pages and the man command. This also includes "man" outputs.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.nixos.enable

Whether to install NixOS's own documentation.

  • This includes man pages like configuration.nix(5) if man.enable is set.

  • This includes the HTML manual and the nixos-help command if doc.enable is set.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.nixos.extraModuleSources

Which extra NixOS module paths the generated NixOS's documentation should strip from options.

Type: list of path or strings

Default: [ ]

Example:

# e.g. with options from modules in ${pkgs.customModules}/nix:
[ pkgs.customModules ]

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
documentation.nixos.includeAllModules

Whether the generated NixOS's documentation should include documentation for all the options from all the NixOS modules included in the current configuration.nix. Disabling this will make the manual generator to ignore options defined outside of baseModules.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/misc/documentation.nix>
dysnomia.enable

Whether to enable Dysnomia

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.enableAuthentication

Whether to publish privacy-sensitive authentication credentials

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.package

The Dysnomia package

Type: path

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.components

An atttribute set in which each key represents a container and each value an attribute set in which each key represents a component and each value a derivation constructing its initial state

Type: unspecified

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.containers

An attribute set in which each key represents a container and each value an attribute set providing its configuration properties

Type: unspecified

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.extraContainerPaths

A list of paths containing additional container configurations that are added to the search folders

Type: unspecified

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.extraContainerProperties

An attribute set providing additional container settings in addition to the default properties

Type: unspecified

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.extraModulePaths

A list of paths containing additional modules that are added to the search folders

Type: unspecified

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
dysnomia.properties

An attribute set in which each attribute represents a machine property. Optionally, these values can be shell substitutions.

Type: unspecified

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/misc/dysnomia.nix>
environment.enableDebugInfo

Some NixOS packages provide debug symbols. However, these are not included in the system closure by default to save disk space. Enabling this option causes the debug symbols to appear in /run/current-system/sw/lib/debug/.build-id, where tools such as gdb can find them. If you need debug symbols for a package that doesn't provide them by default, you can enable them as follows:

nixpkgs.config.packageOverrides = pkgs: {
  hello = pkgs.hello.overrideAttrs (oldAttrs: {
    separateDebugInfo = true;
  });
};

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/debug-info.nix>
environment.checkConfigurationOptions

Alias of _module.check.

Type: boolean

Declared by:

<nixpkgs/nixos/modules/rename.nix>
environment.etc

Set of files that have to be linked in /etc.

Type: list or attribute set of submodules

Default: { }

Example:

{ example-configuration-file =
    { source = "/nix/store/.../etc/dir/file.conf.example";
      mode = "0440";
    };
  "default/useradd".text = "GROUP=100 ...";
}

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.enable

Whether this /etc file should be generated. This option allows specific /etc files to be disabled.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.gid

GID of created file. Only takes affect when the file is copied (that is, the mode is not 'symlink').

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.group

Group name of created file. Only takes affect when the file is copied (that is, the mode is not 'symlink'). Changing this option takes precedence over gid.

Type: string

Default: "+0"

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.mode

If set to something else than symlink, the file is copied instead of symlinked, with the given file mode.

Type: string

Default: "symlink"

Example: "0600"

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.source

Path of the source file.

Type: path

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.target

Name of symlink (relative to /etc). Defaults to the attribute name.

Type: string

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.text

Text of the file.

Type: null or strings concatenated with "\n"

Default: null

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.uid

UID of created file. Only takes affect when the file is copied (that is, the mode is not 'symlink').

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.etc.<name?>.user

User name of created file. Only takes affect when the file is copied (that is, the mode is not 'symlink'). Changing this option takes precedence over uid.

Type: string

Default: "+0"

Declared by:

<nixpkgs/nixos/modules/system/etc/etc.nix>
environment.extraInit

Shell script code called during global environment initialisation after all variables and profileVariables have been set. This code is assumed to be shell-independent, which means you should stick to pure sh without sh word split.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.extraOutputsToInstall

List of additional package outputs to be symlinked into /run/current-system/sw.

Type: list of strings

Default: [ ]

Example: [ "doc" "info" "devdoc" ]

Declared by:

<nixpkgs/nixos/modules/config/system-path.nix>
environment.extraSetup

Shell fragments to be run after the system environment has been created. This should only be used for things that need to modify the internals of the environment, e.g. generating MIME caches. The environment being built can be accessed at $out.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/system-path.nix>
environment.freetds

Configure freetds database entries. Each attribute denotes a section within freetds.conf, and the value (a string) is the config content for that section. When at least one entry is configured the global environment variables FREETDSCONF, FREETDS and SYBASE will be configured to allow the programs that use freetds to find the library and config.

Type: attribute set of strings

Default: { }

Example:

{ MYDATABASE = ''
    host = 10.0.2.100
    port = 1433
    tds version = 7.2
  '';
}

Declared by:

<nixpkgs/nixos/modules/programs/freetds.nix>
environment.gnome3.excludePackages

Which packages gnome should exclude from the default environment

Type: list of packages

Default: [ ]

Example:

[ pkgs.gnome3.totem ]

Declared by:

<nixpkgs/nixos/modules/services/x11/desktop-managers/gnome3.nix>
environment.homeBinInPath

Include ~/bin/ in $PATH.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.interactiveShellInit

Shell script code called during interactive shell initialisation. This code is assumed to be shell-independent, which means you should stick to pure sh without sh word split.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.loginShellInit

Shell script code called during login shell initialisation. This code is assumed to be shell-independent, which means you should stick to pure sh without sh word split.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.lxqt.excludePackages

Which LXQt packages to exclude from the default environment

Type: list of packages

Default: [ ]

Example:

[ pkgs.lxqt.qterminal ]

Declared by:

<nixpkgs/nixos/modules/services/x11/desktop-managers/lxqt.nix>
environment.mate.excludePackages

Which MATE packages to exclude from the default environment

Type: list of packages

Default: [ ]

Example:

[ pkgs.mate.mate-terminal pkgs.mate.pluma ]

Declared by:

<nixpkgs/nixos/modules/services/x11/desktop-managers/mate.nix>
environment.memoryAllocator.provider

The system-wide memory allocator.

Briefly, the system-wide memory allocator providers are:

  • libc: the standard allocator provided by libc

  • graphene-hardened: An allocator designed to mitigate memory corruption attacks, such as those caused by use-after-free bugs.

  • jemalloc: A general purpose allocator that emphasizes fragmentation avoidance and scalable concurrency support.

  • scudo: A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator, which aims at providing additional mitigations against heap based vulnerabilities, while maintaining good performance.

Warning: Selecting an alternative allocator (i.e., anything other than libc) may result in instability, data loss, and/or service failure.

Type: one of "libc", "graphene-hardened", "jemalloc", "scudo"

Default: "libc"

Declared by:

<nixpkgs/nixos/modules/config/malloc.nix>
environment.noXlibs

Switch off the options in the default configuration that require X11 libraries. This includes client-side font configuration and SSH forwarding of X11 authentication in. Thus, you probably do not want to enable this option if you want to run X11 programs on this machine via SSH.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/no-x-libs.nix>
environment.pantheon.excludePackages

Which packages pantheon should exclude from the default environment

Type: list of packages

Default: [ ]

Example:

[ pkgs.pantheon.elementary-camera ]

Declared by:

<nixpkgs/nixos/modules/services/x11/desktop-managers/pantheon.nix>
environment.pathsToLink

List of directories to be symlinked in /run/current-system/sw.

Type: list of strings

Default: [ ]

Example: [ "/" ]

Declared by:

<nixpkgs/nixos/modules/config/system-path.nix>
environment.profileRelativeEnvVars

Attribute set of environment variable. Each attribute maps to a list of relative paths. Each relative path is appended to the each profile of environment.profiles to form the content of the corresponding environment variable.

Type: attribute set of list of stringss

Example: { MANPATH = [ "/man" "/share/man" ] ; PATH = [ "/bin" ] ; }

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.profileRelativeSessionVariables

Attribute set of environment variable used in the global environment. These variables will be set by PAM early in the login process.

Variable substitution is available as described in pam_env.conf(5).

Each attribute maps to a list of relative paths. Each relative path is appended to the each profile of environment.profiles to form the content of the corresponding environment variable.

Also, these variables are merged into environment.profileRelativeEnvVars and it is therefore not possible to use PAM style variables such as @{HOME}.

Type: attribute set of list of stringss

Example: { MANPATH = [ "/man" "/share/man" ] ; PATH = [ "/bin" ] ; }

Declared by:

<nixpkgs/nixos/modules/config/system-environment.nix>
environment.profiles

A list of profiles used to setup the global environment.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.sessionVariables

A set of environment variables used in the global environment. These variables will be set by PAM early in the login process.

The value of each session variable can be either a string or a list of strings. The latter is concatenated, interspersed with colon characters.

Note, due to limitations in the PAM format values may not contain the " character.

Also, these variables are merged into environment.variables and it is therefore not possible to use PAM style variables such as @{HOME}.

Type: attribute set of string or list of stringss

Default: { }

Declared by:

<nixpkgs/nixos/modules/config/system-environment.nix>
environment.shellAliases

An attribute set that maps aliases (the top level attribute names in this option) to command strings or directly to build outputs. The aliases are added to all users' shells. Aliases mapped to null are ignored.

Type: attribute set of null or string or paths

Example: { l = null; ll = "ls -l"; }

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.shellInit

Shell script code called during shell initialisation. This code is assumed to be shell-independent, which means you should stick to pure sh without sh word split.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.shells

A list of permissible login shells for user accounts. No need to mention /bin/sh here, it is placed into this list implicitly.

Type: list of package or paths

Default: [ ]

Example:

[ pkgs.bashInteractive pkgs.zsh ]

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
environment.systemPackages

The set of packages that appear in /run/current-system/sw. These packages are automatically available to all users, and are automatically updated every time you rebuild the system configuration. (The latter is the main difference with installing them in the default profile, /nix/var/nix/profiles/default.

Type: list of packages

Default: [ ]

Example:

[ pkgs.firefox pkgs.thunderbird ]

Declared by:

<nixpkgs/nixos/modules/config/system-path.nix>
environment.unixODBCDrivers

Specifies Unix ODBC drivers to be registered in /etc/odbcinst.ini. You may also want to add pkgs.unixODBC to the system path to get a command line client to connect to ODBC databases.

Type: list of packages

Default: [ ]

Example:

with pkgs.unixODBCDrivers; [ sqlite psql ]

Declared by:

<nixpkgs/nixos/modules/config/unix-odbc-drivers.nix>
environment.variables

A set of environment variables used in the global environment. These variables will be set on shell initialisation (e.g. in /etc/profile). The value of each variable can be either a string or a list of strings. The latter is concatenated, interspersed with colon characters.

Type: attribute set of string or list of stringss

Default: { }

Example: { EDITOR = "nvim"; VISUAL = "nvim"; }

Declared by:

<nixpkgs/nixos/modules/config/shells-environment.nix>
fileSystems

The file systems to be mounted. It must include an entry for the root directory (mountPoint = "/"). Each entry in the list is an attribute set with the following fields: mountPoint, device, fsType (a file system type recognised by mount; defaults to "auto"), and options (the mount options passed to mount using the -o flag; defaults to [ "defaults" ]).

Instead of specifying device, you can also specify a volume label (label) for file systems that support it, such as ext2/ext3 (see mke2fs -L).

Type: list or attribute set of submodules

Default: { }

Example:

{
  "/".device = "/dev/hda1";
  "/data" = {
    device = "/dev/hda2";
    fsType = "ext3";
    options = [ "data=journal" ];
  };
  "/bigdisk".label = "bigdisk";
}

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
<nixpkgs/nixos/modules/tasks/encrypted-devices.nix>
<nixpkgs/nixos/modules/system/boot/stage-1.nix>
fileSystems.<name?>.autoFormat

If the device does not currently contain a filesystem (as determined by blkid, then automatically format it with the filesystem type specified in fsType. Use with caution.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.autoResize

If set, the filesystem is grown to its maximum size before being mounted. (This is typically the size of the containing partition.) This is currently only supported for ext2/3/4 filesystems that are mounted during early boot.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.device

Location of the device.

Type: null or string (with check: non-empty)

Default: null

Example: "/dev/sda"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.encrypted.enable

The block device is backed by an encrypted one, adds this device as a initrd luks entry.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/encrypted-devices.nix>
fileSystems.<name?>.encrypted.blkDev

Location of the backing encrypted device.

Type: null or string

Default: null

Example: "/dev/sda1"

Declared by:

<nixpkgs/nixos/modules/tasks/encrypted-devices.nix>
fileSystems.<name?>.encrypted.keyFile

File system location of keyfile. This unlocks the drive after the root has been mounted to /mnt-root.

Type: null or string

Default: null

Example: "/mnt-root/root/.swapkey"

Declared by:

<nixpkgs/nixos/modules/tasks/encrypted-devices.nix>
fileSystems.<name?>.encrypted.label

Label of the unlocked encrypted device. Set fileSystems.<name?>.device to /dev/mapper/<label> to mount the unlocked device.

Type: null or string

Default: null

Example: "rootfs"

Declared by:

<nixpkgs/nixos/modules/tasks/encrypted-devices.nix>
fileSystems.<name?>.formatOptions

If autoFormat option is set specifies extra options passed to mkfs.

Type: string

Default: ""

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.fsType

Type of the file system.

Type: string (with check: non-empty)

Default: "auto"

Example: "ext3"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.label

Label of the device (if any).

Type: null or string (with check: non-empty)

Default: null

Example: "root-partition"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.mountPoint

Location of the mounted the file system.

Type: string (with check: non-empty)

Example: "/mnt/usb"

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.neededForBoot

If set, this file system will be mounted in the initial ramdisk. By default, this applies to the root file system and to the file system containing /nix/store.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/system/boot/stage-1.nix>
fileSystems.<name?>.noCheck

Disable running fsck on this filesystem.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fileSystems.<name?>.options

Options used to mount the file system.

Type: list of string (with check: non-empty)s

Default: [ "defaults" ]

Example: [ "data=journal" ]

Declared by:

<nixpkgs/nixos/modules/tasks/filesystems.nix>
fonts.enableDefaultFonts

Enable a basic set of fonts providing several font styles and families and reasonable coverage of Unicode.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fonts.nix>
fonts.enableFontDir

Whether to create a directory with links to all fonts in /run/current-system/sw/share/X11-fonts.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontdir.nix>
fonts.enableGhostscriptFonts

Whether to add the fonts provided by Ghostscript (such as various URW fonts and the “Base-14” Postscript fonts) to the list of system fonts, making them available to X11 applications.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/ghostscript.nix>
fonts.fontconfig.enable

If enabled, a Fontconfig configuration file will be built pointing to a set of default fonts. If you don't care about running X11 applications or any other program that uses Fontconfig, you can turn this option off and prevent a dependency on all those fonts.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.allowBitmaps

Allow bitmap fonts. Set to false to ban all bitmap fonts.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.allowType1

Allow Type-1 fonts. Default is false because of poor rendering.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.antialias

Enable font antialiasing. At high resolution (> 200 DPI), antialiasing has no visible effect; users of such displays may want to disable this option.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.cache32Bit

Generate system fonts cache for 32-bit applications.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.defaultFonts.emoji

System-wide default emoji font(s). Multiple fonts may be listed in case a font does not support all emoji.

Note that fontconfig matches color emoji fonts preferentially, so if you want to use a black and white font while having a color font installed (eg. Noto Color Emoji installed alongside Noto Emoji), fontconfig will still choose the color font even when it is later in the list.

Type: list of strings

Default: [ "Noto Color Emoji" ]

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.defaultFonts.monospace

System-wide default monospace font(s). Multiple fonts may be listed in case multiple languages must be supported.

Type: list of strings

Default: [ "DejaVu Sans Mono" ]

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.defaultFonts.sansSerif

System-wide default sans serif font(s). Multiple fonts may be listed in case multiple languages must be supported.

Type: list of strings

Default: [ "DejaVu Sans" ]

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.defaultFonts.serif

System-wide default serif font(s). Multiple fonts may be listed in case multiple languages must be supported.

Type: list of strings

Default: [ "DejaVu Serif" ]

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.dpi

Force DPI setting. Setting to 0 disables DPI forcing; the DPI detected for the display will be used.

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.hinting.enable

Enable font hinting. Hinting aligns glyphs to pixel boundaries to improve rendering sharpness at low resolution. At high resolution (> 200 dpi) hinting will do nothing (at best); users of such displays may want to disable this option.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.hinting.autohint

Enable the autohinter in place of the default interpreter. The results are usually lower quality than correctly-hinted fonts, but better than unhinted fonts.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.includeUserConf

Include the user configuration from ~/.config/fontconfig/fonts.conf or ~/.config/fontconfig/conf.d.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.localConf

System-wide customization file contents, has higher priority than defaultFonts settings.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.penultimate.enable

Enable fontconfig-penultimate settings to supplement the NixOS defaults by providing per-font rendering defaults and metric aliases.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig-penultimate.nix>
fonts.fontconfig.subpixel.lcdfilter

FreeType LCD filter. At high resolution (> 200 DPI), LCD filtering has no visible effect; users of such displays may want to select none.

Type: one of "none", "default", "light", "legacy"

Default: "default"

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.subpixel.rgba

Subpixel order. The overwhelming majority of displays are rgb in their normal orientation. Select vrgb for mounting such a display 90 degrees clockwise from its normal orientation or vbgr for mounting 90 degrees counter-clockwise. Select bgr in the unlikely event of mounting 180 degrees from the normal orientation. Reverse these directions in the improbable event that the display's native subpixel order is bgr.

Type: one of "rgb", "bgr", "vrgb", "vbgr", "none"

Default: "rgb"

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fontconfig.useEmbeddedBitmaps

Use embedded bitmaps in fonts like Calibri.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/fonts/fontconfig.nix>
fonts.fonts

List of primary font paths.

Type: list of paths

Default: [ ]

Example:

[ pkgs.dejavu_fonts ]

Declared by:

<nixpkgs/nixos/modules/config/fonts/fonts.nix>
gnu

When enabled, GNU software is chosen by default whenever a there is a choice between GNU and non-GNU software (e.g., GNU lsh vs. OpenSSH).

