Appendix A. All Options

Configuration for bazarr

Type: submodule

Default: { }

Declared by:

Whether to enable bazarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration for bazarr.

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

Directory where bazarr stores data.

Type: string

Default: "/var/lib/bazarr"

Declared by:

Domain under which bazarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for bazarr.

Type: XML value

Default: { }

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which bazarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive) (read only)

Default: 6767

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which bazarr will be served.

Type: string

Example: "bazarr"

Declared by:

Configuration for jackett

Type: submodule

Default: { }

Declared by:

Whether to enable jackett.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration for jackett.

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

Directory where jackett stores data.

Type: string

Default: "/var/lib/jackett"

Declared by:

Domain under which jackett will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for jackett.

Type: JSON value

Default: { }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

FlareSolverr endpoint.

Type: null or string

Default: null

Declared by:

File containing the Open Movie Database API key.

Type: null or (submodule)

Default: null

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Port on which jackett listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive) (read only)

Default: 9117

Declared by:

Port of the proxy. Ignored if ProxyType is set to -1

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: null

Declared by:

-1 = disabled 0 = HTTP 1 = SOCKS4 2 = SOCKS5

Type: one of “-1”, “0”, “1”, “2”

Default: "-1"

Declared by:

URL of the proxy. Ignored if ProxyType is set to -1

Type: null or string

Default: null

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which jackett will be served.

Type: string

Example: "jackett"

Declared by:

Configuration for lidarr

Type: submodule

Default: { }

Declared by:

Whether to enable lidarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration for lidarr.

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

Directory where lidarr stores data.

Type: string

Default: "/var/lib/lidarr"

Declared by:

Domain under which lidarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for lidarr.

Type: XML value

Default: { }

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which lidarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8686

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which lidarr will be served.

Type: string

Example: "lidarr"

Declared by:

Configuration for radarr

Type: submodule

Default: { }

Declared by:

Whether to enable radarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration for radarr.

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

Directory where radarr stores data.

Type: string

Default: "/var/lib/radarr"

Declared by:

Domain under which radarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for radarr.

Type: XML value

Default: { }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Wether to send anonymous data or not.

Type: boolean

Default: false

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which radarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 7878

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which radarr will be served.

Type: string

Example: "radarr"

Declared by:

Configuration for readarr

Type: submodule

Default: { }

Declared by:

Whether to enable readarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration for readarr.

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

Directory where readarr stores data.

Type: string

Default: "/var/lib/readarr"

Declared by:

Domain under which readarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for readarr.

Type: XML value

Default: { }

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which readarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8787

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which readarr will be served.

Type: string

Example: "readarr"

Declared by:

Configuration for sonarr

Type: submodule

Default: { }

Declared by:

Whether to enable sonarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration for sonarr.

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

Directory where sonarr stores data.

Type: string

Default: "/var/lib/sonarr"

Declared by:

Domain under which sonarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for sonarr.

Type: XML value

Default: { }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which sonarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8989

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which sonarr will be served.

Type: string

Example: "sonarr"

Declared by:

Whether to enable selfhostblocks.audiobookshelf.

Type: boolean

Default: false

Example: true

Declared by:

OIDC endpoint for SSO

Type: string

Example: "https://authelia.example.com"

Declared by:

domain under which audiobookshelf will be served.

Type: string

Example: "mydomain.com"

Declared by:

Extra configuration given to the systemd service file.

Type: attribute set of string

Default: { }

Example:

{
  MemoryHigh = "512M";
  MemoryMax = "900M";
}

Declared by:

Enable logging.

Type: null or one of “critical”, “error”, “warning”, “info”, “debug”

Default: false

Example: true

Declared by:

OIDC admin group

Type: string

Default: "audiobookshelf_admin"

Declared by:

Client ID for the OIDC endpoint

Type: string

Default: "audiobookshelf"

Declared by:

OIDC provider name

Type: string

Default: "Authelia"

Declared by:

OIDC user group

Type: string

Default: "audiobookshelf_user"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

File containing the SSO shared secret.

Type: path

Declared by:

Subdomain under which audiobookshelf will be served.

Type: string

Example: "abs"

Declared by:

Audiobookshelf web port

Type: signed integer

Default: 8113

Declared by:

Whether to enable selfhostblocks.authelia.

Type: boolean

Default: false

Example: true

Declared by:

System user for this Authelia instance.

Type: string

Default: "authelia"

Declared by:

dc domain for ldap.

Type: string

Example: "dc=mydomain,dc=com"

Declared by:

domain under which Authelia will be served.