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/gnu.nix>
gtk.iconCache.enable

Whether to build icon theme caches for GTK applications.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/gtk/gtk-icon-cache.nix>
hardware.enableAllFirmware

Turn on this option if you want to enable all the firmware.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/all-firmware.nix>
hardware.enableRedistributableFirmware

Turn on this option if you want to enable all the firmware with a license allowing redistribution. (i.e. free firmware and firmware-linux-nonfree)

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/all-firmware.nix>
hardware.acpilight.enable

Enable acpilight. This will allow brightness control via xbacklight from users in the video group

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/acpilight.nix>
hardware.bladeRF.enable

Enables udev rules for BladeRF devices. By default grants access to users in the "bladerf" group. You may want to install the libbladeRF package.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/bladeRF.nix>
hardware.bluetooth.enable

Whether to enable support for Bluetooth.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/bluetooth.nix>
hardware.bluetooth.package

Which BlueZ package to use.

Note: Use the pkgs.bluezFull package to enable all bluez plugins.

Type: package

Default: "pkgs.bluez"

Example: "pkgs.bluezFull"

Declared by:

<nixpkgs/nixos/modules/services/hardware/bluetooth.nix>
hardware.bluetooth.config

Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).

Type: attribute set of attribute set of boolean or signed integer or stringss

Example: { General = { ControllerMode = "bredr"; } ; }

Declared by:

<nixpkgs/nixos/modules/services/hardware/bluetooth.nix>
hardware.bluetooth.extraConfig

Set additional configuration for system-wide bluetooth (/etc/bluetooth/main.conf).

Type: null or strings concatenated with "\n"

Default: null

Example:

''
[General]
ControllerMode = bredr
''

Declared by:

<nixpkgs/nixos/modules/services/hardware/bluetooth.nix>
hardware.bluetooth.powerOnBoot

Whether to power up the default Bluetooth controller on boot.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/bluetooth.nix>
hardware.brillo.enable

Whether to enable Enable brillo in userspace. This will allow brightness control from users in the video group. .

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/brillo.nix>
hardware.bumblebee.enable

Enable the bumblebee daemon to manage Optimus hybrid video cards. This should power off secondary GPU until its use is requested by running an application with optirun.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/video/bumblebee.nix>
hardware.bumblebee.connectDisplay

Set to true if you intend to connect your discrete card to a monitor. This option will set up your Nvidia card for EDID discovery and to turn on the monitor signal.

Only nvidia driver is supported so far.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/video/bumblebee.nix>
hardware.bumblebee.driver

Set driver used by bumblebeed. Supported are nouveau and nvidia.

Type: one of "nvidia", "nouveau"

Default: "nvidia"

Declared by:

<nixpkgs/nixos/modules/hardware/video/bumblebee.nix>
hardware.bumblebee.group

Group for bumblebee socket

Type: string

Default: "wheel"

Example: "video"

Declared by:

<nixpkgs/nixos/modules/hardware/video/bumblebee.nix>
hardware.bumblebee.pmMethod

Set preferred power management method for unused card.

Type: one of "auto", "bbswitch", "switcheroo", "none"

Default: "auto"

Declared by:

<nixpkgs/nixos/modules/hardware/video/bumblebee.nix>
hardware.ckb-next.enable

Whether to enable the Corsair keyboard/mouse driver.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/ckb-next.nix>
hardware.ckb-next.package

The package implementing the Corsair keyboard/mouse driver.

Type: package

Default: "pkgs.ckb-next"

Declared by:

<nixpkgs/nixos/modules/hardware/ckb-next.nix>
hardware.ckb-next.gid

Limit access to the ckb daemon to a particular group.

Type: null or signed integer

Default: null

Example: 100

Declared by:

<nixpkgs/nixos/modules/hardware/ckb-next.nix>
hardware.cpu.amd.updateMicrocode

Update the CPU microcode for AMD processors.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/cpu/amd-microcode.nix>
hardware.cpu.intel.updateMicrocode

Update the CPU microcode for Intel processors.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/cpu/intel-microcode.nix>
hardware.deviceTree.enable

Build device tree files. These are used to describe the non-discoverable hardware of a system.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/device-tree.nix>
hardware.deviceTree.base

The package containing the base device-tree (.dtb) to boot. Contains device trees bundled with the Linux kernel by default.

Type: path

Default: "\${config.boot.kernelPackages.kernel}/dtbs"

Example:

pkgs.deviceTree_rpi

Declared by:

<nixpkgs/nixos/modules/hardware/device-tree.nix>
hardware.deviceTree.overlays

A path containing device tree overlays (.dtbo) to be applied to all base device-trees.

Type: list of paths

Default: [ ]

Example:

["${pkgs.deviceTree_rpi.overlays}/w1-gpio.dtbo"]

Declared by:

<nixpkgs/nixos/modules/hardware/device-tree.nix>
hardware.digitalbitbox.enable

Enables udev rules for Digital Bitbox devices.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/digitalbitbox.nix>
hardware.digitalbitbox.package

The Digital Bitbox package to use. This can be used to install a package with udev rules that differ from the defaults.

Type: package

Default: "pkgs.digitalbitbox"

Declared by:

<nixpkgs/nixos/modules/hardware/digitalbitbox.nix>
hardware.facetimehd.enable

Whether to enable facetimehd kernel module.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/video/webcam/facetimehd.nix>
hardware.fancontrol.enable

Whether to enable software fan control (requires fancontrol.config).

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/fancontrol.nix>
hardware.fancontrol.config

Fancontrol configuration file content. See pwmconfig(8) from the lm_sensors package.

Type: strings concatenated with "\n"

Default: null

Example:

''
# Configuration file generated by pwmconfig
INTERVAL=10
DEVPATH=hwmon3=devices/virtual/thermal/thermal_zone2 hwmon4=devices/platform/f71882fg.656
DEVNAME=hwmon3=soc_dts1 hwmon4=f71869a
FCTEMPS=hwmon4/device/pwm1=hwmon3/temp1_input
FCFANS= hwmon4/device/pwm1=hwmon4/device/fan1_input
MINTEMP=hwmon4/device/pwm1=35
MAXTEMP=hwmon4/device/pwm1=65
MINSTART=hwmon4/device/pwm1=150
MINSTOP=hwmon4/device/pwm1=0
''

Declared by:

<nixpkgs/nixos/modules/services/hardware/fancontrol.nix>
hardware.firmware

List of packages containing firmware files. Such files will be loaded automatically if the kernel asks for them (i.e., when it has detected specific hardware that requires firmware to function). If multiple packages contain firmware files with the same name, the first package in the list takes precedence. Note that you must rebuild your system if you add files to any of these directories.

Type: list of packages

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/hardware/udev.nix>
hardware.ksm.enable

Whether to enable Kernel Same-Page Merging.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/ksm.nix>
hardware.ksm.sleep

How many milliseconds ksmd should sleep between scans. Setting it to null uses the kernel's default time.

Type: null or signed integer

Default: null

Declared by:

<nixpkgs/nixos/modules/hardware/ksm.nix>
hardware.ledger.enable

Whether to enable udev rules for Ledger devices.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/ledger.nix>
hardware.logitech.enable

Whether to enable Logitech Devices.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/logitech.nix>
hardware.logitech.enableGraphical

Enable graphical support applications.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/logitech.nix>
hardware.mcelog.enable

Enable the Machine Check Exception logger.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/mcelog.nix>
hardware.mwProCapture.enable

Whether to enable Magewell Pro Capture family kernel module.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/video/capture/mwprocapture.nix>
hardware.nitrokey.enable

Enables udev rules for Nitrokey devices. By default grants access to users in the "nitrokey" group. You may want to install the nitrokey-app package, depending on your device and needs.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/nitrokey.nix>
hardware.nitrokey.group

Grant access to Nitrokey devices to users in this group.

Type: string

Default: "nitrokey"

Example: "wheel"

Declared by:

<nixpkgs/nixos/modules/hardware/nitrokey.nix>
hardware.nvidia.modesetting.enable

Enable kernel modesetting when using the NVIDIA proprietary driver.

Enabling this fixes screen tearing when using Optimus via PRIME (see hardware.nvidia.optimus_prime.enable. This is not enabled by default because it is not officially supported by NVIDIA and would not work with SLI.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/video/nvidia.nix>
hardware.nvidia.optimus_prime.enable

Enable NVIDIA Optimus support using the NVIDIA proprietary driver via PRIME. If enabled, the NVIDIA GPU will be always on and used for all rendering, while enabling output to displays attached only to the integrated Intel GPU without a multiplexer.

Note that this option only has any effect if the "nvidia" driver is specified in services.xserver.videoDrivers, and it should preferably be the only driver there.

If this is enabled, then the bus IDs of the NVIDIA and Intel GPUs have to be specified (hardware.nvidia.optimus_prime.nvidiaBusId and hardware.nvidia.optimus_prime.intelBusId).

If you enable this, you may want to also enable kernel modesetting for the NVIDIA driver (hardware.nvidia.modesetting.enable) in order to prevent tearing.

Note that this configuration will only be successful when a display manager for which the services.xserver.displayManager.setupCommands option is supported is used.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/video/nvidia.nix>
hardware.nvidia.optimus_prime.allowExternalGpu

Configure X to allow external NVIDIA GPUs when using optimus.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/video/nvidia.nix>
hardware.nvidia.optimus_prime.intelBusId

Bus ID of the Intel GPU. You can find it using lspci; for example if lspci shows the Intel GPU at "00:02.0", set this option to "PCI:0:2:0".

Type: string

Default: ""

Example: "PCI:0:2:0"

Declared by:

<nixpkgs/nixos/modules/hardware/video/nvidia.nix>
hardware.nvidia.optimus_prime.nvidiaBusId

Bus ID of the NVIDIA GPU. You can find it using lspci; for example if lspci shows the NVIDIA GPU at "01:00.0", set this option to "PCI:1:0:0".

Type: string

Default: ""

Example: "PCI:1:0:0"

Declared by:

<nixpkgs/nixos/modules/hardware/video/nvidia.nix>
hardware.nvidiaOptimus.disable

Completely disable the NVIDIA graphics card and use the integrated graphics processor instead.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/hardware/nvidia-optimus.nix>
hardware.onlykey.enable

Enable OnlyKey device (https://crp.to/p/) support.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/onlykey.nix>
hardware.opengl.enable

Whether to enable OpenGL drivers. This is needed to enable OpenGL support in X11 systems, as well as for Wayland compositors like sway and Weston. It is enabled by default by the corresponding modules, so you do not usually have to set it yourself, only if there is no module for your wayland compositor of choice. See services.xserver.enable and programs.sway.enable.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/opengl.nix>
hardware.opengl.driSupport

Whether to enable accelerated OpenGL rendering through the Direct Rendering Interface (DRI).

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/hardware/opengl.nix>
hardware.opengl.driSupport32Bit

On 64-bit systems, whether to support Direct Rendering for 32-bit applications (such as Wine). This is currently only supported for the nvidia and ati_unfree drivers, as well as Mesa.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/opengl.nix>
hardware.opengl.extraPackages

Additional packages to add to OpenGL drivers. This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc.

Type: list of packages

Default: [ ]

Example:

with pkgs; [ vaapiIntel libvdpau-va-gl vaapiVdpau intel-ocl ]

Declared by:

<nixpkgs/nixos/modules/hardware/opengl.nix>
hardware.opengl.extraPackages32

Additional packages to add to 32-bit OpenGL drivers on 64-bit systems. Used when driSupport32Bit is set. This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc.

Type: list of packages

Default: [ ]

Example:

with pkgs.pkgsi686Linux; [ vaapiIntel libvdpau-va-gl vaapiVdpau ]

Declared by:

<nixpkgs/nixos/modules/hardware/opengl.nix>
hardware.opengl.s3tcSupport

Make S3TC(S3 Texture Compression) via libtxc_dxtn available to OpenGL drivers instead of the patent-free S2TC replacement.

Using this library may require a patent license depending on your location.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/opengl.nix>
hardware.openrazer.enable

Whether to enable OpenRazer drivers and userspace daemon.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/openrazer.nix>
hardware.openrazer.devicesOffOnScreensaver

Turn off the devices when the systems screensaver kicks in.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/hardware/openrazer.nix>
hardware.openrazer.keyStatistics

Collects number of keypresses per hour per key used to generate a heatmap.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/openrazer.nix>
hardware.openrazer.mouseBatteryNotifier

Mouse battery notifier.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/hardware/openrazer.nix>
hardware.openrazer.syncEffectsEnabled

Set the sync effects flag to true so any assignment of effects will work across devices.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/hardware/openrazer.nix>
hardware.openrazer.verboseLogging

Whether to enable verbose logging. Logs debug messages.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/openrazer.nix>
hardware.parallels.enable

This enables Parallels Tools for Linux guests, along with provided video, mouse and other hardware drivers.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/virtualisation/parallels-guest.nix>
hardware.parallels.package

Defines which package to use for prl-tools. Override to change the version.

Type: package

Default: "config.boot.kernelPackages.prl-tools"

Example:

config.boot.kernelPackages.prl-tools

Declared by:

<nixpkgs/nixos/modules/virtualisation/parallels-guest.nix>
hardware.parallels.autoMountShares

Control prlfsmountd service. When this service is running, shares can not be manually mounted through `mount -t prl_fs ...` as this service will remount and trample any set options. Recommended to enable for simple file sharing, but extended share use such as for code should disable this to manually mount shares.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/virtualisation/parallels-guest.nix>
hardware.pcmcia.enable

Enable this option to support PCMCIA card.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/pcmcia.nix>
hardware.pcmcia.config

Path to the configuration file which maps the memory, IRQs and ports used by the PCMCIA hardware.

Type: unspecified

Default: null

Declared by:

<nixpkgs/nixos/modules/hardware/pcmcia.nix>
hardware.pcmcia.firmware

List of firmware used to handle specific PCMCIA card.

Type: list of paths

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/hardware/pcmcia.nix>
hardware.printers.ensureDefaultPrinter

Ensures the named printer is the default CUPS printer / printer queue.

Type: null or printable string without spaces, # and /

Default: null

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters

Will regularly ensure that the given CUPS printers are configured as declared here. If a printer's options are manually changed afterwards, they will be overwritten eventually. This option will never delete any printer, even if removed from this list. You can check existing printers with lpstat -s and remove printers with lpadmin -x <printer-name>. Printers not listed here can still be manually configured.

Type: list of submodules

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters.*.description

Optional human-readable description.

Type: null or string

Default: null

Example: "Brother HL-5140"

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters.*.deviceUri

How to reach the printer. lpinfo -v shows a list of supported device URIs and schemes.

Type: string

Example: [ "ipp://printserver.local/printers/BrotherHL_Workroom" "usb://HP/DESKJET%20940C?serial=CN16E6C364BH" ]

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters.*.location

Optional human-readable location.

Type: null or string

Default: null

Example: "Workroom"

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters.*.model

Location of the ppd driver file for the printer. lpinfo -m shows a list of supported models.

Type: string

Example:

gutenprint.${lib.version.majorMinor (lib.getVersion pkgs.cups)}://brother-hl-5140/expert

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters.*.name

Name of the printer / printer queue. May contain any printable characters except "/", "#", and space.

Type: printable string without spaces, # and /

Example: "BrotherHL_Workroom"

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.printers.ensurePrinters.*.ppdOptions

Sets PPD options for the printer. lpoptions [-p printername] -l shows suported PPD options for the given printer.

Type: attribute set of strings

Default: { }

Example: { Duplex = "DuplexNoTumble"; PageSize = "A4"; }

Declared by:

<nixpkgs/nixos/modules/hardware/printers.nix>
hardware.pulseaudio.enable

Whether to enable the PulseAudio sound server.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.package

The PulseAudio derivation to use. This can be used to enable features (such as JACK support, Bluetooth) via the pulseaudioFull package.

Type: package

Default: "pkgs.pulseaudio"

Example:

pkgs.pulseaudioFull

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.configFile

The path to the default configuration options the PulseAudio server should use. By default, the "default.pa" configuration from the PulseAudio distribution is used.

Type: null or path

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.daemon.config

Config of the pulse daemon. See man pulse-daemon.conf.

Type: attribute set of unspecifieds

Default: { }

Example:

{ realtime-scheduling = "yes"; }

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.daemon.logLevel

The log level that the system-wide pulseaudio daemon should use, if activated.

Type: string

Default: "notice"

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.extraClientConf

Extra configuration appended to pulse/client.conf file.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.extraConfig

Literal string to append to configFile and the config file generated by the pulseaudio module.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.extraModules

Extra pulseaudio modules to use. This is intended for out-of-tree pulseaudio modules like extra bluetooth codecs.

Extra modules take precedence over built-in pulseaudio modules.

Type: list of packages

Default: [ ]

Example:

[ pkgs.pulseaudio-modules-bt ]

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.support32Bit

Whether to include the 32-bit pulseaudio libraries in the system or not. This is only useful on 64-bit systems and currently limited to x86_64-linux.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.systemWide

If false, a PulseAudio server is launched automatically for each user that tries to use the sound system. The server runs with user privileges. If true, one system-wide PulseAudio server is launched on boot, running as the user "pulse", and only users in the "audio" group will have access to the server. Please read the PulseAudio documentation for more details.

Don't enable this option unless you know what you are doing.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.tcp.enable

Whether to enable tcp streaming support.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.tcp.anonymousClients.allowAll

Whether to enable all anonymous clients to stream to the server.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.tcp.anonymousClients.allowedIpRanges

A list of IP subnets that are allowed to stream to the server.

Type: list of strings

Default: [ ]

Example:

[ "127.0.0.1" "192.168.1.0/24" ]

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.zeroconf.discovery.enable

Whether to enable discovery of pulseaudio sinks in the local network.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.pulseaudio.zeroconf.publish.enable

Whether to enable publishing the pulseaudio sink in the local network.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/config/pulseaudio.nix>
hardware.raid.HPSmartArray.enable

Whether to enable HP Smart Array kernel modules and CLI utility.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/raid/hpsa.nix>
hardware.sane.enable

Enable support for SANE scanners.

Note: Users in the "scanner" group will gain access to the scanner, or the "lp" group if it's also a printer.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane.nix>
hardware.sane.brscan4.enable

When enabled, will automatically register the "brscan4" sane backend and bring configuration files to their expected location.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
hardware.sane.brscan4.netDevices

The list of network devices that will be registered against the brscan4 sane backend.

Type: list or attribute set of submodules

Default: { }

Example: { office1 = { ip = "192.168.1.2"; model = "MFC-7860DW"; } ; office2 = { model = "MFC-7860DW"; nodename = "BRW0080927AFBCE"; } ; }

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
hardware.sane.brscan4.netDevices.<name?>.ip

The ip address of the device. If undefined, you will have to provide a nodename.

Type: null or string

Default: null

Example:

192.168.1.2

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
hardware.sane.brscan4.netDevices.<name?>.model

The model of the network device.

Type: string

Example:

MFC-7860DW

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
hardware.sane.brscan4.netDevices.<name?>.name

The friendly name you give to the network device. If undefined, the name of attribute will be used.

Type: string

Example:

office1

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
hardware.sane.brscan4.netDevices.<name?>.nodename

The node name of the device. If undefined, you will have to provide an ip.

Type: null or string

Default: null

Example:

BRW0080927AFBCE

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
hardware.sane.dsseries.enable

When enabled, will automatically register the "dsseries" SANE backend.

This supports the Brother DSmobile scanner series, including the DS-620, DS-720D, DS-820W, and DS-920DW scanners.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/dsseries.nix>
hardware.sane.extraBackends

Packages providing extra SANE backends to enable.

Note: The example contains the package for HP scanners.

Type: list of paths

Default: [ ]

Example:

[ pkgs.hplipWithPlugin ]

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane.nix>
hardware.sane.netConf

Network hosts that should be probed for remote scanners.

Type: strings concatenated with "\n"

Default: ""

Example: "192.168.0.16"

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane.nix>
hardware.sane.snapshot

Use a development snapshot of SANE scanner drivers.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/hardware/sane.nix>
hardware.sensor.iio.enable

Enable this option to support IIO sensors.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/sensor/iio.nix>
hardware.steam-hardware.enable

Enable udev rules for Steam hardware such as the Steam Controller, other supported controllers and the HTC Vive

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/steam-hardware.nix>
hardware.trackpoint.enable

Enable sensitivity and speed configuration for trackpoints.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/trackpoint.nix>
hardware.trackpoint.device

The device name of the trackpoint. You can check with xinput. Some newer devices (example x1c6) use "TPPS/2 Elan TrackPoint".

Type: string

Default: "TPPS/2 IBM TrackPoint"

Declared by:

<nixpkgs/nixos/modules/tasks/trackpoint.nix>
hardware.trackpoint.emulateWheel

Enable scrolling while holding the middle mouse button.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/trackpoint.nix>
hardware.trackpoint.fakeButtons

Switch to "bare" PS/2 mouse support in case Trackpoint buttons are not recognized properly. This can happen for example on models like the L430, T450, T450s, on which the Trackpoint buttons are actually a part of the Synaptics touchpad.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/trackpoint.nix>
hardware.trackpoint.sensitivity

Configure the trackpoint sensitivity. By default, the kernel configures 128.

Type: signed integer

Default: 128

Example: 255

Declared by:

<nixpkgs/nixos/modules/tasks/trackpoint.nix>
hardware.trackpoint.speed

Configure the trackpoint speed. By default, the kernel configures 97.

Type: signed integer

Default: 97

Example: 255

Declared by:

<nixpkgs/nixos/modules/tasks/trackpoint.nix>
hardware.tuxedo-keyboard.enable

Whether to enable Enables the tuxedo-keyboard driver.

To configure the driver, pass the options to the boot.kernelParams configuration. There are several parameters you can change. It's best to check at the source code description which options are supported. You can find all the supported parameters at: https://github.com/tuxedocomputers/tuxedo-keyboard#kernelparam

In order to use the custom lighting with the maximumg brightness and a color of 0xff0a0a one would put pass boot.kernelParams like this:

boot.kernelParams = [
 "tuxedo_keyboard.mode=0"
 "tuxedo_keyboard.brightness=255"
 "tuxedo_keyboard.color_left=0xff0a0a"
];

.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/hardware/tuxedo-keyboard.nix>
hardware.u2f.enable

Enable U2F hardware support.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/hardware/u2f.nix>
hardware.usbWwan.enable

Enable this option to support USB WWAN adapters.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/usb-wwan.nix>
i18n.defaultLocale

The default locale. It determines the language for program messages, the format for dates and times, sort order, and so on. It also determines the character set, such as UTF-8.

Type: string

Default: "en_US.UTF-8"

Example: "nl_NL.UTF-8"

Declared by:

<nixpkgs/nixos/modules/config/i18n.nix>
i18n.extraLocaleSettings

A set of additional system-wide locale settings other than LANG which can be configured with i18n.defaultLocale.

Type: attribute set of strings

Default: { }

Example: { LC_MESSAGES = "en_US.UTF-8"; LC_TIME = "de_DE.UTF-8"; }

Declared by:

<nixpkgs/nixos/modules/config/i18n.nix>
i18n.glibcLocales

Customized pkg.glibcLocales package.

Changing this option can disable handling of i18n.defaultLocale and supportedLocale.

Type: path

Default: (build of glibc-locales-2.30)

Example:

pkgs.glibcLocales

Declared by:

<nixpkgs/nixos/modules/config/i18n.nix>
i18n.inputMethod.enabled

Select the enabled input method. Input methods is a software to input symbols that are not available on standard input devices.

Input methods are specially used to input Chinese, Japanese and Korean characters.

Currently the following input methods are available in NixOS:

  • ibus: The intelligent input bus, extra input engines can be added using i18n.inputMethod.ibus.engines.

  • fcitx: A customizable lightweight input method, extra input engines can be added using i18n.inputMethod.fcitx.engines.

  • nabi: A Korean input method based on XIM. Nabi doesn't support Qt 5.

  • uim: The universal input method, is a library with a XIM bridge. uim mainly support Chinese, Japanese and Korean.

Type: null or one of "ibus", "fcitx", "nabi", "uim"

Default: null

Example: "fcitx"

Declared by:

<nixpkgs/nixos/modules/i18n/input-method/default.nix>
i18n.inputMethod.fcitx.engines

Enabled Fcitx engines. Available engines are: anthy, chewing, cloudpinyin, hangul, libpinyin, m17n, mozc, rime, skk, table-extra, table-other, unikey.

Type: list of packages

Default: [ ]

Example:

with pkgs.fcitx-engines; [ mozc hangul ]

Declared by:

<nixpkgs/nixos/modules/i18n/input-method/fcitx.nix>
i18n.inputMethod.ibus.engines

Enabled IBus engines. Available engines are: anthy, hangul, kkc, libpinyin, m17n, mozc, table, table-chinese, table-others, typing-booster, typing-booster-unwrapped, uniemoji.

Type: list of packages

Default: [ ]

Example:

with pkgs.ibus-engines; [ mozc hangul ]

Declared by:

<nixpkgs/nixos/modules/i18n/input-method/ibus.nix>
i18n.inputMethod.ibus.panel

Replace the IBus panel with another panel.

Type: null or path

Default: null

Example:

''${pkgs.plasma5.plasma-desktop}/lib/libexec/kimpanel-ibus-panel

Declared by:

<nixpkgs/nixos/modules/i18n/input-method/ibus.nix>
i18n.inputMethod.uim.toolbar

selected UIM toolbar.

Type: one of "gtk", "gtk3", "gtk-systray", "gtk3-systray", "qt4"

Default: "gtk"

Example: "gtk-systray"

Declared by:

<nixpkgs/nixos/modules/i18n/input-method/uim.nix>
i18n.supportedLocales

List of locales that the system should support. The value "all" means that all locales supported by Glibc will be installed. A full list of supported locales can be found at https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED.

Type: list of strings

Default: [ "all" ]

Example: [ "en_US.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "nl_NL/ISO-8859-1" ]

Declared by:

<nixpkgs/nixos/modules/config/i18n.nix>
krb5.enable

Whether to enable building krb5.conf, configuration file for Kerberos V.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.appdefaults

Settings used by some Kerberos V5 applications.

Type: attribute set or strings concatenated with "\n"

Default: { }

Example:

{
  pam = {
    debug = false;
    ticket_lifetime = 36000;
    renew_lifetime = 36000;
    max_timeout = 30;
    timeout_shift = 2;
    initial_timeout = 1;
  };
};

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.capaths

Authentication paths for non-hierarchical cross-realm authentication.

Type: attribute set or strings concatenated with "\n"

Default: { }

Example:

{
  "ATHENA.MIT.EDU" = {
    "EXAMPLE.COM" = ".";
  };
  "EXAMPLE.COM" = {
    "ATHENA.MIT.EDU" = ".";
  };
};

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.config

Verbatim krb5.conf configuration. Note that this is mutually exclusive with configuration via libdefaults, realms, domain_realm, capaths, appdefaults, plugins and extraConfig configuration options. Consult man krb5.conf for documentation.

Type: null or strings concatenated with "\n"

Default: null

Example:

''
[libdefaults]
  default_realm = EXAMPLE.COM

[realms]
  EXAMPLE.COM = {
    admin_server = kerberos.example.com
    kdc = kerberos.example.com
    default_principal_flags = +preauth
  }

[domain_realm]
  example.com  = EXAMPLE.COM
  .example.com = EXAMPLE.COM

[logging]
  kdc          = SYSLOG:NOTICE
  admin_server = SYSLOG:NOTICE
  default      = SYSLOG:NOTICE
''

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.defaultRealm

DEPRECATED, please use krb5.libdefaults.default_realm.

Type: null or string

Default: null

Example: "ATHENA.MIT.EDU"

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.domainRealm

DEPRECATED, please create a map of server hostnames to Kerberos realms in krb5.domain_realm.

Type: null or string

Default: null

Example: "athena.mit.edu"

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.domain_realm

Map of server hostnames to Kerberos realms.

Type: attribute set or strings concatenated with "\n"

Default: { }

Example:

{
  "example.com" = "EXAMPLE.COM";
  ".example.com" = "EXAMPLE.COM";
};

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.extraConfig

These lines go to the end of krb5.conf verbatim. krb5.conf may include any of the relations that are valid for kdc.conf (see man kdc.conf), but it is not a recommended practice.

Type: null or strings concatenated with "\n"

Default: null

Example:

''
[logging]
  kdc          = SYSLOG:NOTICE
  admin_server = SYSLOG:NOTICE
  default      = SYSLOG:NOTICE
''

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.kdc

DEPRECATED, please pass a kdc attribute to a realm in krb5.realms.

Type: null or string

Default: null

Example: "kerberos.mit.edu"

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.kerberos

The Kerberos implementation that will be present in environment.systemPackages after enabling this service.

Type: package

Default: "pkgs.krb5Full"

Example:

pkgs.heimdalFull

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.kerberosAdminServer

DEPRECATED, please pass an admin_server attribute to a realm in krb5.realms.

Type: null or string

Default: null

Example: "kerberos.mit.edu"

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.libdefaults

Settings used by the Kerberos V5 library.

Type: attribute set or strings concatenated with "\n"

Default: { }

Example:

{
  default_realm = "ATHENA.MIT.EDU";
};

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.plugins

Controls plugin module registration.

Type: attribute set or strings concatenated with "\n"

Default: { }

Example:

{
  ccselect = {
    disable = "k5identity";
  };
};

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
krb5.realms

Realm-specific contact information and settings.

Type: attribute set or strings concatenated with "\n"

Default: { }

Example:

{
  "ATHENA.MIT.EDU" = {
    admin_server = "athena.mit.edu";
    kdc = "athena.mit.edu";
  };
};

Declared by:

<nixpkgs/nixos/modules/config/krb5/default.nix>
lib

This option allows modules to define helper functions, constants, etc.

Type: attribute set of attribute sets

Default: { }

Declared by:

<nixpkgs/nixos/modules/misc/lib.nix>
location.latitude

Your current latitude, between -90.0 and 90.0. Must be provided along with longitude.

Type: floating point number

Declared by:

<nixpkgs/nixos/modules/config/locale.nix>
location.longitude

Your current longitude, between between -180.0 and 180.0. Must be provided along with latitude.

Type: floating point number

Declared by:

<nixpkgs/nixos/modules/config/locale.nix>
location.provider

The location provider to use for determining your location. If set to manual you must also provide latitude/longitude.

Type: one of "manual", "geoclue2"

Default: "manual"

Declared by:

<nixpkgs/nixos/modules/config/locale.nix>
nesting.children

Additional configurations to build.

Type: unspecified

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/activation/top-level.nix>
nesting.clone

Additional configurations to build based on the current configuration which then has a lower priority.

To switch to a cloned configuration (e.g. child-1) at runtime, run

# sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test

Type: unspecified

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/system/activation/top-level.nix>
networking.enableB43Firmware

Turn on this option if you want firmware for the NICs supported by the b43 module.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/network/b43.nix>
networking.enableIPv6

Whether to enable support for IPv6.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.enableIntel2200BGFirmware

Turn on this option if you want firmware for the Intel PRO/Wireless 2200BG to be loaded automatically. This is required if you want to use this device.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/hardware/network/intel-2200bg.nix>
networking.bonds

This option allows you to define bond devices that aggregate multiple, underlying networking interfaces together. The value of this option is an attribute set. Each attribute specifies a bond, with the attribute name specifying the name of the bond's network interface

Type: attribute set of submodules

Default: { }

Example:

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bonds.<name>.driverOptions

Options for the bonding driver. Documentation can be found in https://www.kernel.org/doc/Documentation/networking/bonding.txt

Type: attribute set of strings

Default: { }

Example:

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bonds.<name>.interfaces

The interfaces to bond together

Type: list of strings

Example: [ "enp4s0f0" "enp4s0f1" "wlan0" ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bonds.<name>.lacp_rate

DEPRECATED, use `driverOptions`. Option specifying the rate in which we'll ask our link partner to transmit LACPDU packets in 802.3ad mode.

Type: null or string

Default: null

Example: "fast"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bonds.<name>.miimon

DEPRECATED, use `driverOptions`. Miimon is the number of millisecond in between each round of polling by the device driver for failed links. By default polling is not enabled and the driver is trusted to properly detect and handle failure scenarios.

Type: null or signed integer

Default: null

Example: 100

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bonds.<name>.mode

DEPRECATED, use `driverOptions`. The mode which the bond will be running. The default mode for the bonding driver is balance-rr, optimizing for throughput. More information about valid modes can be found at https://www.kernel.org/doc/Documentation/networking/bonding.txt

Type: null or string

Default: null

Example: "active-backup"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bonds.<name>.xmit_hash_policy

DEPRECATED, use `driverOptions`. Selects the transmit hash policy to use for slave selection in balance-xor, 802.3ad, and tlb modes.

Type: null or string

Default: null

Example: "layer2+3"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bridges

This option allows you to define Ethernet bridge devices that connect physical networks together. The value of this option is an attribute set. Each attribute specifies a bridge, with the attribute name specifying the name of the bridge's network interface.

Type: attribute set of submodules

Default: { }

Example: { br0 = { interfaces = [ "eth0" "eth1" ] ; } ; br1 = { interfaces = [ "eth2" "wlan0" ] ; } ; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bridges.<name>.interfaces

The physical network interfaces connected by the bridge.

Type: list of strings

Example: [ "eth0" "eth1" ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.bridges.<name>.rstp

Whether the bridge interface should enable rstp.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway

The default gateway. It can be left empty if it is auto-detected through DHCP. It can be specified as a string or an option set along with a network interface.

Type: null or submodule or string convertible to it

Default: null

Example: { address = "131.211.84.1"; interface = "enp3s0"; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway.address

The default gateway address.

Type: string

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway.interface

The default gateway interface.

Type: null or string

Default: null

Example: "enp0s3"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway.metric

The default gateway metric/preference.

Type: null or signed integer

Default: null

Example: 42

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway6

The default ipv6 gateway. It can be left empty if it is auto-detected through DHCP. It can be specified as a string or an option set along with a network interface.

Type: null or submodule or string convertible to it

Default: null

Example: { address = "2001:4d0:1e04:895::1"; interface = "enp3s0"; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway6.address

The default gateway address.

Type: string

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway6.interface

The default gateway interface.

Type: null or string

Default: null

Example: "enp0s3"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGateway6.metric

The default gateway metric/preference.

Type: null or signed integer

Default: null

Example: 42

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.defaultGatewayWindowSize

The window size of the default gateway. It limits maximal data bursts that TCP peers are allowed to send to us.

Type: null or signed integer

Default: null

Example: 524288

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.dhcpcd.enable

Whether to enable dhcpcd for device configuration. This is mainly to explicitly disable dhcpcd (for example when using networkd).

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.dhcpcd.allowInterfaces

Enable the DHCP client for any interface whose name matches any of the shell glob patterns in this list. Any interface not explicitly matched by this pattern will be denied. This pattern only applies when non-null.

Type: null or list of strings

Default: null

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.dhcpcd.denyInterfaces

Disable the DHCP client for any interface whose name matches any of the shell glob patterns in this list. The purpose of this option is to blacklist virtual interfaces such as those created by Xen, libvirt, LXC, etc.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.dhcpcd.extraConfig

Literal string to append to the config file generated for dhcpcd.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.dhcpcd.persistent

Whenever to leave interfaces configured on dhcpcd daemon shutdown. Set to true if you have your root or store mounted over the network or this machine accepts SSH connections through DHCP interfaces and clients should be notified when it shuts down.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.dhcpcd.runHook

Shell code that will be run after all other hooks. See `man dhcpcd-run-hooks` for details on what is possible.

Type: strings concatenated with "\n"

Default: ""

Example: "if [[ \$reason =~ BOUND ]]; then echo \$interface: Routers are \$new_routers - were \$old_routers; fi"

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.dhcpcd.wait

This option specifies when the dhcpcd service will fork to background. If set to "background", dhcpcd will fork to background immediately. If set to "ipv4" or "ipv6", dhcpcd will wait for the corresponding IP address to be assigned. If set to "any", dhcpcd will wait for any type (IPv4 or IPv6) to be assigned. If set to "both", dhcpcd will wait for both an IPv4 and an IPv6 address before forking. The option "if-carrier-up" is equivalent to "any" if either ethernet is plugged nor WiFi is powered, and to "background" otherwise.

Type: one of "background", "any", "ipv4", "ipv6", "both", "if-carrier-up"

Default: "any"

Declared by:

<nixpkgs/nixos/modules/services/networking/dhcpcd.nix>
networking.domain

The domain. It can be left empty if it is auto-detected through DHCP.

Type: null or string

Default: null

Example: "home"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.extraHosts

Additional verbatim entries to be appended to /etc/hosts.

Type: strings concatenated with "\n"

Default: ""

Example: "192.168.0.1 lanlocalhost"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.firewall.enable

Whether to enable the firewall. This is a simple stateful firewall that blocks connection attempts to unauthorised TCP or UDP ports on this machine. It does not affect packet forwarding.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.package

The iptables package to use for running the firewall service."

Type: package

Default: "pkgs.iptables"

Example:

pkgs.iptables-nftables-compat

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.allowPing

Whether to respond to incoming ICMPv4 echo requests ("pings"). ICMPv6 pings are always allowed because the larger address space of IPv6 makes network scanning much less effective.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.allowedTCPPortRanges

A range of TCP ports on which incoming connections are accepted.

Type: list of attribute set of 16 bit unsigned integer; between 0 and 65535 (both inclusive)ss

Default: [ ]

Example: [ { from = 8999; to = 9003; } ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.allowedTCPPorts

List of TCP ports on which incoming connections are accepted.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)s

Default: [ ]

Example: [ 22 80 ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.allowedUDPPortRanges

Range of open UDP ports.

Type: list of attribute set of 16 bit unsigned integer; between 0 and 65535 (both inclusive)ss

Default: [ ]

Example: [ { from = 60000; to = 61000; } ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.allowedUDPPorts

List of open UDP ports.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)s

Default: [ ]

Example: [ 53 ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.autoLoadConntrackHelpers

Whether to auto-load connection-tracking helpers. See the description at networking.firewall.connectionTrackingModules

(needs kernel 3.5+)

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.checkReversePath

Performs a reverse path filter test on a packet. If a reply to the packet would not be sent via the same interface that the packet arrived on, it is refused.

If using asymmetric routing or other complicated routing, set this option to loose mode or disable it and setup your own counter-measures.

This option can be either true (or "strict"), "loose" (only drop the packet if the source address is not reachable via any interface) or false. Defaults to the value of kernelHasRPFilter.

(needs kernel 3.3+)

Type: boolean or one of "strict", "loose"

Default: true

Example: "loose"

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.connectionTrackingModules

List of connection-tracking helpers that are auto-loaded. The complete list of possible values is given in the example.

As helpers can pose as a security risk, it is advised to set this to an empty list and disable the setting networking.firewall.autoLoadConntrackHelpers unless you know what you are doing. Connection tracking is disabled by default.

Loading of helpers is recommended to be done through the CT target. More info: https://home.regit.org/netfilter-en/secure-use-of-helpers/

Type: list of strings

Default: [ ]

Example: [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.extraCommands

Additional shell commands executed as part of the firewall initialisation script. These are executed just before the final "reject" firewall rule is added, so they can be used to allow packets that would otherwise be refused.

Type: strings concatenated with "\n"

Default: ""

Example: "iptables -A INPUT -p icmp -j ACCEPT"

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.extraPackages

Additional packages to be included in the environment of the system as well as the path of networking.firewall.extraCommands.

Type: list of packages

Default: [ ]

Example:

[ pkgs.ipset ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.extraStopCommands

Additional shell commands executed as part of the firewall shutdown script. These are executed just after the removal of the NixOS input rule, or if the service enters a failed state.

Type: strings concatenated with "\n"

Default: ""

Example: "iptables -P INPUT ACCEPT"

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.interfaces

Interface-specific open ports.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.interfaces.<name>.allowedTCPPortRanges

A range of TCP ports on which incoming connections are accepted.

Type: list of attribute set of 16 bit unsigned integer; between 0 and 65535 (both inclusive)ss

Default: [ ]

Example: [ { from = 8999; to = 9003; } ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.interfaces.<name>.allowedTCPPorts

List of TCP ports on which incoming connections are accepted.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)s

Default: [ ]

Example: [ 22 80 ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.interfaces.<name>.allowedUDPPortRanges

Range of open UDP ports.

Type: list of attribute set of 16 bit unsigned integer; between 0 and 65535 (both inclusive)ss

Default: [ ]

Example: [ { from = 60000; to = 61000; } ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.interfaces.<name>.allowedUDPPorts

List of open UDP ports.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)s

Default: [ ]

Example: [ 53 ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.logRefusedConnections

Whether to log rejected or dropped incoming connections.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.logRefusedPackets

Whether to log all rejected or dropped incoming packets. This tends to give a lot of log messages, so it's mostly useful for debugging.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.logRefusedUnicastsOnly

If networking.firewall.logRefusedPackets and this option are enabled, then only log packets specifically directed at this machine, i.e., not broadcasts or multicasts.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.logReversePathDrops

Logs dropped packets failing the reverse path filter test if the option networking.firewall.checkReversePath is enabled.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.pingLimit

If pings are allowed, this allows setting rate limits on them. If non-null, this option should be in the form of flags like "--limit 1/minute --limit-burst 5"

Type: null or strings concatenated with " "

Default: null

Example: "--limit 1/minute --limit-burst 5"

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.rejectPackets

If set, refused packets are rejected rather than dropped (ignored). This means that an ICMP "port unreachable" error message is sent back to the client (or a TCP RST packet in case of an existing connection). Rejecting packets makes port scanning somewhat easier.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.firewall.trustedInterfaces

Traffic coming in from these interfaces will be accepted unconditionally. Traffic from the loopback (lo) interface will always be accepted.

Type: list of strings

Default: [ ]

Example: [ "enp0s2" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/firewall.nix>
networking.hostId

The 32-bit host ID of the machine, formatted as 8 hexadecimal characters.

You should try to make this ID unique among your machines. You can generate a random 32-bit ID using the following commands:

head -c 8 /etc/machine-id

(this derives it from the machine-id that systemd generates) or

head -c4 /dev/urandom | od -A none -t x4

Type: null or string

Default: null

Example: "4e98920d"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.hostName

The name of the machine. Leave it empty if you want to obtain it from a DHCP server (if using DHCP).

Type: string

Default: "nixos"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.hosts

Locally defined maps of hostnames to IP addresses.

Type: attribute set of list of stringss

Example:

{
  "127.0.0.1" = [ "foo.bar.baz" ];
  "192.168.0.2" = [ "fileserver.local" "nameserver.local" ];
};

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.interfaces

The configuration for each network interface. If networking.useDHCP is true, then every interface not listed here will be configured using DHCP.

Type: list or attribute set of submodules

Default: { }

Example: { eth0 = { ipv4 = { addresses = [ { address = "131.211.84.78"; prefixLength = 25; } ] ; } ; } ; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.addresses

List of IPv4 addresses that will be statically assigned to the interface.

Type: list of submodules

Default: [ ]

Example: [ { address = "10.0.0.1"; prefixLength = 16; } { address = "192.168.1.1"; prefixLength = 24; } ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.addresses.*.address

IPv4 address of the interface. Leave empty to configure the interface using DHCP.

Type: string

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.addresses.*.prefixLength

Subnet mask of the interface, specified as the number of bits in the prefix (24).

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.routes

List of extra IPv4 static routes that will be assigned to the interface.

Type: list of submodules

Default: [ ]

Example: [ { address = "10.0.0.0"; prefixLength = 16; } { address = "192.168.2.0"; prefixLength = 24; via = "192.168.1.1"; } ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.routes.*.address

IPv4 address of the network.

Type: string

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.routes.*.options

Other route options. See the symbol OPTIONS in the ip-route(8) manual page for the details.

Type: attribute set of strings

Default: { }

Example: { mtu = "1492"; window = "524288"; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.routes.*.prefixLength

Subnet mask of the network, specified as the number of bits in the prefix (24).

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv4.routes.*.via

IPv4 address of the next hop.

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.addresses

List of IPv6 addresses that will be statically assigned to the interface.

Type: list of submodules

Default: [ ]

Example: [ { address = "fdfd:b3f0:482::1"; prefixLength = 48; } { address = "2001:1470:fffd:2098::e006"; prefixLength = 64; } ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.addresses.*.address

IPv6 address of the interface. Leave empty to configure the interface using DHCP.

Type: string

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.addresses.*.prefixLength

Subnet mask of the interface, specified as the number of bits in the prefix (64).

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.routes

List of extra IPv6 static routes that will be assigned to the interface.

Type: list of submodules

Default: [ ]

Example: [ { address = "fdfd:b3f0::"; prefixLength = 48; } { address = "2001:1470:fffd:2098::"; prefixLength = 64; via = "fdfd:b3f0::1"; } ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.routes.*.address

IPv6 address of the network.

Type: string

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.routes.*.options

Other route options. See the symbol OPTIONS in the ip-route(8) manual page for the details.

Type: attribute set of strings

Default: { }

Example: { mtu = "1492"; window = "524288"; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.routes.*.prefixLength

Subnet mask of the network, specified as the number of bits in the prefix (64).

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.ipv6.routes.*.via

IPv6 address of the next hop.

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.macAddress

MAC address of the interface. Leave empty to use the default.

Type: null or string

Default: null

Example: "00:11:22:33:44:55"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.mtu

MTU size for packets leaving the interface. Leave empty to use the default.

Type: null or signed integer

Default: null

Example: 9000

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.name

Name of the interface.

Type: string

Example: "eth0"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.proxyARP

Turn on proxy_arp for this device (and proxy_ndp for ipv6). This is mainly useful for creating pseudo-bridges between a real interface and a virtual network such as VPN or a virtual machine for interfaces that don't support real bridging (most wlan interfaces). As ARP proxying acts slightly above the link-layer, below-ip traffic isn't bridged, so things like DHCP won't work. The advantage above using NAT lies in the fact that no IP addresses are shared, so all hosts are reachable/routeable.

WARNING: turns on ip-routing, so if you have multiple interfaces, you should think of the consequence and setup firewall rules to limit this.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.tempAddress

When IPv6 is enabled with SLAAC, this option controls the use of temporary address (aka privacy extensions). This is used to reduce tracking. The three possible values are:

  • "default" to generate temporary addresses and use them by default;

  • "enabled" to generate temporary addresses but keep using the standard EUI-64 ones by default;

  • "disabled" to completely disable temporary addresses.

Type: one of "default", "enabled", "disabled"

Default: if cfg.enableIPv6 then "default" else "disabled"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.useDHCP

Whether this interface should be configured with dhcp. Null implies the old behavior which depends on whether ip addresses are specified or not.

Type: null or boolean

Default: null

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.virtual

Whether this interface is virtual and should be created by tunctl. This is mainly useful for creating bridges between a host and a virtual network such as VPN or a virtual machine.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.virtualOwner

In case of a virtual device, the user who owns it.

Type: string

Default: "root"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.interfaces.<name?>.virtualType

The type of interface to create. The default is TUN for an interface name starting with "tun", otherwise TAP.

Type: one of "tun", "tap"

Default: if hasPrefix "tun" name then "tun" else "tap"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.iproute2.enable

Whether to enable copy IP route configuration files.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/config/iproute2.nix>
networking.iproute2.rttablesExtraConfig

Verbatim lines to add to /etc/iproute2/rt_tables

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/iproute2.nix>
networking.localCommands

Shell commands to be executed at the end of the network-setup systemd service. Note that if you are using DHCP to obtain the network configuration, interfaces may not be fully configured yet.

Type: strings concatenated with "\n"

Default: ""

Example: "text=anything; echo You can put \$text here."

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.macvlans

This option allows you to define macvlan interfaces which should be automatically created.

Type: attribute set of submodules

Default: { }

Example:

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.macvlans.<name>.interface

The interface the macvlan will transmit packets through.

Type: string

Example: "enp4s0"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.macvlans.<name>.mode

The mode of the macvlan device.

Type: null or string

Default: null

Example: "vepa"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.nameservers

The list of nameservers. It can be left empty if it is auto-detected through DHCP.

Type: list of strings

Default: [ ]

Example: [ "130.161.158.4" "130.161.33.17" ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.nat.enable

Whether to enable Network Address Translation (NAT).

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.dmzHost

The local IP address to which all traffic that does not match any forwarding rule is forwarded.

Type: null or string

Default: null

Example: "10.0.0.1"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.externalIP

The public IP address to which packets from the local network are to be rewritten. If this is left empty, the IP address associated with the external interface will be used.

Type: null or string

Default: null

Example: "203.0.113.123"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.externalInterface

The name of the external network interface.

Type: null or string

Default: null

Example: "eth1"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.extraCommands

Additional shell commands executed as part of the nat initialisation script.

Type: strings concatenated with "\n"

Default: ""

Example: "iptables -A INPUT -p icmp -j ACCEPT"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.extraStopCommands

Additional shell commands executed as part of the nat teardown script.

Type: strings concatenated with "\n"

Default: ""

Example: "iptables -D INPUT -p icmp -j ACCEPT || true"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.forwardPorts

List of forwarded ports from the external interface to internal destinations by using DNAT.

Type: list of submodules

Default: [ ]

Example: [ { destination = "10.0.0.1:80"; proto = "tcp"; sourcePort = 8080; } ]

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.forwardPorts.*.destination

Forward connection to destination ip:port; to specify a port range, use ip:start-end

Type: string

Example: "10.0.0.1:80"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.forwardPorts.*.loopbackIPs

Public IPs for NAT reflection; for connections to `loopbackip:sourcePort' from the host itself and from other hosts behind NAT

Type: list of strings

Default: [ ]

Example:

[ "55.1.2.3" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.forwardPorts.*.proto

Protocol of forwarded connection

Type: string

Default: "tcp"

Example: "udp"

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.forwardPorts.*.sourcePort

Source port of the external interface; to specify a port range, use a string with a colon (e.g. "60000:61000")

Type: signed integer or string matching the pattern [[:digit:]]+:[[:digit:]]+

Example: 8080

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.internalIPs

The IP address ranges for which to perform NAT. Packets coming from these addresses (on any interface) and destined for the external interface will be rewritten.

Type: list of strings

Default: [ ]

Example: [ "192.168.1.0/24" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.nat.internalInterfaces

The interfaces for which to perform NAT. Packets coming from these interface and destined for the external interface will be rewritten.

Type: list of strings

Default: [ ]

Example: [ "eth0" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/nat.nix>
networking.networkmanager.enable

Whether to use NetworkManager to obtain an IP address and other configuration for all network interfaces that are not manually configured. If enabled, a group networkmanager will be created. Add all users that should have permission to change network settings to this group.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.enableStrongSwan

Enable the StrongSwan plugin.

If you enable this option the networkmanager_strongswan plugin will be added to the networking.networkmanager.packages option so you don't need to to that yourself.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.packages

Extra packages that provide NetworkManager plugins.

Type: list of packages

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.appendNameservers

A list of name servers that should be appended to the ones configured in NetworkManager or received by DHCP.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.dhcp

Which program (or internal library) should be used for DHCP.

Type: one of "dhclient", "dhcpcd", "internal"

Default: "internal"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.dispatcherScripts

A list of scripts which will be executed in response to network events.

Type: list of submodules

Default: [ ]

Example:

[ {
      source = pkgs.writeText "upHook" ''

        if [ "$2" != "up" ]; then
            logger "exit: event $2 != up"
            exit
        fi

        # coreutils and iproute are in PATH too
        logger "Device $DEVICE_IFACE coming up"
    '';
    type = "basic";
} ]

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.dispatcherScripts.*.source

Path to the hook script.

Type: path

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.dispatcherScripts.*.type

Dispatcher hook type. Look up the hooks described at https://developer.gnome.org/NetworkManager/stable/NetworkManager.html and choose the type depending on the output folder. You should then filter the event type (e.g., "up"/"down") from within your script.

Type: one of "basic", "pre-down", "pre-up"

Default: "basic"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.dns

Set the DNS (resolv.conf) processing mode.

A description of these modes can be found in the main section of https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html or in NetworkManager.conf(5).

Type: one of "default", "dnsmasq", "unbound", "systemd-resolved", "none"

Default: "default"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.ethernet.macAddress

Set the MAC address of the interface.

"XX:XX:XX:XX:XX:XX"

MAC address of the interface

"permanent"

Use the permanent MAC address of the device

"preserve"

Don’t change the MAC address of the device upon activation

"random"

Generate a randomized value upon each connect

"stable"

Generate a stable, hashed MAC address

Type: string or one of "permanent", "preserve", "random", "stable"

Default: "preserve"

Example: "00:11:22:33:44:55"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.extraConfig

Configuration appended to the generated NetworkManager.conf. Refer to https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html or NetworkManager.conf(5) for more information.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.insertNameservers

A list of name servers that should be inserted before the ones configured in NetworkManager or received by DHCP.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.logLevel

Set the default logging verbosity level.

Type: one of "OFF", "ERR", "WARN", "INFO", "DEBUG", "TRACE"

Default: "WARN"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.unmanaged

List of interfaces that will not be managed by NetworkManager. Interface name can be specified here, but if you need more fidelity, refer to https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html#device-spec or the "Device List Format" Appendix of NetworkManager.conf(5).

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.wifi.backend

Specify the Wi-Fi backend used for the device. Currently supported are wpa_supplicant or iwd (experimental).

Type: one of "wpa_supplicant", "iwd"

Default: "wpa_supplicant"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.wifi.macAddress

Set the MAC address of the interface.

"XX:XX:XX:XX:XX:XX"

MAC address of the interface

"permanent"

Use the permanent MAC address of the device

"preserve"

Don’t change the MAC address of the device upon activation

"random"

Generate a randomized value upon each connect

"stable"

Generate a stable, hashed MAC address

Type: string or one of "permanent", "preserve", "random", "stable"

Default: "preserve"

Example: "00:11:22:33:44:55"

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.wifi.powersave

Whether to enable Wi-Fi power saving.

Type: null or boolean

Default: null

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.networkmanager.wifi.scanRandMacAddress

Whether to enable MAC address randomization of a Wi-Fi device during scanning.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/networking/networkmanager.nix>
networking.nftables.enable

Whether to enable nftables. nftables is a Linux-based packet filtering framework intended to replace frameworks like iptables.

This conflicts with the standard networking firewall, so make sure to disable it before using nftables.

Note that if you have Docker enabled you will not be able to use nftables without intervention. Docker uses iptables internally to setup NAT for containers. This module disables the ip_tables kernel module, however Docker automatically loads the module. Please see [1] for more information.

There are other programs that use iptables internally too, such as libvirt.

[1]: https://github.com/NixOS/nixpkgs/issues/24318#issuecomment-289216273

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/nftables.nix>
networking.nftables.ruleset

The ruleset to be used with nftables. Should be in a format that can be loaded using "/bin/nft -f". The ruleset is updated atomically.

Type: strings concatenated with "\n"

Example:

''
# Check out https://wiki.nftables.org/ for better documentation.
# Table for both IPv4 and IPv6.
table inet filter {
  # Block all incomming connections traffic except SSH and "ping".
  chain input {
    type filter hook input priority 0;

    # accept any localhost traffic
    iifname lo accept

    # accept traffic originated from us
    ct state {established, related} accept

    # ICMP
    # routers may also want: mld-listener-query, nd-router-solicit
    ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
    ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept

    # allow "ping"
    ip6 nexthdr icmp icmpv6 type echo-request accept
    ip protocol icmp icmp type echo-request accept

    # accept SSH connections (required for a server)
    tcp dport 22 accept

    # count and drop any other traffic
    counter drop
  }

  # Allow all outgoing connections.
  chain output {
    type filter hook output priority 0;
    accept
  }

  chain forward {
    type filter hook forward priority 0;
    accept
  }
}
''

Declared by:

<nixpkgs/nixos/modules/services/networking/nftables.nix>
networking.nftables.rulesetFile

The ruleset file to be used with nftables. Should be in a format that can be loaded using "nft -f". The ruleset is updated atomically.

Type: path

Default: (build of nftables-rules)

Declared by:

<nixpkgs/nixos/modules/services/networking/nftables.nix>
networking.proxy.allProxy

This option specifies the all_proxy environment variable.

Type: null or string

Default: null

Example: "http://127.0.0.1:3128"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.proxy.default

This option specifies the default value for httpProxy, httpsProxy, ftpProxy and rsyncProxy.

Type: null or string

Default: null

Example: "http://127.0.0.1:3128"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.proxy.ftpProxy

This option specifies the ftp_proxy environment variable.

Type: null or string

Default: null

Example: "http://127.0.0.1:3128"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.proxy.httpProxy

This option specifies the http_proxy environment variable.

Type: null or string

Default: null

Example: "http://127.0.0.1:3128"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.proxy.httpsProxy

This option specifies the https_proxy environment variable.

Type: null or string

Default: null

Example: "http://127.0.0.1:3128"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.proxy.noProxy

This option specifies the no_proxy environment variable. If a default proxy is used and noProxy is null, then noProxy will be set to 127.0.0.1,localhost.

Type: null or string

Default: null

Example: "127.0.0.1,localhost,.localdomain"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.proxy.rsyncProxy

This option specifies the rsync_proxy environment variable.

Type: null or string

Default: null

Example: "http://127.0.0.1:3128"

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.resolvconf.dnsExtensionMechanism

Enable the edns0 option in resolv.conf. With that option set, glibc supports use of the extension mechanisms for DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC, which does not work without it.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/resolvconf.nix>
networking.resolvconf.dnsSingleRequest

Recent versions of glibc will issue both ipv4 (A) and ipv6 (AAAA) address queries at the same time, from the same port. Sometimes upstream routers will systemically drop the ipv4 queries. The symptom of this problem is that 'getent hosts example.com' only returns ipv6 (or perhaps only ipv4) addresses. The workaround for this is to specify the option 'single-request' in /etc/resolv.conf. This option enables that.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/resolvconf.nix>
networking.resolvconf.extraConfig

Extra configuration to append to resolvconf.conf.

Type: strings concatenated with "\n"

Default: ""

Example: "libc=NO"

Declared by:

<nixpkgs/nixos/modules/config/resolvconf.nix>
networking.resolvconf.extraOptions

Set the options in /etc/resolv.conf.

Type: list of strings

Default: [ ]

Example: [ "ndots:1" "rotate" ]

Declared by:

<nixpkgs/nixos/modules/config/resolvconf.nix>
networking.resolvconf.useLocalResolver

Use local DNS server for resolving.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/resolvconf.nix>
networking.rxe.enable

Whether to enable RDMA over converged ethernet.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/networking/rxe.nix>
networking.rxe.interfaces

Enable RDMA on the listed interfaces. The corresponding virtual RDMA interfaces will be named rxe0 ... rxeN where the ordering will be as they are named in the list. UDP port 4791 must be open on the respective ethernet interfaces.

Type: list of strings

Default: [ ]

Example: [ "eth0" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/rxe.nix>
networking.search

The list of search paths used when resolving domain names.

Type: list of strings

Default: [ ]

Example: [ "example.com" "local.domain" ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.sits

This option allows you to define 6-to-4 interfaces which should be automatically created.

Type: attribute set of submodules

Default: { }

Example:

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.sits.<name>.dev

The underlying network device on which the tunnel resides.

Type: null or string

Default: null

Example: "enp4s0f0"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.sits.<name>.local

The address of the local endpoint which the remote side should send packets to.

Type: null or string

Default: null

Example: "10.0.0.22"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.sits.<name>.remote

The address of the remote endpoint to forward traffic over.

Type: null or string

Default: null

Example: "10.0.0.1"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.sits.<name>.ttl

The time-to-live of the connection to the remote tunnel endpoint.

Type: null or signed integer

Default: null

Example: 255

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.supplicant

Interfaces for which to start wpa_supplicant. The supplicant is used to scan for and associate with wireless networks, or to authenticate with 802.1x capable network switches.

The value of this option is an attribute set. Each attribute configures a wpa_supplicant service, where the attribute name specifies the name of the interface that wpa_supplicant operates on. The attribute name can be a space separated list of interfaces. The attribute names WLAN, LAN and DBUS have a special meaning. WLAN and LAN are configurations for universal wpa_supplicant service that is started for each WLAN interface or for each LAN interface, respectively. DBUS defines a device-unrelated wpa_supplicant service that can be accessed through D-Bus.

Type: attribute set of submodules

Default: { }

Example:

{ "wlan0 wlan1" = {
    configFile.path = "/etc/wpa_supplicant.conf";
    userControlled.group = "network";
    extraConf = ''
      ap_scan=1
      p2p_disabled=1
    '';
    extraCmdArgs = "-u -W";
    bridge = "br0";
  };
}

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.bridge

Name of the bridge interface that wpa_supplicant should listen at.

Type: string

Default: ""

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.configFile.path

External wpa_supplicant.conf configuration file. The configuration options defined declaratively within networking.supplicant have precedence over options defined in configFile.

Type: null or path

Default: null

Example:

/etc/wpa_supplicant.conf

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.configFile.writable

Whether the configuration file at configFile.path should be written to by wpa_supplicant.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.driver

Force a specific wpa_supplicant driver.

Type: null or string

Default: "nl80211,wext"

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.extraCmdArgs

Command line arguments to add when executing wpa_supplicant.

Type: string

Default: ""

Example: "-e/run/wpa_supplicant/entropy.bin"

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.extraConf

Configuration options for wpa_supplicant.conf. Options defined here have precedence over options in configFile. NOTE: Do not write sensitive data into extraConf as it will be world-readable in the nix-store. For sensitive information use the configFile instead.

Type: strings concatenated with "\n"

Default: ""

Example:

''
ap_scan=1
device_name=My-NixOS-Device
device_type=1-0050F204-1
driver_param=use_p2p_group_interface=1
disable_scan_offload=1
p2p_listen_reg_class=81
p2p_listen_channel=1
p2p_oper_reg_class=81
p2p_oper_channel=1
manufacturer=NixOS
model_name=NixOS_Unstable
model_number=2015
''

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.userControlled.enable

Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli. This is useful for laptop users that switch networks a lot and don't want to depend on a large package such as NetworkManager just to pick nearby access points.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.userControlled.group

Members of this group can control wpa_supplicant.

Type: string

Default: "wheel"

Example: "network"

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.supplicant.<name>.userControlled.socketDir

Directory of sockets for controlling wpa_supplicant.

Type: string

Default: "/run/wpa_supplicant"

Declared by:

<nixpkgs/nixos/modules/services/networking/supplicant.nix>
networking.tcpcrypt.enable

Whether to enable opportunistic TCP encryption. If the other end speaks Tcpcrypt, then your traffic will be encrypted; otherwise it will be sent in clear text. Thus, Tcpcrypt alone provides no guarantees -- it is best effort. If, however, a Tcpcrypt connection is successful and any attackers that exist are passive, then Tcpcrypt guarantees privacy.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/tcpcrypt.nix>
networking.timeServers

The set of NTP servers from which to synchronise.

Type: unspecified

Default: [ "0.nixos.pool.ntp.org" "1.nixos.pool.ntp.org" "2.nixos.pool.ntp.org" "3.nixos.pool.ntp.org" ]

Declared by:

<nixpkgs/nixos/modules/config/networking.nix>
networking.useDHCP

Whether to use DHCP to obtain an IP address and other configuration for all network interfaces that are not manually configured.

Using this option is highly discouraged and also incompatible with networking.useNetworkd. Please use networking.interfaces.<name>.useDHCP instead and set this to false.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.useHostResolvConf

In containers, whether to use the resolv.conf supplied by the host.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.useNetworkd

Whether we should use networkd as the network configuration backend or the legacy script based system. Note that this option is experimental, enable at your own risk.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.usePredictableInterfaceNames

Whether to assign predictable names to network interfaces. If enabled, interfaces are assigned names that contain topology information (e.g. wlp3s0) and thus should be stable across reboots. If disabled, names depend on the order in which interfaces are discovered by the kernel, which may change randomly across reboots; for instance, you may find eth0 and eth1 flipping unpredictably.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/hardware/udev.nix>
networking.vlans

This option allows you to define vlan devices that tag packets on top of a physical interface. The value of this option is an attribute set. Each attribute specifies a vlan, with the name specifying the name of the vlan interface.

Type: attribute set of submodules

Default: { }

Example:

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vlans.<name>.id

The vlan identifier

Type: signed integer

Example: 1

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vlans.<name>.interface

The interface the vlan will transmit packets through.

Type: string

Example: "enp4s0"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vswitches

This option allows you to define Open vSwitches that connect physical networks together. The value of this option is an attribute set. Each attribute specifies a vswitch, with the attribute name specifying the name of the vswitch's network interface.

Type: attribute set of submodules

Default: { }

Example: { vs0 = { interfaces = [ "eth0" "eth1" ] ; } ; vs1 = { interfaces = [ "eth2" "wlan0" ] ; } ; }

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vswitches.<name>.controllers

Specify the controller targets. For the allowed options see man 8 ovs-vsctl.

Type: list of strings

Default: [ ]

Example: [ "ptcp:6653:[::1]" ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vswitches.<name>.extraOvsctlCmds

Commands to manipulate the Open vSwitch database. Every line executed with ovs-vsctl. All commands are bundled together with the operations for adding the interfaces into one atomic operation.

Type: strings concatenated with "\n"

Default: ""

Example:

''
set-fail-mode <switch_name> secure
set Bridge <switch_name> stp_enable=true
''

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vswitches.<name>.interfaces

The physical network interfaces connected by the vSwitch.

Type: list of strings

Example: [ "eth0" "eth1" ]

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.vswitches.<name>.openFlowRules

OpenFlow rules to insert into the Open vSwitch. All openFlowRules are loaded with ovs-ofctl within one atomic operation.

Type: strings concatenated with "\n"

Default: ""

Example:

''
actions=normal
''

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wg-quick.interfaces

Wireguard interfaces.

Type: attribute set of submodules

Default: { }

Example: { wg0 = { address = [ "192.168.20.4/24" ] ; peers = [ { allowedIPs = [ "192.168.20.1/32" ] ; endpoint = "demo.wireguard.io:12913"; publicKey = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="; } ] ; privateKey = "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk="; } ; }

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.address

The IP addresses of the interface.

Type: list of strings

Default: [ ]

Example: [ "192.168.2.1/24" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.dns

The IP addresses of DNS servers to configure.

Type: list of strings

Default: [ ]

Example: [ "192.168.2.2" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.listenPort

16-bit port for listening. Optional; if not specified, automatically generated based on interface name.

Type: null or signed integer

Default: null

Example: 51820

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.mtu

If not specified, the MTU is automatically determined from the endpoint addresses or the system default route, which is usually a sane choice. However, to manually specify an MTU to override this automatic discovery, this value may be specified explicitly.

Type: null or signed integer

Default: null

Example: 1248

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers

Peers linked to the interface.

Type: list of submodules

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers.*.allowedIPs

List of IP (v4 or v6) addresses with CIDR masks from which this peer is allowed to send incoming traffic and to which outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may be specified for matching all IPv4 addresses, and ::/0 may be specified for matching all IPv6 addresses.

Type: list of strings

Example: [ "10.192.122.3/32" "10.192.124.1/24" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers.*.endpoint

Endpoint IP or hostname of the peer, followed by a colon, and then a port number of the peer.

Type: null or string

Default: null

Example: "demo.wireguard.io:12913"

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers.*.persistentKeepalive

This is optional and is by default off, because most users will not need it. It represents, in seconds, between 1 and 65535 inclusive, how often to send an authenticated empty packet to the peer, for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds; however, most users will not need this.

Type: null or signed integer

Default: null

Example: 25

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers.*.presharedKey

Base64 preshared key generated by wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

Warning: Consider using presharedKeyFile instead if you do not want to store the key in the world-readable Nix store.

Type: null or string

Default: null

Example: "rVXs/Ni9tu3oDBLS4hOyAUAa1qTWVA3loR8eL20os3I="

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers.*.presharedKeyFile

File pointing to preshared key as generated by wg pensk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

Type: null or string

Default: null

Example: "/private/wireguard_psk"

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.peers.*.publicKey

The base64 public key the peer.

Type: string

Example: "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.postDown

Command called after the interface is taken down.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

${pkgs.iproute}/bin/ip netns del foo

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.postUp

Commands called after the interface setup.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

${pkgs.iproute}/bin/ip netns add foo

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.preDown

Command called before the interface is taken down.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

${pkgs.iproute}/bin/ip netns del foo

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.preUp

Commands called at the start of the interface setup.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

${pkgs.iproute}/bin/ip netns add foo

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.privateKey

Base64 private key generated by wg genkey.

Warning: Consider using privateKeyFile instead if you do not want to store the key in the world-readable Nix store.

Type: null or string

Default: null

Example: "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk="

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.privateKeyFile

Private key file as generated by wg genkey.

Type: null or string

Default: null

Example: "/private/wireguard_key"

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wg-quick.interfaces.<name>.table

The kernel routing table to add this interface's associated routes to. Setting this is useful for e.g. policy routing ("ip rule") or virtual routing and forwarding ("ip vrf"). Both numeric table IDs and table names (/etc/rt_tables) can be used. Defaults to "main".

Type: null or string

Default: null

Example: "main"

Declared by:

<nixpkgs/nixos/modules/services/networking/wg-quick.nix>
networking.wicd.enable

Whether to start wicd. Wired and wireless network configurations can then be managed by wicd-client.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/wicd.nix>
networking.wireguard.enable

Whether to enable WireGuard.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces

WireGuard interfaces.

Type: attribute set of submodules

Default: { }

Example: { wg0 = { ips = [ "192.168.20.4/24" ] ; peers = [ { allowedIPs = [ "192.168.20.1/32" ] ; endpoint = "demo.wireguard.io:12913"; publicKey = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="; } ] ; privateKey = "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk="; } ; }

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.allowedIPsAsRoutes

Determines whether to add allowed IPs as routes or not.

Type: boolean

Default: true

Example: false

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.generatePrivateKeyFile

Automatically generate a private key with wg genkey, at the privateKeyFile location.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.interfaceNamespace

The pre-existing network namespace the WireGuard interface is moved to. The special value init means the init namespace. When null, the interface is not moved. See documentation.

Type: null or string

Default: null

Example: "init"

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.ips

The IP addresses of the interface.

Type: list of strings

Default: [ ]

Example: [ "192.168.2.1/24" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.listenPort

16-bit port for listening. Optional; if not specified, automatically generated based on interface name.

Type: null or signed integer

Default: null

Example: 51820

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers

Peers linked to the interface.

Type: list of submodules

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers.*.allowedIPs

List of IP (v4 or v6) addresses with CIDR masks from which this peer is allowed to send incoming traffic and to which outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may be specified for matching all IPv4 addresses, and ::/0 may be specified for matching all IPv6 addresses.

Type: list of strings

Example: [ "10.192.122.3/32" "10.192.124.1/24" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers.*.endpoint

Endpoint IP or hostname of the peer, followed by a colon, and then a port number of the peer.

Type: null or string

Default: null

Example: "demo.wireguard.io:12913"

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers.*.persistentKeepalive

This is optional and is by default off, because most users will not need it. It represents, in seconds, between 1 and 65535 inclusive, how often to send an authenticated empty packet to the peer, for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds; however, most users will not need this.

Type: null or signed integer

Default: null

Example: 25

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers.*.presharedKey

Base64 preshared key generated by wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

Warning: Consider using presharedKeyFile instead if you do not want to store the key in the world-readable Nix store.

Type: null or string

Default: null

Example: "rVXs/Ni9tu3oDBLS4hOyAUAa1qTWVA3loR8eL20os3I="

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers.*.presharedKeyFile

File pointing to preshared key as generated by wg pensk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

Type: null or string

Default: null

Example: "/private/wireguard_psk"

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.peers.*.publicKey

The base64 public key of the peer.

Type: string

Example: "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.postSetup

Commands called at the end of the interface setup.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

printf "nameserver 10.200.100.1" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.postShutdown

Commands called after shutting down the interface.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

${pkgs.openresolv}/bin/resolvconf -d wg0

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.preSetup

Commands called at the start of the interface setup.

Type: strings concatenated with "\n" or list of strings convertible to it

Default: ""

Example:

${pkgs.iproute}/bin/ip netns add foo

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.privateKey

Base64 private key generated by wg genkey.

Warning: Consider using privateKeyFile instead if you do not want to store the key in the world-readable Nix store.

Type: null or string

Default: null

Example: "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk="

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.privateKeyFile

Private key file as generated by wg genkey.

Type: null or string

Default: null

Example: "/private/wireguard_key"

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.socketNamespace

The pre-existing network namespace in which the WireGuard interface is created, and which retains the socket even if the interface is moved via interfaceNamespace. When null, the interface is created in the init namespace. See documentation.

Type: null or string

Default: null

Example: "container"

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireguard.interfaces.<name>.table

The kernel routing table to add this interface's associated routes to. Setting this is useful for e.g. policy routing ("ip rule") or virtual routing and forwarding ("ip vrf"). Both numeric table IDs and table names (/etc/rt_tables) can be used. Defaults to "main".

Type: string

Default: "main"

Declared by:

<nixpkgs/nixos/modules/services/networking/wireguard.nix>
networking.wireless.enable

Whether to enable wpa_supplicant.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.driver

Force a specific wpa_supplicant driver.

Type: string

Default: "nl80211,wext"

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.extraConfig

Extra lines appended to the configuration file. See wpa_supplicant.conf(5) for available options.

Type: string

Default: ""

Example:

''
p2p_disabled=1
''

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.interfaces

The interfaces wpa_supplicant will use. If empty, it will automatically use all wireless interfaces.

Type: list of strings

Default: [ ]

Example: [ "wlan0" "wlan1" ]

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.iwd.enable

Whether to enable iwd.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/networking/iwd.nix>
networking.wireless.networks

The network definitions to automatically connect to when wpa_supplicant is running. If this parameter is left empty wpa_supplicant will use /etc/wpa_supplicant.conf as the configuration file.