Type: string

Example: "mydomain.com"

Declared by:

Endpoint for LDAP authentication backend.

Type: string

Example: "ldap.example.com"

Declared by:

OIDC clients

Type: list of (attribute set of anything)

Default: [ ]

Declared by:

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default: "one_factor"

Declared by:

Human readable description of the OIDC client.

Type: null or string

Default: null

Declared by:

Unique identifier of the OIDC client.

Type: string

Declared by:

If the OIDC client is public or not.

Type: boolean

Default: false

Declared by:

List of uris that are allowed to be redirected to.

Type: list of string

Declared by:

Scopes to ask for

Type: list of string

Default: [ ]

Example:

[
  "openid"
  "profile"
  "email"
  "groups"
]

Declared by:

File containing the shared secret with the OIDC client.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

If given, adds a port to the <subdomain>.<domain> endpoint.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: null

Declared by:

Rule based clients

Type: list of anything

Default: [ ]

Declared by:

Secrets needed by Authelia

Type: submodule

Declared by:

File containing the identity provider OIDC HMAC secret.

Type: path

Declared by:

File containing the identity provider OIDC issuer private key.

Generate one with nix run nixpkgs#openssl -- genrsa -out keypair.pem 2048

Type: path

Declared by:

File containing the JWT secret.

Type: path

Declared by:

File containing the LDAP admin user password.

Type: path

Declared by:

File containing the session secret.

Type: path

Declared by:

File containing the storage encryption key.

Type: path

Declared by:

If a string is given, writes notifications to the given path.Otherwise, send notifications by smtp.

https://www.authelia.com/configuration/notifications/introduction/

Type: string or null or (submodule)

Default: "/tmp/authelia-notifications"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which Authelia will be served.

Type: string

Example: "auth"

Declared by:

Add borgbackup package so external backups can use this server as a remote.

Type: boolean

Default: false

Example: true

Declared by:

Unix group doing the backups.

Type: string

Default: "backup"

Declared by:

Each instance is a backup setting

Type: attribute set of (submodule)

Default: { }

Declared by:

Whether to enable shb backup instance.

Type: boolean

Default: false

Example: true

Declared by:

What program to use to make the backups.

Type: one of “borgmatic”, “restic”

Example: "borgmatic"

Declared by:

Consistency frequency options. Only applicable for borgmatic

Type: attribute set of non-empty string

Default: { }

Example:

{
  archives = "1 month";
  repository = "2 weeks";
}

Declared by:

Add environment file to be read by the systemd service.

Type: boolean

Default: false

Example: true

Declared by:

Borgmatic exclude patterns.

Type: list of string

Default: [ ]

Declared by:

Borgmatic hooks.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup

Type: list of string

Default: [ ]

Declared by:

Sops file that holds this instance’s Borgmatic repository key and passphrase.

Type: path

Example: "secrets/backup.yaml"

Declared by:

Repositories to back this instance to.

Type: non-empty (list of (submodule))

Declared by:

Repository location

Type: string

Declared by:

When to run the backup. See systemd.timer(5) for details.

Type: attribute set of (systemd option)

Default:

{
  OnCalendar = "daily";
  Persistent = true;
}

Example:

{
  OnCalendar = "00:05";
  Persistent = true;
  RandomizedDelaySec = "5h";
}

Declared by:

Retention options.

Type: attribute set of (signed integer or non-empty string)

Default:

{
  keep_daily = 7;
  keep_hourly = 24;
  keep_monthly = 6;
  keep_weekly = 4;
  keep_within = "1d";
}

Declared by:

Secret name, if null use the name of the backup instance.

Type: null or string

Default: null

Declared by:

Borgmatic source directories.

Type: non-empty (list of string)

Declared by:

Run backups only if AC power is plugged in.

Type: boolean

Default: true

Example: false

Declared by:

Reduce performance impact of backup jobs.

Type: submodule

Default: { }

Declared by:

ionice priority, defaults to 7 for lowest priority IO. Only used for restic backup, restic forget and restic check commands.

Type: null or integer between 0 and 7 (both inclusive)

Default: 7

Declared by:

ionice scheduling class, defaults to best-effort IO. Only used for restic backup, restic forget and restic check commands.

Type: one of “idle”, “best-effort”, “realtime”

Default: "best-effort"

Declared by:

nice priority adjustment, defaults to 15 for ~20% CPU time of normal-priority process

Type: integer between -20 and 19 (both inclusive)

Default: 15

Declared by:

Unix user doing the backups.

Type: string

Default: "backup"

Declared by:

Generate a self-signed Certificate Authority.