Type: attribute set of submodules

Default: { }

Example:

{ echelon = {                   # SSID with no spaces or special characters
    psk = "abcdefgh";
  };
  "echelon's AP" = {            # SSID with spaces and/or special characters
     psk = "ijklmnop";
  };
  "free.wifi" = {};             # Public wireless network
}

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.networks.<name>.auth

Use this option to configure advanced authentication methods like EAP. See wpa_supplicant.conf(5) for example configurations.

Mutually exclusive with psk and pskRaw.

Type: null or string

Default: null

Example:

''
key_mgmt=WPA-EAP
eap=PEAP
identity="user@example.com"
password="secret"
''

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.networks.<name>.extraConfig

Extra configuration lines appended to the network block. See wpa_supplicant.conf(5) for available options.

Type: string

Default: ""

Example:

''
bssid_blacklist=02:11:22:33:44:55 02:22:aa:44:55:66
''

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.networks.<name>.hidden

Set this to true if the SSID of the network is hidden.

Type: boolean

Default: false

Example:

{ echelon = {
    hidden = true;
    psk = "abcdefgh";
  };
}

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.networks.<name>.priority

By default, all networks will get same priority group (0). If some of the networks are more desirable, this field can be used to change the order in which wpa_supplicant goes through the networks when selecting a BSS. The priority groups will be iterated in decreasing priority (i.e., the larger the priority value, the sooner the network is matched against the scan results). Within each priority group, networks will be selected based on security policy, signal strength, etc.

Type: null or signed integer

Default: null

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.networks.<name>.psk

The network's pre-shared key in plaintext defaulting to being a network without any authentication.

Be aware that these will be written to the nix store in plaintext!

Mutually exclusive with pskRaw.

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.networks.<name>.pskRaw

The network's pre-shared key in hex defaulting to being a network without any authentication.

Mutually exclusive with psk.

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.userControlled.enable

Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli. This is useful for laptop users that switch networks a lot and don't want to depend on a large package such as NetworkManager just to pick nearby access points.

When using a declarative network specification you cannot persist any settings via wpa_gui or wpa_cli.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wireless.userControlled.group

Members of this group can control wpa_supplicant.

Type: string

Default: "wheel"

Example: "network"

Declared by:

<nixpkgs/nixos/modules/services/networking/wpa_supplicant.nix>
networking.wlanInterfaces

Creating multiple WLAN interfaces on top of one physical WLAN device (NIC).

The name of the WLAN interface corresponds to the name of the attribute. A NIC is referenced by the persistent device name of the WLAN interface that udev assigns to a NIC by default. If a NIC supports multiple WLAN interfaces, then the one NIC can be used as device for multiple WLAN interfaces. If a NIC is used for creating WLAN interfaces, then the default WLAN interface with a persistent device name form udev is not created. A WLAN interface with the persistent name assigned from udev would have to be created explicitly.

Type: attribute set of submodules

Default: { }

Example:

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wlanInterfaces.<name>.device

The name of the underlying hardware WLAN device as assigned by udev.

Type: string

Example: "wlp6s0"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wlanInterfaces.<name>.flags

Flags for interface of type monitor.

Type: null or one of "none", "fcsfail", "control", "otherbss", "cook", "active"

Default: null

Example: "control"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wlanInterfaces.<name>.fourAddr

Whether to enable 4-address mode with type managed.

Type: null or boolean

Default: null

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wlanInterfaces.<name>.mac

MAC address to use for the device. If null, then the MAC of the underlying hardware WLAN device is used.

INFO: Locally administered MAC addresses are of the form:

  • x2:xx:xx:xx:xx:xx

  • x6:xx:xx:xx:xx:xx

  • xA:xx:xx:xx:xx:xx

  • xE:xx:xx:xx:xx:xx

Type: null or string

Default: null

Example: "02:00:00:00:00:01"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wlanInterfaces.<name>.meshID

MeshID of interface with type mesh.

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
networking.wlanInterfaces.<name>.type

The type of the WLAN interface. The type has to be supported by the underlying hardware of the device.

Type: one of "managed", "ibss", "monitor", "mesh", "wds"

Default: "managed"

Example: "ibss"

Declared by:

<nixpkgs/nixos/modules/tasks/network-interfaces.nix>
nix.package

This option specifies the Nix package instance to use throughout the system.

Type: package

Default: "pkgs.nix"

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.allowedUsers

A list of names of users (separated by whitespace) that are allowed to connect to the Nix daemon. As with nix.trustedUsers, you can specify groups by prefixing them with @. Also, you can allow all users by specifying *. The default is *. Note that trusted users are always allowed to connect.

Type: list of strings

Default: [ "*" ]

Example: [ "@wheel" "@builders" "alice" "bob" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.autoOptimiseStore

If set to true, Nix automatically detects files in the store that have identical contents, and replaces them with hard links to a single copy. This saves disk space. If set to false (the default), you can still run nix-store --optimise to get rid of duplicate files.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.binaryCachePublicKeys

List of public keys used to sign binary caches. If nix.requireSignedBinaryCaches is enabled, then Nix will use a binary from a binary cache if and only if it is signed by any of the keys listed here. By default, only the key for cache.nixos.org is included.

Type: list of strings

Example: [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.binaryCaches

List of binary cache URLs used to obtain pre-built binaries of Nix packages.

By default https://cache.nixos.org/ is added, to override it use lib.mkForce [].

Type: list of strings

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.buildCores

This option defines the maximum number of concurrent tasks during one build. It affects, e.g., -j option for make. The special value 0 means that the builder should use all available CPU cores in the system. Some builds may become non-deterministic with this option; use with care! Packages will only be affected if enableParallelBuilding is set for them.

Type: signed integer

Default: 0

Example: 64

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.buildMachines

This option lists the machines to be used if distributed builds are enabled (see nix.distributedBuilds). Nix will perform derivations on those machines via SSH by copying the inputs to the Nix store on the remote machine, starting the build, then copying the output back to the local Nix store. Each element of the list should be an attribute set containing the machine's host name (hostname), the user name to be used for the SSH connection (sshUser), the Nix system type (system, e.g., "i686-linux"), the maximum number of jobs to be run in parallel on that machine (maxJobs), the path to the SSH private key to be used to connect (sshKey), a list of supported features of the machine (supportedFeatures) and a list of mandatory features of the machine (mandatoryFeatures). The SSH private key should not have a passphrase, and the corresponding public key should be added to ~sshUser/authorized_keys on the remote machine.

Type: list of attribute sets

Default: [ ]

Example:

[ { hostName = "voila.labs.cs.uu.nl";
    sshUser = "nix";
    sshKey = "/root/.ssh/id_buildfarm";
    system = "powerpc-darwin";
    maxJobs = 1;
  }
  { hostName = "linux64.example.org";
    sshUser = "buildfarm";
    sshKey = "/root/.ssh/id_buildfarm";
    system = "x86_64-linux";
    maxJobs = 2;
    speedFactor = 2;
    supportedFeatures = [ "kvm" ];
    mandatoryFeatures = [ "perf" ];
  }
]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.checkConfig

If enabled (the default), checks that Nix can parse the generated nix.conf.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.daemonIONiceLevel

Nix daemon process I/O priority. This priority propagates to build processes. 0 is the default Unix process I/O priority, 7 is the lowest.

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.daemonNiceLevel

Nix daemon process priority. This priority propagates to build processes. 0 is the default Unix process priority, 19 is the lowest.

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.distributedBuilds

Whether to distribute builds to the machines listed in nix.buildMachines.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.extraOptions

Additional text appended to nix.conf.

Type: strings concatenated with "\n"

Default: ""

Example:

''
keep-outputs = true
keep-derivations = true
''

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.gc.automatic

Automatically run the garbage collector at a specific time.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-gc.nix>
nix.gc.dates

Specification (in the format described by systemd.time(7)) of the time at which the garbage collector will run.

Type: string

Default: "03:15"

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-gc.nix>
nix.gc.options

Options given to nix-collect-garbage when the garbage collector is run automatically.

Type: string

Default: ""

Example: "--max-freed \$((64 * 1024**3))"

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-gc.nix>
nix.maxJobs

This option defines the maximum number of jobs that Nix will try to build in parallel. The default is 1. You should generally set it to the total number of logical cores in your system (e.g., 16 for two CPUs with 4 cores each and hyper-threading).

Type: signed integer or one of "auto"

Default: 1

Example: 64

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.nixPath

The default Nix expression search path, used by the Nix evaluator to look up paths enclosed in angle brackets (e.g. <nixpkgs>).

Type: list of strings

Default: [ "nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos" "nixos-config=/etc/nixos/configuration.nix" "/nix/var/nix/profiles/per-user/root/channels" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.nrBuildUsers

Number of nixbld user accounts created to perform secure concurrent builds. If you receive an error message saying that “all build users are currently in use”, you should increase this value.

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.optimise.automatic

Automatically run the nix store optimiser at a specific time.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-optimise.nix>
nix.optimise.dates

Specification (in the format described by systemd.time(7)) of the time at which the optimiser will run.

Type: list of strings

Default: [ "03:45" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-optimise.nix>
nix.readOnlyStore

If set, NixOS will enforce the immutability of the Nix store by making /nix/store a read-only bind mount. Nix will automatically make the store writable when needed.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.registry

A system-wide flake registry.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.registry.<name>.exact

Whether the from reference needs to match exactly. If set, a from reference like nixpkgs does not match with a reference like nixpkgs/nixos-20.03.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.registry.<name>.flake

The flake input to which from> is to be rewritten.

Type: unspecified

Default: null

Example:

nixpkgs

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.registry.<name>.from

The flake reference to be rewritten.

Type: attribute set of string or signed integer or boolean or packages

Example: { id = "nixpkgs"; type = "indirect"; }

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.registry.<name>.to

The flake reference to which from> is to be rewritten.

Type: attribute set of string or signed integer or boolean or packages

Example: { owner = "my-org"; repo = "my-nixpkgs"; type = "github"; }

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.requireSignedBinaryCaches

If enabled (the default), Nix will only download binaries from binary caches if they are cryptographically signed with any of the keys listed in nix.binaryCachePublicKeys. If disabled, signatures are neither required nor checked, so it's strongly recommended that you use only trustworthy caches and https to prevent man-in-the-middle attacks.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.sandboxPaths

Directories from the host filesystem to be included in the sandbox.

Type: list of strings

Default: [ ]

Example: [ "/dev" "/proc" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.sshServe.enable

Whether to enable serving the Nix store as a remote store via SSH.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-ssh-serve.nix>
nix.sshServe.keys

A list of SSH public keys allowed to access the binary cache via SSH.

Type: list of strings

Default: [ ]

Example: [ "ssh-dss AAAAB3NzaC1k... alice@example.org" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-ssh-serve.nix>
nix.sshServe.protocol

The specific Nix-over-SSH protocol to use.

Type: one of "ssh", "ssh-ng"

Default: "ssh"

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-ssh-serve.nix>
nix.systemFeatures

The supported features of a machine

Type: list of strings

Example: [ "kvm" "big-parallel" "gccarch-skylake" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.trustedBinaryCaches

List of binary cache URLs that non-root users can use (in addition to those specified using nix.binaryCaches) by passing --option binary-caches to Nix commands.

Type: list of strings

Default: [ ]

Example: [ "https://hydra.nixos.org/" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.trustedUsers

A list of names of users that have additional rights when connecting to the Nix daemon, such as the ability to specify additional binary caches, or to import unsigned NARs. You can also specify groups by prefixing them with @; for instance, @wheel means all users in the wheel group.

Type: list of strings

Default: [ "root" ]

Example: [ "root" "alice" "@wheel" ]

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nix.useSandbox

If set, Nix will perform builds in a sandboxed environment that it will set up automatically for each build. This prevents impurities in builds by disallowing access to dependencies outside of the Nix store by using network and mount namespaces in a chroot environment. This is enabled by default even though it has a possible performance impact due to the initial setup time of a sandbox for each build. It doesn't affect derivation hashes, so changing this option will not trigger a rebuild of packages.

Type: boolean or one of "relaxed"

Default: true

Declared by:

<nixpkgs/nixos/modules/services/misc/nix-daemon.nix>
nixops.enableDeprecatedAutoLuks

Whether to enable Enable the deprecated NixOps AutoLuks module.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/misc/nixops-autoluks.nix>
nixpkgs.config

The configuration of the Nix Packages collection. (For details, see the Nixpkgs documentation.) It allows you to set package configuration options.

Ignored when nixpkgs.pkgs is set.

Type: nixpkgs config

Default: { }

Example:

{ allowBroken = true; allowUnfree = true; }

Declared by:

<nixpkgs/nixos/modules/misc/nixpkgs.nix>
nixpkgs.crossSystem

Specifies the platform for which NixOS should be built. Specify this only if it is different from nixpkgs.localSystem, the platform on which NixOS should be built. In other words, specify this to cross-compile NixOS. Otherwise it should be set as null, the default. See its description in the Nixpkgs manual for more details.

Ignored when nixpkgs.pkgs is set.

Type: null or attribute set

Default: (import "${nixos}/../lib").lib.systems.examples.aarch64-multiplatform

Example: { config = "aarch64-unknown-linux-gnu"; system = "aarch64-linux"; }

Declared by:

<nixpkgs/nixos/modules/misc/nixpkgs.nix>
nixpkgs.localSystem

Specifies the platform on which NixOS should be built. When nixpkgs.crossSystem is unset, it also specifies the platform for which NixOS should be built. If this option is unset, it defaults to the platform type of the machine where evaluation happens. Specifying this option is useful when doing distributed multi-platform deployment, or when building virtual machines. See its description in the Nixpkgs manual for more details.

Ignored when nixpkgs.pkgs is set.

Type: attribute set

Default: (import "${nixos}/../lib").lib.systems.examples.aarch64-multiplatform

Example: { config = "aarch64-unknown-linux-gnu"; system = "aarch64-linux"; }

Declared by:

<nixpkgs/nixos/modules/misc/nixpkgs.nix>
nixpkgs.overlays

List of overlays to use with the Nix Packages collection. (For details, see the Nixpkgs documentation.) It allows you to override packages globally. Each function in the list takes as an argument the original Nixpkgs. The first argument should be used for finding dependencies, and the second should be used for overriding recipes.

If nixpkgs.pkgs is set, overlays specified here will be applied after the overlays that were already present in nixpkgs.pkgs.

Type: list of nixpkgs overlays

Default: [ ]

Example:

[
  (self: super: {
    openssh = super.openssh.override {
      hpnSupport = true;
      kerberos = self.libkrb5;
    };
  })
]

Declared by:

<nixpkgs/nixos/modules/misc/nixpkgs.nix>
nixpkgs.pkgs

If set, the pkgs argument to all NixOS modules is the value of this option, extended with nixpkgs.overlays, if that is also set. Either nixpkgs.crossSystem or nixpkgs.localSystem will be used in an assertion to check that the NixOS and Nixpkgs architectures match. Any other options in nixpkgs.*, notably config, will be ignored.

If unset, the pkgs argument to all NixOS modules is determined as shown in the default value for this option.

The default value imports the Nixpkgs source files relative to the location of this NixOS module, because NixOS and Nixpkgs are distributed together for consistency, so the nixos in the default value is in fact a relative path. The config, overlays, localSystem, and crossSystem come from this option's siblings.

This option can be used by applications like NixOps to increase the performance of evaluation, or to create packages that depend on a container that should be built with the exact same evaluation of Nixpkgs, for example. Applications like this should set their default value using lib.mkDefault, so user-provided configuration can override it without using lib.

Note that using a distinct version of Nixpkgs with NixOS may be an unexpected source of problems. Use this option with care.

Type: An evaluation of Nixpkgs; the top level attribute set of packages

Default: import "${nixos}/.." { inherit (cfg) config overlays localSystem crossSystem; }

Example:

import <nixpkgs> {}

Declared by:

<nixpkgs/nixos/modules/misc/nixpkgs.nix>
nixpkgs.system

Specifies the Nix platform type on which NixOS should be built. It is better to specify nixpkgs.localSystem instead.

{
  nixpkgs.system = ..;
}

is the same as

{
  nixpkgs.localSystem.system = ..;
}

See nixpkgs.localSystem for more information.

Ignored when nixpkgs.localSystem is set. Ignored when nixpkgs.pkgs is set.

Type: string

Example: "i686-linux"

Declared by:

<nixpkgs/nixos/modules/misc/nixpkgs.nix>
power.ups.enable

Enables support for Power Devices, such as Uninterruptible Power Supplies, Power Distribution Units and Solar Controllers.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.maxStartDelay

This can be set as a global variable above your first UPS definition and it can also be set in a UPS section. This value controls how long upsdrvctl will wait for the driver to finish starting. This keeps your system from getting stuck due to a broken driver or UPS.

Type: signed integer

Default: 45

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.mode

The MODE determines which part of the NUT is to be started, and which configuration files must be modified.

The values of MODE can be:

- none: NUT is not configured, or use the Integrated Power Management, or use some external system to startup NUT components. So nothing is to be started.

- standalone: This mode address a local only configuration, with 1 UPS protecting the local system. This implies to start the 3 NUT layers (driver, upsd and upsmon) and the matching configuration files. This mode can also address UPS redundancy.

- netserver: same as for the standalone configuration, but also need some more ACLs and possibly a specific LISTEN directive in upsd.conf. Since this MODE is opened to the network, a special care should be applied to security concerns.

- netclient: this mode only requires upsmon.

Type: string

Default: "standalone"

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.schedulerRules

File which contains the rules to handle UPS events.

Type: string

Example: "/etc/nixos/upssched.conf"

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups

This is where you configure all the UPSes that this system will be monitoring directly. These are usually attached to serial ports, but USB devices are also supported.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.description

Description of the UPS.

Type: string

Default: ""

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.directives

List of configuration directives for this UPS.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.driver

Specify the program to run to talk to this UPS. apcsmart, bestups, and sec are some examples.

Type: string

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.maxStartDelay

This can be set as a global variable above your first UPS definition and it can also be set in a UPS section. This value controls how long upsdrvctl will wait for the driver to finish starting. This keeps your system from getting stuck due to a broken driver or UPS.

Type: null or signed integer

Default: null

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.port

The serial port to which your UPS is connected. /dev/ttyS0 is usually the first port on Linux boxes, for example.

Type: string

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.shutdownOrder

When you have multiple UPSes on your system, you usually need to turn them off in a certain order. upsdrvctl shuts down all the 0s, then the 1s, 2s, and so on. To exclude a UPS from the shutdown sequence, set this to -1.

Type: signed integer

Default: 0

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
power.ups.ups.<name>.summary

Lines which would be added inside ups.conf for handling this UPS.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/services/monitoring/ups.nix>
powerManagement.enable

Whether to enable power management. This includes support for suspend-to-RAM and powersave features on laptops.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/config/power-management.nix>
powerManagement.cpuFreqGovernor

Configure the governor used to regulate the frequence of the available CPUs. By default, the kernel configures the performance governor, although this may be overwritten in your hardware-configuration.nix file.

Often used values: "ondemand", "powersave", "performance"

Type: null or string

Default: null

Example: "ondemand"

Declared by:

<nixpkgs/nixos/modules/tasks/cpu-freq.nix>
powerManagement.cpufreq.max

The maximum frequency the CPU will use. Defaults to the maximum possible.

Type: null or unsigned integer, meaning >=0

Default: null

Example: 2200000

Declared by:

<nixpkgs/nixos/modules/tasks/cpu-freq.nix>
powerManagement.cpufreq.min

The minimum frequency the CPU will use.

Type: null or unsigned integer, meaning >=0

Default: null

Example: 800000

Declared by:

<nixpkgs/nixos/modules/tasks/cpu-freq.nix>
powerManagement.powerDownCommands

Commands executed when the machine powers down. That is, they're executed both when the system shuts down and when it goes to suspend or hibernation.

Type: strings concatenated with "\n"

Default: ""

Example:

"${pkgs.hdparm}/sbin/hdparm -B 255 /dev/sda"

Declared by:

<nixpkgs/nixos/modules/config/power-management.nix>
powerManagement.powerUpCommands

Commands executed when the machine powers up. That is, they're executed both when the system first boots and when it resumes from suspend or hibernation.

Type: strings concatenated with "\n"

Default: ""

Example:

"${pkgs.hdparm}/sbin/hdparm -B 255 /dev/sda"

Declared by:

<nixpkgs/nixos/modules/config/power-management.nix>
powerManagement.powertop.enable

Whether to enable powertop auto tuning on startup.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/tasks/powertop.nix>
powerManagement.resumeCommands

Commands executed after the system resumes from suspend-to-RAM.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/config/power-management.nix>
powerManagement.scsiLinkPolicy

SCSI link power management policy. The kernel default is "max_performance".

"med_power_with_dipm" is supported by kernel versions 4.15 and newer.

Type: null or one of "min_power", "max_performance", "medium_power", "med_power_with_dipm"

Default: null

Declared by:

<nixpkgs/nixos/modules/tasks/scsi-link-power-management.nix>
programs.adb.enable

Whether to configure system to use Android Debug Bridge (adb). To grant access to a user, it must be part of adbusers group: users.users.alice.extraGroups = ["adbusers"];

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/adb.nix>
programs.atop.settings

Parameters to be written to /etc/atoprc.

Type: attribute set

Default: { }

Example: { flags = "a1f"; interval = 5; }

Declared by:

<nixpkgs/nixos/modules/programs/atop.nix>
programs.autojump.enable

Whether to enable autojump.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/autojump.nix>
programs.bandwhich.enable

Whether to add bandwhich to the global environment and configure a setcap wrapper for it.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/bandwhich.nix>
programs.bash.enableCompletion

Enable Bash completion for all interactive bash shells.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.enableLsColors

Enable extra colors in directory listings.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.interactiveShellInit

Shell script code called during interactive bash shell initialisation.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.loginShellInit

Shell script code called during login bash shell initialisation.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.promptInit

Shell script code used to initialise the bash prompt.

Type: strings concatenated with "\n"

Default:

''
# Provide a nice prompt if the terminal supports it.
if [ "$TERM" != "dumb" -o -n "$INSIDE_EMACS" ]; then
  PROMPT_COLOR="1;31m"
  let $UID && PROMPT_COLOR="1;32m"
  if [ -n "$INSIDE_EMACS" -o "$TERM" == "eterm" -o "$TERM" == "eterm-color" ]; then
    # Emacs term mode doesn't support xterm title escape sequence (\e]0;)
    PS1="\n\[\033[$PROMPT_COLOR\][\u@\h:\w]\\$\[\033[0m\] "
  else
    PS1="\n\[\033[$PROMPT_COLOR\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\\$\[\033[0m\] "
  fi
  if test "$TERM" = "xterm"; then
    PS1="\[\033]2;\h:\u:\w\007\]$PS1"
  fi
fi
''

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.shellAliases

Set of aliases for bash shell, which overrides environment.shellAliases. See environment.shellAliases for an option format description.

Type: attribute set of null or string or paths

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.shellInit

Shell script code called during bash shell initialisation.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/bash/bash.nix>
programs.bash.vteIntegration

Whether to enable Bash integration for VTE terminals. This allows it to preserve the current directory of the shell across terminals.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/config/vte.nix>
programs.bash-my-aws.enable

Whether to enable bash-my-aws.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/bash-my-aws.nix>
programs.bcc.enable

Whether to enable bcc.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/bcc.nix>
programs.browserpass.enable

Whether to enable Browserpass native messaging host.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/browserpass.nix>
programs.captive-browser.enable

Whether to enable captive browser.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.captive-browser.package

Which package to use for captive-browser

Type: package

Default: "pkgs.captive-browser"

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.captive-browser.bindInterface

Binds captive-browser to the network interface declared in cfg.interface. This can be used to avoid collisions with private subnets.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.captive-browser.browser

The shell (/bin/sh) command executed once the proxy starts. When browser exits, the proxy exits. An extra env var PROXY is available.

Here, we use a separate Chrome instance in Incognito mode, so that it can run (and be waited for) alongside the default one, and that it maintains no state across runs. To configure this browser open a normal window in it, settings will be preserved.

@volth: chromium is to open a plain HTTP (not HTTPS nor redirect to HTTPS!) website. upstream uses http://example.com but I have seen captive portals whose DNS server resolves "example.com" to 127.0.0.1

Type: string

Default: ''''${pkgs.chromium}/bin/chromium --user-data-dir=$HOME/.chromium-captive --proxy-server="socks5://$PROXY" --host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost" --no-first-run --new-window --incognito http://cache.nixos.org/''

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.captive-browser.dhcp-dns

The shell (/bin/sh) command executed to obtain the DHCP DNS server address. The first match of an IPv4 regex is used. IPv4 only, because let's be real, it's a captive portal.

Type: string

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.captive-browser.interface

your public network interface (wlp3s0, wlan0, eth0, ...)

Type: string

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.captive-browser.socks5-addr

the listen address for the SOCKS5 proxy server

Type: string

Default: "localhost:1666"

Declared by:

<nixpkgs/nixos/modules/programs/captive-browser.nix>
programs.ccache.enable

Whether to enable CCache.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/ccache.nix>
programs.ccache.packageNames

Nix top-level packages to be compiled using CCache

Type: list of strings

Default: [ ]

Example: [ "wxGTK30" "qt48" "ffmpeg_3_3" "libav_all" ]

Declared by:

<nixpkgs/nixos/modules/programs/ccache.nix>
programs.ccache.cacheDir

CCache directory

Type: path

Default: "/var/cache/ccache"

Declared by:

<nixpkgs/nixos/modules/programs/ccache.nix>
programs.cdemu.enable

cdemu for members of programs.cdemu.group.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/cdemu.nix>
programs.cdemu.group

Group that users must be in to use cdemu.

Type: unspecified

Default: "cdrom"

Declared by:

<nixpkgs/nixos/modules/programs/cdemu.nix>
programs.cdemu.gui

Whether to install the cdemu GUI (gCDEmu).

Type: unspecified

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/cdemu.nix>
programs.cdemu.image-analyzer

Whether to install the image analyzer.

Type: unspecified

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/cdemu.nix>
programs.chromium.enable

Whether to enable chromium policies.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/chromium.nix>
programs.chromium.defaultSearchProviderSearchURL

Chromium default search provider url.

Type: null or string

Default: null

Example: "https://encrypted.google.com/search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}"

Declared by:

<nixpkgs/nixos/modules/programs/chromium.nix>
programs.chromium.defaultSearchProviderSuggestURL

Chromium default search provider url for suggestions.

Type: null or string

Default: null

Example: "https://encrypted.google.com/complete/search?output=chrome&q={searchTerms}"

Declared by:

<nixpkgs/nixos/modules/programs/chromium.nix>
programs.chromium.extensions

List of chromium extensions to install. For list of plugins ids see id in url of extensions on chrome web store page.

Type: list of strings

Default: [ ]

Example:

[
  "chlffgpmiacpedhhbkiomidkjlcfhogd" # pushbullet
  "mbniclmhobmnbdlbpiphghaielnnpgdp" # lightshot
  "gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere
  "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
]

Declared by:

<nixpkgs/nixos/modules/programs/chromium.nix>
programs.chromium.extraOpts

Extra chromium policy options, see https://www.chromium.org/administrators/policy-list-3 for a list of avalible options

Type: attribute set

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/chromium.nix>
programs.chromium.homepageLocation

Chromium default homepage

Type: null or string

Default: null

Example: "https://nixos.org"

Declared by:

<nixpkgs/nixos/modules/programs/chromium.nix>
programs.clickshare-csc1.enable

Whether to enable Barco ClickShare CSC-1 driver/client. This allows users in the clickshare group to access and use a ClickShare USB dongle that is connected to the machine .

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/clickshare.nix>
programs.command-not-found.enable

Whether interactive shells should show which Nix package (if any) provides a missing command.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/command-not-found/command-not-found.nix>
programs.command-not-found.dbPath

Absolute path to programs.sqlite.

By default this file will be provided by your channel (nixexprs.tar.xz).

Type: path

Default: "/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite"

Declared by:

<nixpkgs/nixos/modules/programs/command-not-found/command-not-found.nix>
programs.criu.enable

Install criu along with necessary kernel options.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/criu.nix>
programs.dconf.enable

Whether to enable dconf.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/dconf.nix>
programs.digitalbitbox.enable

Installs the Digital Bitbox application and enables the complementary hardware module.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/digitalbitbox/default.nix>
programs.digitalbitbox.package

The Digital Bitbox package to use. This can be used to install a package with udev rules that differ from the defaults.

Type: package

Default: "pkgs.digitalbitbox"

Declared by:

<nixpkgs/nixos/modules/programs/digitalbitbox/default.nix>
programs.dmrconfig.enable

Whether to configure system to enable use of dmrconfig. This enables the required udev rules and installs the program.

Type: boolean

Default: false

Related packages:

  • pkgs.dmrconfig (dmrconfig-1.1): Configuration utility for DMR radios.

    DMRconfig is a utility for programming digital radios via USB programming cable.
    

Declared by:

<nixpkgs/nixos/modules/programs/dmrconfig.nix>
programs.dmrconfig.package

dmrconfig derivation to use

Type: package

Default: "pkgs.dmrconfig"

Declared by:

<nixpkgs/nixos/modules/programs/dmrconfig.nix>
programs.evince.enable

Whether to enable Evince, the GNOME document viewer.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/evince.nix>
programs.file-roller.enable

Whether to enable File Roller, an archive manager for GNOME.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/file-roller.nix>
programs.firejail.enable

Whether to enable firejail.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/firejail.nix>
programs.firejail.wrappedBinaries

Wrap the binaries in firejail and place them in the global path.

You will get file collisions if you put the actual application binary in the global environment and applications started via .desktop files are not wrapped if they specify the absolute path to the binary.

Type: attribute set

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/firejail.nix>
programs.fish.enable

Whether to configure fish as an interactive shell.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.interactiveShellInit

Shell script code called during interactive fish shell initialisation.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.loginShellInit

Shell script code called during fish login shell initialisation.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.promptInit

Shell script code used to initialise fish prompt.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.shellAliases

Set of aliases for fish shell, which overrides environment.shellAliases. See environment.shellAliases for an option format description.

Type: attribute set of null or string or paths

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.shellInit

Shell script code called during fish shell initialisation.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.vendor.completions.enable

Whether fish should use completion files provided by other packages.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.vendor.config.enable

Whether fish should source configuration snippets provided by other packages.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fish.vendor.functions.enable

Whether fish should autoload fish functions provided by other packages.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/fish.nix>
programs.fuse.mountMax

Set the maximum number of FUSE mounts allowed to non-root users.

Type: integer between 0 and 32767 (both inclusive)

Default: 1000

Declared by:

<nixpkgs/nixos/modules/programs/fuse.nix>
programs.fuse.userAllowOther

Allow non-root users to specify the allow_other or allow_root mount options, see mount.fuse3(8).

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/fuse.nix>
programs.geary.enable

Whether to enable Geary, a Mail client for GNOME 3.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/geary.nix>
programs.gnome-disks.enable

Whether to enable GNOME Disks daemon, a program designed to be a UDisks2 graphical front-end.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnome-disks.nix>
programs.gnome-documents.enable

Whether to enable GNOME Documents, a document manager application for GNOME.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnome-documents.nix>
programs.gnome-terminal.enable

Whether to enable GNOME Terminal.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/gnome-terminal.nix>
programs.gnupg.package

The gpg package that should be used.

Type: package

Default: "pkgs.gnupg"

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gnupg.agent.enable

Enables GnuPG agent with socket-activation for every user session.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gnupg.agent.enableBrowserSocket

Enable browser socket for GnuPG agent.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gnupg.agent.enableExtraSocket

Enable extra socket for GnuPG agent.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gnupg.agent.enableSSHSupport

Enable SSH agent support in GnuPG agent. Also sets SSH_AUTH_SOCK environment variable correctly. This will disable socket-activation and thus always start a GnuPG agent per user session.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gnupg.agent.pinentryFlavor

Which pinentry interface to use. If not null, the path to the pinentry binary will be passed to gpg-agent via commandline and thus overrides the pinentry option in gpg-agent.conf in the user's home directory. If not set at all, it'll pick an appropriate flavor depending on the system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce 4.12, gnome3 on all other systems with X enabled, ncurses otherwise).

Type: null or one of "curses", "tty", "gtk2", "qt", "gnome3", "emacs"

Example: "gnome3"

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gnupg.dirmngr.enable

Enables GnuPG network certificate management daemon with socket-activation for every user session.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gnupg.nix>
programs.gpaste.enable

Whether to enable GPaste, a clipboard manager.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gpaste.nix>
programs.gphoto2.enable

Whether to configure system to use gphoto2. To grant digital camera access to a user, the user must be part of the camera group: users.users.alice.extraGroups = ["camera"];

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/gphoto2.nix>
programs.iftop.enable

Whether to enable iftop + setcap wrapper.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/iftop.nix>
programs.iotop.enable

Whether to enable iotop + setcap wrapper.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/iotop.nix>
programs.java.enable

Install and setup the Java development kit.

Note: This adds JAVA_HOME to the global environment, by sourcing the jdk's setup-hook on shell init. It is equivalent to starting a shell through 'nix-shell -p jdk', or roughly the following system-wide configuration:

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/java.nix>
programs.java.package

Java package to install. Typical values are pkgs.jdk or pkgs.jre.

Type: package

Default: "pkgs.jdk"

Declared by:

<nixpkgs/nixos/modules/programs/java.nix>
programs.kbdlight.enable

Whether to enable kbdlight.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/kbdlight.nix>
programs.less.enable

Whether to enable less.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.clearDefaultCommands

Clear all default commands. You should remember to set the quit key. Otherwise you will not be able to leave less without killing it.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.commands

Defines new command keys.

Type: attribute set of strings

Default: { }

Example: { h = ''noaction 5\e(''; l = ''noaction 5\e)''; }

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.configFile

Path to lesskey configuration file.

configFile takes precedence over commands, clearDefaultCommands, lineEditingKeys, and envVariables.

Type: null or path

Default: null

Example:

$${pkgs.my-configs}/lesskey

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.envVariables

Defines environment variables.

Type: attribute set of strings

Default: { }

Example: { LESS = "--quit-if-one-screen"; }

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.lessclose

When less closes a file opened in such a way, it will call another program, called the input postprocessor, which may perform any desired clean-up action (such as deleting the replacement file created by LESSOPEN).

Type: null or string

Default: null

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.lessopen

Before less opens a file, it first gives your input preprocessor a chance to modify the way the contents of the file are displayed.

Type: null or string

Default: "|\${pkgs.lesspipe}/bin/lesspipe.sh %s"

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.less.lineEditingKeys

Defines new line-editing keys.

Type: attribute set of strings

Default: { }

Example: { e = "abort"; }

Declared by:

<nixpkgs/nixos/modules/programs/less.nix>
programs.liboping.enable

Whether to enable liboping.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/liboping.nix>
programs.light.enable

Whether to install Light backlight control command and udev rules granting access to members of the "video" group.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/light.nix>
programs.mininet.enable

Whether to enable Mininet.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/mininet.nix>
programs.mosh.enable

Whether to enable mosh. Note, this will open ports in your firewall!

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/mosh.nix>
programs.mosh.withUtempter

Whether to enable libutempter for mosh. This is required so that mosh can write to /var/run/utmp (which can be queried with `who` to display currently connected user sessions). Note, this will add a guid wrapper for the group utmp!

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/mosh.nix>
programs.mtr.enable

Whether to add mtr to the global environment and configure a setcap wrapper for it.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/mtr.nix>
programs.mtr.package

The package to use.

Type: package

Default: (build of mtr-0.93)

Declared by:

<nixpkgs/nixos/modules/programs/mtr.nix>
programs.nano.nanorc

The system-wide nano configuration. See nanorc(5).

Type: strings concatenated with "\n"

Default: ""

Example:

''
set nowrap
set tabstospaces
set tabsize 2
''

Declared by:

<nixpkgs/nixos/modules/programs/nano.nix>
programs.nano.syntaxHighlight

Whether to enable syntax highlight for various languages.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/nano.nix>
programs.nm-applet.enable

Whether to enable nm-applet.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/nm-applet.nix>
programs.npm.enable

Whether to enable npm global config.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/npm.nix>
programs.npm.npmrc

The system-wide npm configuration. See https://docs.npmjs.com/misc/config.

Type: strings concatenated with "\n"

Default:

''
prefix = ''${HOME}/.npm
''

Example:

''
prefix = ''${HOME}/.npm
https-proxy=proxy.example.com
init-license=MIT
init-author-url=http://npmjs.org
color=true
''

Declared by:

<nixpkgs/nixos/modules/programs/npm.nix>
programs.plotinus.enable

Whether to enable the Plotinus GTK 3 plugin. Plotinus provides a popup (triggered by Ctrl-Shift-P) to search the menus of a compatible application.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/plotinus.nix>
programs.qt5ct.enable

Whether to enable the Qt5 Configuration Tool (qt5ct), a program that allows users to configure Qt5 settings (theme, font, icons, etc.) under desktop environments or window manager without Qt integration.

Official home page: https://sourceforge.net/projects/qt5ct/

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/qt5ct.nix>
programs.screen.screenrc

The contents of /etc/screenrc file.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/screen.nix>
programs.seahorse.enable

Whether to enable Seahorse, a GNOME application for managing encryption keys and passwords in the GNOME Keyring.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/seahorse.nix>
programs.sedutil.enable

Whether to enable sedutil.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/sedutil.nix>
programs.singularity.enable

Whether to enable Singularity.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/singularity.nix>
programs.slock.enable

Whether to install slock screen locker with setuid wrapper.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/slock.nix>
programs.spacefm.enable

Whether to install SpaceFM and create /etc/spacefm/spacefm.conf.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/spacefm.nix>
programs.spacefm.settings

The system-wide spacefm configuration. Parameters to be written to /etc/spacefm/spacefm.conf. Refer to the relevant entry in the SpaceFM manual.

Type: attribute set

Default: { graphical_su = "\${pkgs.gksu}/bin/gksu"; terminal_su = "\${pkgs.sudo}/bin/sudo"; tmp_dir = "/tmp"; }

Example:

{
          tmp_dir = "/tmp";
          terminal_su = "${pkgs.sudo}/bin/sudo";
          graphical_su = "${pkgs.gksu}/bin/gksu";
        }

Declared by:

<nixpkgs/nixos/modules/programs/spacefm.nix>
programs.ssh.package

The package used for the openssh client and daemon.

Type: package

Default: "pkgs.openssh"

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.agentPKCS11Whitelist

A pattern-list of acceptable paths for PKCS#11 shared libraries that may be used with the -s option to ssh-add.

Type: null or string

Default: null

Example: "\${pkgs.opensc}/lib/opensc-pkcs11.so"

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.agentTimeout

How long to keep the private keys in memory. Use null to keep them forever.

Type: null or string

Default: null

Example: "1h"

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.askPassword

Program used by SSH to ask for passwords.

Type: string

Default: "\${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass"

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.extraConfig

Extra configuration text prepended to ssh_config. Other generated options will be added after a Host * pattern. See ssh_config(5) for help.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.forwardX11

Whether to request X11 forwarding on outgoing connections by default. This is useful for running graphical programs on the remote machine and have them display to your local X11 server. Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two. Note: there are some security risks to forwarding an X11 connection. NixOS's X server is built with the SECURITY extension, which prevents some obvious attacks. To enable or disable forwarding on a per-connection basis, see the -X and -x options to ssh. The -Y option to ssh enables trusted forwarding, which bypasses the SECURITY extension.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.hostKeyAlgorithms

Specifies the host key algorithms that the client wants to use in order of preference.

Type: list of strings

Default: [ "+ssh-dss" ]

Example: [ "ssh-ed25519" "ssh-rsa" ]

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.knownHosts

The set of system-wide known SSH hosts.

Type: list or attribute set of submodules

Default: { }

Example:

{
  myhost = {
    hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
    publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
  };
  myhost2 = {
    hostNames = [ "myhost2" ];
    publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
  };
}

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.knownHosts.<name?>.certAuthority

This public key is an SSH certificate authority, rather than an individual host's key.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.knownHosts.<name?>.hostNames

A list of host names and/or IP numbers used for accessing the host's ssh service.

Type: list of strings

Default: [ ]

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.knownHosts.<name?>.publicKey

The public key data for the host. You can fetch a public key from a running SSH server with the ssh-keyscan command. The public key should not include any host names, only the key type and the key itself.

Type: null or string

Default: null

Example: "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg=="

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.knownHosts.<name?>.publicKeyFile

The path to the public key file for the host. The public key file is read at build time and saved in the Nix store. You can fetch a public key file from a running SSH server with the ssh-keyscan command. The content of the file should follow the same format as described for the publicKey option.

Type: null or path

Default: null

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.pubkeyAcceptedKeyTypes

Specifies the key types that will be used for public key authentication.

Type: list of strings

Default: [ "+ssh-dss" ]

Example: [ "ssh-ed25519" "ssh-rsa" ]

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.setXAuthLocation

Whether to set the path to xauth for X11-forwarded connections. This causes a dependency on X11 packages.

Type: boolean

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.ssh.startAgent

Whether to start the OpenSSH agent when you log in. The OpenSSH agent remembers private keys for you so that you don't have to type in passphrases every time you make an SSH connection. Use ssh-add to add a key to the agent.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/ssh.nix>
programs.sway.enable

Whether to enable Sway, the i3-compatible tiling Wayland compositor. You can manually launch Sway by executing "exec sway" on a TTY. Copy /etc/sway/config to ~/.config/sway/config to modify the default configuration. See https://github.com/swaywm/sway/wiki and "man 5 sway" for more information. Please have a look at the "extraSessionCommands" example for running programs natively under Wayland.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sway.extraOptions

Command line arguments passed to launch Sway. Please DO NOT report issues if you use an unsupported GPU (proprietary drivers).

Type: list of strings

Default: [ ]

Example: [ "--verbose" "--debug" "--unsupported-gpu" "--my-next-gpu-wont-be-nvidia" ]

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sway.extraPackages

Extra packages to be installed system wide.

Type: list of packages

Default: with pkgs; [ swaylock swayidle xwayland rxvt-unicode dmenu ];

Example:

with pkgs; [
  xwayland
  i3status i3status-rust
  termite rofi light
]

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sway.extraSessionCommands

Shell commands executed just before Sway is started.

Type: strings concatenated with "\n"

Default: ""

Example:

''
export SDL_VIDEODRIVER=wayland
# needs qt5.qtwayland in systemPackages
export QT_QPA_PLATFORM=wayland
export QT_WAYLAND_DISABLE_WINDOWDECORATION="1"
# Fix for some Java AWT applications (e.g. Android Studio),
# use this if they aren't displayed properly:
export _JAVA_AWT_WM_NONREPARENTING=1
''

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sway.wrapperFeatures

Attribute set of features to enable in the wrapper.

Type: submodule

Default: { }

Example: { gtk = true; }

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sway.wrapperFeatures.base

Whether to make use of the base wrapper to execute extra session commands and prepend a dbus-run-session to the sway command.

Type: boolean

Default: true

Example: false

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sway.wrapperFeatures.gtk

Whether to make use of the wrapGAppsHook wrapper to execute sway with required environment variables for GTK applications.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/sway.nix>
programs.sysdig.enable

Whether to enable sysdig.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/sysdig.nix>
programs.system-config-printer.enable

Whether to enable system-config-printer, a Graphical user interface for CUPS administration.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/system-config-printer.nix>
programs.systemtap.enable

Install systemtap along with necessary kernel options.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/systemtap.nix>
programs.thefuck.enable

Whether to enable thefuck.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/thefuck.nix>
programs.thefuck.alias

`thefuck` needs an alias to be configured. The default value is `fuck`, but you can use anything else as well.

Type: string

Default: "fuck"

Declared by:

<nixpkgs/nixos/modules/programs/thefuck.nix>
programs.tmux.enable

Whenever to configure tmux system-wide.

Type: boolean

Default: false

Related packages:

  • pkgs.tmux (tmux-3.0a): Terminal multiplexer.

    tmux is intended to be a modern, BSD-licensed alternative to programs such as GNU screen. Major features include:
    
             * A powerful, consistent, well-documented and easily scriptable command interface.
             * A window may be split horizontally and vertically into panes.
             * Panes can be freely moved and resized, or arranged into preset layouts.
             * Support for UTF-8 and 256-colour terminals.
             * Copy and paste with multiple buffers.
             * Interactive menus to select windows, sessions or clients.
             * Change the current window by searching for text in the target.
             * Terminal locking, manually or after a timeout.
             * A clean, easily extended, BSD-licensed codebase, under active development.
    

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.aggressiveResize

Resize the window to the size of the smallest session for which it is the current window.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.baseIndex

Base index for windows and panes.

Type: signed integer

Default: 0

Example: 1

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.clock24

Use 24 hour clock.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.customPaneNavigationAndResize

Override the hjkl and HJKL bindings for pane navigation and resizing in VI mode.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.escapeTime

Time in milliseconds for which tmux waits after an escape is input.

Type: signed integer

Default: 500

Example: 0

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.extraConfig

Additional contents of /etc/tmux.conf

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.historyLimit

Maximum number of lines held in window history.

Type: signed integer

Default: 2000

Example: 5000

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.keyMode

VI or Emacs style shortcuts.

Type: one of "emacs", "vi"

Default: "emacs"

Example: "vi"

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.newSession

Automatically spawn a session if trying to attach and none are running.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.resizeAmount

Number of lines/columns when resizing.

Type: signed integer

Default: 5

Example: 10

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.reverseSplit

Reverse the window split shortcuts.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.secureSocket

Store tmux socket under /run, which is more secure than /tmp, but as a downside it doesn't survive user logout.

Type: boolean

Default: true

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.shortcut

Ctrl following by this key is used as the main shortcut.

Type: string

Default: "b"

Example: "a"

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.tmux.terminal

Set the $TERM variable.

Type: string

Default: "screen"

Example: "screen-256color"

Declared by:

<nixpkgs/nixos/modules/programs/tmux.nix>
programs.traceroute.enable

Whether to configure a setcap wrapper for traceroute.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/traceroute.nix>
programs.tsmClient.enable

Whether to enable IBM Spectrum Protect (Tivoli Storage Manager, TSM) client command line applications with a client system-options file "dsm.sys" .

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.package

The TSM client derivation to be added to the system environment. It will called with .override to add paths to the client system-options file.

Type: package

Default: "pkgs.tsm-client"

Example:

pkgs.tsm-client-withGui

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.defaultServername

If multiple server stanzas are declared with programs.tsmClient.servers, this option may be used to name a default server stanza that IBM TSM uses in the absence of a user-defined dsm.opt file. This option translates to a defaultserver configuration line.

Type: null or string matching the pattern .{1,64}

Default: null

Example: "mainTsmServer"

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.dsmSysText

This configuration key contains the effective text of the client system-options file "dsm.sys". It should not be changed, but may be used to feed the configuration into other TSM-depending packages used on the system.

Type: strings concatenated with "\n" (read only)

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers

Server definitions ("stanzas") for the client system-options file.

Type: list or attribute set of submodules

Default: { }

Example: { mainTsmServer = { extraConfig = { compression = "yes"; } ; node = "MY-TSM-NODE"; server = "tsmserver.company.com"; } ; }

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.extraConfig

Additional key-value pairs for the server stanza. Values must be strings, or null for the key not to be used in the stanza (e.g. to overrule values generated by other options).

Type: attribute set of null or strings

Default: { }

Example: { compression = "yes"; passwordaccess = null; }

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.genPasswd

Whether to enable automatic client password generation. This option influences the passwordaccess directive in dsm.sys. The password will be stored in the directory given by the option passwdDir. Caution: If this option is enabled and the server forces to renew the password (e.g. on first connection), a random password will be generated and stored .

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.includeExclude

include.* and exclude.* directives to be used when sending files to the IBM TSM server. The lines will be written into a file that the inclexcl directive in dsm.sys points to.

Type: strings concatenated with "\n"

Default: ""

Example:

''
exclude.dir     /nix/store
include.encrypt /home/.../*
''

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.name

Local name of the IBM TSM server, must be uncapitalized and no longer than 64 chars. The value will be used for the server directive in dsm.sys.

Type: string matching the pattern .{1,64}

Example: "mainTsmServer"

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.node

Target node name on the IBM TSM server. The value will be used for the nodename directive in dsm.sys.

Type: string matching the pattern .+

Example: "MY-TSM-NODE"

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.passwdDir

Directory that holds the TSM node's password information. The value will be used for the passworddir directive in dsm.sys.

Type: path

Example: "/home/alice/tsm-password"

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.port

TCP port of the IBM TSM server. The value will be used for the tcpport directive in dsm.sys. TSM does not support ports above 32767.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 1500

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.server

Host/domain name or IP address of the IBM TSM server. The value will be used for the tcpserveraddress directive in dsm.sys.

Type: string matching the pattern .+

Example: "tsmserver.company.com"

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.servers.<name?>.text

Additional text lines for the server stanza. This option can be used if certion configuration keys must be used multiple times or ordered in a certain way as the extraConfig option can't control the order of lines in the resulting stanza. Note that the server line at the beginning of the stanza is not part of this option's value.

Type: strings concatenated with "\n"

Example:

lib.modules.mkAfter "compression no"

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.tsmClient.wrappedPackage

The TSM client derivation, wrapped with the path to the client system-options file "dsm.sys". This option is to provide the effective derivation for other modules that want to call TSM executables.

Type: package (read only)

Declared by:

<nixpkgs/nixos/modules/programs/tsm-client.nix>
programs.udevil.enable

Whether to enable udevil.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/udevil.nix>
programs.usbtop.enable

Whether to enable usbtop and required kernel module.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/usbtop.nix>
programs.vim.defaultEditor

When enabled, installs vim and configures vim to be the default editor using the EDITOR environment variable.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/vim.nix>
programs.wavemon.enable

Whether to add wavemon to the global environment and configure a setcap wrapper for it.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/wavemon.nix>
programs.waybar.enable

Whether to enable waybar.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/waybar.nix>
programs.wireshark.enable

Whether to add Wireshark to the global environment and configure a setcap wrapper for 'dumpcap' for users in the 'wireshark' group.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/wireshark.nix>
programs.wireshark.package

Which Wireshark package to install in the global environment.

Type: package

Default: "pkgs.wireshark-cli"

Declared by:

<nixpkgs/nixos/modules/programs/wireshark.nix>
programs.x2goserver.enable

Enables the x2goserver module. NOTE: This will create a good amount of symlinks in `/usr/local/bin`

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/x2goserver.nix>
programs.x2goserver.nxagentDefaultOptions

List of default nx agent options.

Type: list of strings

Default: [ "-extension GLX" "-nolisten tcp" ]

Example: [ "-extension GLX" "-nolisten tcp" ]

Declared by:

<nixpkgs/nixos/modules/programs/x2goserver.nix>
programs.x2goserver.settings

x2goserver.conf ini configuration as nix attributes. See `x2goserver.conf(5)` for details

Type: attribute set of attribute sets

Default: { }

Example:

superenicer = {
  "enable" = "yes";
  "idle-nice-level" = 19;
};
telekinesis = { "enable" = "no"; };

Declared by:

<nixpkgs/nixos/modules/programs/x2goserver.nix>
programs.x2goserver.superenicer.enable

Enables the SupeReNicer code in x2gocleansessions, this will renice suspended sessions to nice level 19 and renice them to level 0 if the session becomes marked as running again

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/x2goserver.nix>
programs.xfs_quota.projects

Setup of xfs_quota projects. Make sure the filesystem is mounted with the pquota option.

Type: attribute set of submodules

Default: { }

Example: { projname = { id = 50; path = "/xfsprojects/projname"; sizeHardLimit = "50g"; } ; }

Declared by:

<nixpkgs/nixos/modules/programs/xfs_quota.nix>
programs.xfs_quota.projects.<name>.fileSystem

XFS filesystem hosting the xfs_quota project.

Type: string

Default: "/"

Declared by:

<nixpkgs/nixos/modules/programs/xfs_quota.nix>
programs.xfs_quota.projects.<name>.id

Project ID.

Type: signed integer

Declared by:

<nixpkgs/nixos/modules/programs/xfs_quota.nix>
programs.xfs_quota.projects.<name>.path

Project directory.

Type: string

Declared by:

<nixpkgs/nixos/modules/programs/xfs_quota.nix>
programs.xfs_quota.projects.<name>.sizeHardLimit

Hard limit of the project size.

Type: null or string

Default: null

Example: "50g"

Declared by:

<nixpkgs/nixos/modules/programs/xfs_quota.nix>
programs.xfs_quota.projects.<name>.sizeSoftLimit

Soft limit of the project size

Type: null or string

Default: null

Example: "30g"

Declared by:

<nixpkgs/nixos/modules/programs/xfs_quota.nix>
programs.xonsh.enable

Whether to configure xonsh as an interactive shell.

Type: boolean

Default: false

Declared by:

<nixpkgs/nixos/modules/programs/xonsh.nix>
programs.xonsh.package

xonsh package to use.

Type: package

Default: (build of xonsh-0.9.13)

Example:

pkgs.xonsh.override { configFile = "/path/to/xonshrc"; }

Declared by:

<nixpkgs/nixos/modules/programs/xonsh.nix>
programs.xonsh.config

Control file to customize your shell behavior.

Type: strings concatenated with "\n"

Default: ""

Declared by:

<nixpkgs/nixos/modules/programs/xonsh.nix>
programs.xss-lock.enable

Whether to enable xss-lock.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/xss-lock.nix>
programs.xss-lock.extraOptions

Additional command-line arguments to pass to xss-lock.

Type: list of strings

Default: [ ]

Example: [ "--ignore-sleep" ]

Declared by:

<nixpkgs/nixos/modules/programs/xss-lock.nix>
programs.xss-lock.lockerCommand

Locker to be used with xsslock

Type: strings concatenated with " "

Default: "\${pkgs.i3lock}/bin/i3lock"

Example:

${pkgs.i3lock-fancy}/bin/i3lock-fancy

Declared by:

<nixpkgs/nixos/modules/programs/xss-lock.nix>
programs.yabar.enable

Whether to enable yabar.

Type: boolean

Default: false

Example: true

Declared by:

<nixpkgs/nixos/modules/programs/yabar.nix>
programs.yabar.package

The package which contains the `yabar` binary.

Nixpkgs provides the `yabar` and `yabar-unstable` derivations since 18.03, so it's possible to choose.

Type: package

Default: (build of yabar-unstable-2018-01-18)

Example:

pkgs.yabar

Declared by:

<nixpkgs/nixos/modules/programs/yabar.nix>
programs.yabar.bars

List of bars that should be rendered by yabar.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/yabar.nix>
programs.yabar.bars.<name>.extra

An attribute set which contains further attributes of a bar.

Type: attribute set of strings

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/yabar.nix>
programs.yabar.bars.<name>.font

The font that will be used to draw the status bar.

Type: string

Default: "sans bold 9"

Example: "Droid Sans, FontAwesome Bold 9"

Declared by:

<nixpkgs/nixos/modules/programs/yabar.nix>
programs.yabar.bars.<name>.indicators

Indicators that should be rendered by yabar.

Type: attribute set of submodules

Default: { }

Declared by:

<nixpkgs/nixos/modules/programs/yabar.nix>
programs.yabar.bars.<name>.indicators.<name>.align

Whether to align the indicator at the left or right of the bar. </