Type: attribute set of (submodule)

Default: { }

Declared by:

Certificate Authority Name. You can put what you want here, it will be displayed by the browser.

Type: string

Default: "Self Host Blocks Certificate"

Declared by:

Paths where CA certs will be located.

This option implements the SSL Generator contract.

Type: anything

Default:

{
  cert = "/var/lib/certs/cas/‹name›.cert";
  key = "/var/lib/certs/cas/‹name›.key";
}

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certs.

This option implements the SSL Generator contract.

Type: string

Default: "shb-certs-ca-‹name›.service"

Declared by:

Generate certificates signed by Let’s Encrypt.

Type: attribute set of (submodule)

Default: { }

Declared by:

Additional environment variables used to configure the DNS provider.

For secrets, use shb.ssl.credentialsFile instead.

See the chosen provider’s documentation for available options.

Type: attribute set of string

Example:

{
  DNSPROVIDER_TIMEOUT = "10";
  DNSPROVIDER_PROPAGATION_TIMEOUT = "240";
}

Declared by:

Admin email in case certificate retrieval goes wrong.

Type: string

Declared by:

Credentials file location for the chosen DNS provider.

The content of this file must expose environment variables as written in the documentation of each DNS provider.

For example, if the documentation says the credential must be located in the environment variable DNSPROVIDER_TOKEN, then the file content must be:

DNSPROVIDER_TOKEN=xyz

You can put non-secret environment variables here too or use shb.ssl.additionalcfg instead.

Type: null or path

Default: null

Example: "/run/secrets/ssl"

Declared by:

Enable debug logging

Type: boolean

Default: false

Declared by:

DNS provider to use. See https://go-acme.github.io/lego/dns/ for the list of supported providers.

Type: null or string

Default: null

Example: "linode"

Declared by:

IP of a DNS server used to resolve hostnames.

Type: string

Default: "8.8.8.8"

Declared by:

Domain to generate a certificate for. This can be a wildcard domain like *.example.com.

Type: string

Example: "example.com"

Declared by:

Other domains to generate a certificate for.

Type: list of string

Default: [ ]

Example:

[
  "sub1.example.com"
  "sub2.example.com"
]

Declared by:

Unix group owning this certificate.

Type: null or string

Default: "acme"

Example: "nginx"

Declared by:

Make all certificates available to given user.

Type: null or string

Default: null

Declared by:

Paths where certs will be located.

This option implements the SSL Generator contract.

Type: anything

Default:

{
  cert = "/var/lib/acme/‹name›/cert.pem";
  key = "/var/lib/acme/‹name›/key.pem";
}

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

The list of systemd services to call systemctl try-reload-or-restart on.

Type: list of string

Default: [ ]

Example:

[
  "nginx.service"
]

Declared by:

Systemd oneshot service used to generate the certs.

This option implements the SSL Generator contract.

Type: string

Default: "shb-certs-cert-letsencrypt-‹name›.service"

Declared by:

Generate self-signed certificates signed by a Certificate Authority.

Type: attribute set of (submodule)

Default: { }

Declared by:

CA used to generate this certificate. Only used for self-signed.

This contract input takes the contract output of the shb.certs.cas SSL block.

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the CA will be located.

This option is the contract output of the shb.certs.cas SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the CA. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "ca-generator.service"

Declared by:

Domain to generate a certificate for. This can be a wildcard domain like *.example.com.

Type: string

Example: "example.com"

Declared by:

Other domains to generate a certificate for.

Type: list of string

Default: [ ]

Example:

[
  "sub1.example.com"
  "sub2.example.com"
]

Declared by:

Unix group owning this certificate.

Type: string

Default: "root"

Example: "nginx"

Declared by:

Paths where certs will be located.

This option implements the SSL Generator contract.

Type: anything

Default:

{
  cert = "/var/lib/certs/selfsigned/‹name›.cert";
  key = "/var/lib/certs/selfsigned/‹name›.key";
}

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

The list of systemd services to call systemctl try-reload-or-restart on.

Type: list of string

Default: [ ]

Example:

[
  "nginx.service"
]

Declared by:

Systemd oneshot service used to generate the certs.

This option implements the SSL Generator contract.

Type: string

Default: "shb-certs-cert-selfsigned-‹name›.service"

Declared by:

Systemd oneshot service used to generate the Certificate Authority bundle.

Type: string

Default: "shb-ca-bundle.service"

Declared by:

Contract for SSL Certificate generator.

Type: anything

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

List of mounts.

Type: list of (submodule)

Default: [ ]

Declared by:

Create a systemd automount unit

Type: boolean

Default: true

Declared by:

Directory creation mode

Type: null or string

Default: null

Example: "2775"

Declared by:

File creation mode

Type: null or string

Default: null

Example: "0664"

Declared by:

Group owner of the mount point.

Type: null or signed integer

Default: null

Example: 1000

Declared by:

Mount point to mount the webdav endpoint on.

Type: string

Example: "/mnt"

Declared by:

Password to connect to the webdav endpoint.

Type: string

Declared by:

Webdav endpoint to connect to.

Type: string

Example: "https://my.domain.com/dav"

Declared by:

User owner of the mount point.

Type: null or signed integer

Default: null

Example: 1000

Declared by:

Username to connect to the webdav endpoint.

Type: string

Declared by:

Whether to enable selfhostblocks.deluge.

Type: boolean

Default: false

Example: true

Declared by:

Plugins to enable, can include those from additionalPlugins.

Type: list of string

Default: [ ]

Example:

[
  "Label"
]

Declared by:

Location of additional plugins. Each item in the list must be the path to the directory containing the plugin .egg file.

Type: list of path

Default: [ ]

Declared by:

OIDC endpoint for SSO

Type: string

Example: "https://authelia.example.com"

Declared by:

File containing auth lines in the format expected by deluge. See https://dev.deluge-torrent.org/wiki/UserGuide/Authentication.

Type: path

Declared by:

Deluge daemon listen ports

Type: list of signed integer

Default:

[
  6881
  6889
]

Declared by:

Deluge daemon port

Type: signed integer

Default: 58846

Declared by:

domain under which deluge will be served.

Type: string

Example: "mydomain.com"

Declared by:

Extra configuration given to the systemd service file.

Type: attribute set of string

Default: { }

Example:

{
  MemoryHigh = "512M";
  MemoryMax = "900M";
}

Declared by:

Enable logging.

Type: null or one of “critical”, “error”, “warning”, “info”, “debug”

Default: false

Example: true

Declared by:

If not null, sets up a deluge to bind all outgoing traffic to the given interface.

Type: null or string

Default: null

Declared by:

If not null, sets up a deluge to forward all traffic to the Proxy listening at that port.

Type: null or signed integer

Default: null

Declared by:

Deluge operational settings.

Type: submodule

Declared by:

Do not count slow torrents towards any limits.

Type: boolean

Default: true

Declared by:

Folder where torrents gets downloaded

Type: string

Example: "/srv/torrents"

Declared by:

Maximum Active Downloading

Type: signed integer

Default: 30

Declared by:

Maximum Active Limit

Type: signed integer

Default: 200

Declared by:

Maximum Active Seeding

Type: signed integer

Default: 100

Declared by:

Maximum Connections Global

Type: signed integer

Default: 200

Declared by:

Maximum Connections Per Torrent

Type: signed integer

Default: 50

Declared by:

Maximum Download Speed

Type: signed integer

Default: 1000

Declared by:

Maximum Download Speed Per Torrent

Type: signed integer

Default: -1

Declared by:

Maximum Upload Slots Global

Type: signed integer

Default: 100

Declared by:

Maximum Upload Slots Per Torrent

Type: signed integer

Default: 4

Declared by:

Maximum Upload Speed

Type: signed integer

Default: 200

Declared by:

Maximum Upload Speed Per Torrent

Type: signed integer

Default: 50

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which deluge will be served.

Type: string

Example: "ha"

Declared by:

Deluge web port

Type: signed integer

Default: 8112

Declared by:

Whether to enable selfhostblocks.grocy.

Type: boolean

Default: false

Example: true

Declared by:

Display language of the frontend.

Type: one of “de”, “en”, “da”, “en_GB”, “es”, “fr”, “hu”, “it”, “nl”, “no”, “pl”, “pt_BR”, “ru”, “sk_SK”, “sv_SE”, “tr”

Default: "en"

Declared by:

ISO 4217 code for the currency to display.

Type: string

Default: "USD"

Example: "NOK"

Declared by:

Folder where Grocy will store all its data.

Type: string

Default: "/var/lib/grocy"

Declared by:

domain under which grocy will be served.

Type: string

Example: "mydomain.com"

Declared by:

Extra configuration given to the systemd service file.

Type: attribute set of string

Default: { }

Example:

{
  MemoryHigh = "512M";
  MemoryMax = "900M";
}

Declared by:

Enable logging.

Type: null or one of “critical”, “error”, “warning”, “info”, “debug”

Default: false

Example: true

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which grocy will be served.

Type: string

Example: "grocy"

Declared by:

Whether to enable selfhostblocks.hledger.

Type: boolean

Default: false

Example: true

Declared by:

OIDC endpoint for SSO

Type: string

Example: "https://authelia.example.com"

Declared by:

domain under which Authelia will be served.

Type: string

Example: "mydomain.com"

Declared by:

Local network range, to restrict access to the UI to only those IPs.

Type: string

Default: null

Example: "192.168.1.1/24"

Declared by:

HLedger port

Type: signed integer

Default: 5000

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which Authelia will be served.

Type: string

Example: "ha"

Declared by:

Whether to enable selfhostblocks.home-assistant.

Type: boolean

Default: false

Example: true

Declared by:

Backup configuration for home-assistant

Type: anything

Default: { }

Example:

{
  backend = "restic";
  repositories = [ ];
}

Declared by:

See all available settings at https://www.home-assistant.io/docs/configuration/basic/

Type: attribute set of string

Declared by:

Two letter country code where this instance is located.

Type: string or (submodule)

Declared by:

Latitude where this instance is located.

Type: string or (submodule)

Declared by:

Longitude where this instance is located.

Type: string or (submodule)

Declared by:

Name of the Home Assistant instance.

Type: string or (submodule)

Declared by:

Timezone of this instance.

Type: string or (submodule)

Example: "America/Los_Angeles"

Declared by:

Timezone of this instance.

Type: string or one of “metric”, “us_customary”

Example: "America/Los_Angeles"

Declared by:

domain under which home-assistant will be served.

Type: string

Example: "mydomain.com"

Declared by:

LDAP Integration App. Manual

Enabling this app will create a new LDAP configuration or update one that exists with the given host.

Type: submodule

Default: { }

Declared by:

Whether to enable LDAP app…

Type: boolean

Default: false

Example: true

Declared by:

Host serving the LDAP server.

If set, the Home Assistant auth will be disabled. To keep it, set keepDefaultAuth to true.

Type: string

Default: "127.0.0.1"

Declared by:

Keep Home Assistant auth active, even if LDAP is configured. Usually, you want to enable this to transfer existing users to LDAP and then you can disabled it.

Type: boolean

Default: false

Declared by:

Port of the service serving the LDAP server.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 389

Declared by:

Group users must belong to to be able to login to Nextcloud.

Type: string

Default: "homeassistant_user"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which home-assistant will be served.

Type: string

Example: "ha"

Declared by:

Whether to enable shb jellyfin.

Type: boolean

Default: false

Example: true

Declared by:

Domain to serve sites under.

Type: string

Example: "domain.com"

Declared by:

LDAP configuration.

Type: submodule

Default: { }

Declared by:

Whether to enable LDAP.

Type: boolean

Default: false

Example: true

Declared by:

LDAP admin group

Type: string

Default: "jellyfin_admin"

Declared by:

DC domain for LDAP.

Type: string

Example: "dc=mydomain,dc=com"

Declared by:

Host serving the LDAP server.

Type: string

Example: "127.0.0.1"

Declared by:

File containing the LDAP admin password.

Type: path

Declared by:

Port where the LDAP server is listening.

Type: signed integer

Example: 389

Declared by:

LDAP user group

Type: string

Default: "jellyfin_user"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

SSO configuration.

Type: submodule

Default: { }

Declared by:

Whether to enable SSO.

Type: boolean

Default: false

Example: true

Declared by:

OIDC admin group

Type: string

Default: "jellyfin_admin"

Declared by:

Client ID for the OIDC endpoint

Type: string

Default: "jellyfin"

Declared by:

OIDC endpoint for SSO

Type: string

Example: "https://authelia.example.com"

Declared by:

OIDC provider name

Type: string

Default: "Authelia"

Declared by:

File containing the OIDC shared secret.

Type: path

Declared by:

OIDC user group

Type: string

Default: "jellyfin_user"

Declared by:

Subdomain under which home-assistant will be served.

Type: string

Example: "jellyfin"

Declared by:

Whether to enable the LDAP service.

Type: boolean

Default: false

Example: true

Declared by:

dc domain to serve.

Type: string

Example: "dc=mydomain,dc=com"

Declared by:

Enable debug logging.

Type: boolean

Default: false

Declared by:

Domain under which the LDAP service will be served.

Type: string

Example: "mydomain.com"

Declared by:

File containing the JWT secret.

Type: path

Declared by:

Port on which the server listens for the LDAP protocol.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 3890

Declared by:

File containing the LDAP admin user password.

Type: path

Declared by:

Set a local network range to restrict access to the UI to only those IPs.

Type: null or string

Default: null

Example: "192.168.1.1/24"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by: