Configuration for bazarr

Type: submodule

Default:

{ }

Declared by:

Whether to enable bazarr.

Type: boolean

Default:

false

Example:

true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default:

null

Example:

"https://authelia.example.com"

Declared by:

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  ".db-shm"
  ".db-wal"
  ".mono"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/bazarr"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"bazarr"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.arr.bazarr.subdomain}.\${config.shb.arr.bazarr.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:6767"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Directory where bazarr stores data.

Type: string

Default:

"/var/lib/bazarr"

Declared by:

Domain under which bazarr will be served.

Type: string

Example:

"example.com"

Declared by:

LDAP group a user must belong to be able to login.

Note that all users are admins too.

Type: string

Default:

"arr_user"

Declared by:

Specific options for bazarr.

Type: open submodule of (XML value)

Default:

{ }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default:

"info"

Declared by:

Port on which bazarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive) (read only)

Default:

6767

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Subdomain under which bazarr will be served.

Type: string

Example:

"bazarr"

Declared by:

Configuration for jackett

Type: submodule

Default:

{ }

Declared by:

Whether to enable jackett.

Type: boolean

Default:

false

Example:

true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default:

null

Example:

"https://authelia.example.com"

Declared by:

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  ".db-shm"
  ".db-wal"
  ".mono"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/jackett"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"jackett"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.arr.jackett.subdomain}.\${config.shb.arr.jackett.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:9117"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Directory where jackett stores data.

Type: string

Default:

"/var/lib/jackett"

Declared by:

Domain under which jackett will be served.

Type: string

Example:

"example.com"

Declared by:

LDAP group a user must belong to be able to login.

Note that all users are admins too.

Type: string

Default:

"arr_user"

Declared by:

Specific options for jackett.

Type: open submodule of (JSON value)

Default:

{ }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

FlareSolverr endpoint.

Type: null or string

Default:

null

Declared by:

File containing the Open Movie Database API key.

Type: null or (submodule)

Default:

null

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Port on which jackett listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive) (read only)

Default:

9117

Declared by:

Port of the proxy. Ignored if ProxyType is set to -1

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by:

-1 = disabled 0 = HTTP 1 = SOCKS4 2 = SOCKS5

Type: one of “-1”, “0”, “1”, “2”

Default:

"-1"

Declared by:

URL of the proxy. Ignored if ProxyType is set to -1

Type: null or string

Default:

null

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Subdomain under which jackett will be served.

Type: string

Example:

"jackett"

Declared by:

Configuration for lidarr

Type: submodule

Default:

{ }

Declared by:

Whether to enable lidarr.

Type: boolean

Default:

false

Example:

true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default:

null

Example:

"https://authelia.example.com"

Declared by:

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  ".db-shm"
  ".db-wal"
  ".mono"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/lidarr"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"lidarr"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.arr.lidarr.subdomain}.\${config.shb.arr.lidarr.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:8686"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Directory where lidarr stores data.

Type: string

Default:

"/var/lib/lidarr"

Declared by:

Domain under which lidarr will be served.

Type: string

Example:

"example.com"

Declared by:

LDAP group a user must belong to be able to login.

Note that all users are admins too.

Type: string

Default:

"arr_user"

Declared by:

Specific options for lidarr.

Type: open submodule of (XML value)

Default:

{ }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default:

"info"

Declared by:

Port on which lidarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8686

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Subdomain under which lidarr will be served.

Type: string

Example:

"lidarr"

Declared by:

Configuration for radarr

Type: submodule

Default:

{ }

Declared by:

Whether to enable radarr.

Type: boolean

Default:

false

Example:

true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default:

null

Example:

"https://authelia.example.com"

Declared by:

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  ".db-shm"
  ".db-wal"
  ".mono"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/radarr"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"radarr"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.arr.radarr.subdomain}.\${config.shb.arr.radarr.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:7878"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Directory where radarr stores data.

Type: string

Default:

"/var/lib/radarr"

Declared by:

Domain under which radarr will be served.

Type: string

Example:

"example.com"

Declared by:

LDAP group a user must belong to be able to login.

Note that all users are admins too.

Type: string

Default:

"arr_user"

Declared by:

Specific options for radarr.

Type: open submodule of (XML value)

Default:

{ }

Declared by:

Wether to send anonymous data or not.

Type: boolean

Default:

false

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default:

"info"

Declared by:

Port on which radarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

7878

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Subdomain under which radarr will be served.

Type: string

Example:

"radarr"

Declared by:

Configuration for readarr

Type: submodule

Default:

{ }

Declared by:

Whether to enable readarr.

Type: boolean

Default:

false

Example:

true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default:

null

Example:

"https://authelia.example.com"

Declared by:

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  ".db-shm"
  ".db-wal"
  ".mono"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/readarr"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"readarr"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.arr.readarr.subdomain}.\${config.shb.arr.readarr.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:8787"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Directory where readarr stores data.

Type: string

Default:

"/var/lib/readarr"

Declared by:

Domain under which readarr will be served.

Type: string

Example:

"example.com"

Declared by:

LDAP group a user must belong to be able to login.

Note that all users are admins too.

Type: string

Default:

"arr_user"

Declared by:

Specific options for readarr.

Type: open submodule of (XML value)

Default:

{ }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default:

"info"

Declared by:

Port on which readarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8787

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Subdomain under which readarr will be served.

Type: string

Example:

"readarr"

Declared by:

Configuration for sonarr

Type: submodule

Default:

{ }

Declared by:

Whether to enable sonarr.

Type: boolean

Default:

false

Example:

true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default:

null

Example:

"https://authelia.example.com"

Declared by:

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[
  ".db-shm"
  ".db-wal"
  ".mono"
]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/sonarr"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"sonarr"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.arr.sonarr.subdomain}.\${config.shb.arr.sonarr.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:8989"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

Directory where sonarr stores data.

Type: string

Default:

"/var/lib/sonarr"

Declared by:

Domain under which sonarr will be served.

Type: string

Example:

"example.com"

Declared by:

LDAP group a user must belong to be able to login.

Note that all users are admins too.

Type: string

Default:

"arr_user"

Declared by:

Specific options for sonarr.

Type: open submodule of (XML value)

Default:

{ }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default:

"info"

Declared by:

Port on which sonarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8989

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

Subdomain under which sonarr will be served.

Type: string

Example:

"sonarr"

Declared by:

Whether to enable selfhostblocks.audiobookshelf.

Type: boolean

Default:

false

Example:

true

Declared by:

Backup configuration.

Type: submodule

Declared by:

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

File patterns to exclude.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default:

{ }

Declared by:

Hooks to run after backup.

Type: list of string

Default:

[ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default:

[ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/audiobookshelf"
]

Example:

"/var/lib/vaultwarden"

Declared by:

Unix user doing the backups.

Type: string

Default:

"audiobookshelf"

Example:

"vaultwarden"

Declared by:

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.audiobookshelf.subdomain}.\${config.shb.audiobookshelf.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:8113"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

domain under which audiobookshelf will be served.

Type: string

Example:

"mydomain.com"

Declared by:

Extra configuration given to the systemd service file.

Type: attribute set of string

Default:

{ }

Example:

{
  MemoryHigh = "512M";
  MemoryMax = "900M";
}

Declared by:

Enable logging.

Type: null or one of “critical”, “error”, “warning”, “info”, “debug”

Default:

false

Example:

true

Declared by:

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

Path to the cert file.

Type: absolute path

Declared by:

Path to the key file.

Type: absolute path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

SSO configuration.

Type: submodule

Default:

{ }

Declared by:

Whether to enable SSO.

Type: boolean

Default:

false

Example:

true

Declared by:

OIDC admin group

Type: string

Default:

"audiobookshelf_admin"

Declared by:

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default:

"one_factor"

Declared by:

Client ID for the OIDC endpoint

Type: string

Default:

"audiobookshelf"

Declared by:

OIDC endpoint for SSO

Type: string

Example:

"https://authelia.example.com"

Declared by:

OIDC provider name

Type: string

Default:

"Authelia"

Declared by:

OIDC shared secret for Audiobookshelf.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"audiobookshelf"

Declared by:

Mode of the secret file.

Type: string

Default:

"0440"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"audiobookshelf"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "audiobookshelfd.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

OIDC shared secret for Authelia.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: { mode = 0400; owner = config.shb.authelia.autheliaUser; group = root; restartUnits = [ ]; }

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: config.shb.authelia.autheliaUser

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[ ]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

OIDC user group

Type: string

Default:

"audiobookshelf_user"

Declared by:

Subdomain under which audiobookshelf will be served.

Type: string

Example:

"abs"

Declared by:

Audiobookshelf web port

Type: signed integer

Default:

8113

Declared by:

Whether to enable selfhostblocks.authelia.

Type: boolean

Default:

false

Example:

true

Declared by:

System user for this Authelia instance.

Type: string

Default:

"authelia"

Declared by:

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"https://\${config.shb.authelia.subdomain}.\${config.shb.authelia.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://127.0.0.1:9091"

Example:

"http://127.0.0.1:8081"

Declared by:

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

dc domain for ldap.

Type: string

Example:

"dc=mydomain,dc=com"

Declared by:

Set logging level to debug and add a mitmdump instance to see exactly what Authelia receives and sends back.

Type: boolean

Default:

false

Declared by:

domain under which Authelia will be served.

Type: string

Example:

"mydomain.com"

Declared by:

Extra definitions.

Type: attribute set of (attribute set)

Default:

{ }

Declared by:

Extra OIDC authorization policies.

Type: attribute set of (attribute set)

Default:

{ }

Declared by:

Extra OIDC claims policies.

Type: attribute set of (attribute set)

Default:

{ }

Declared by:

Extra OIDC scopes.

Type: attribute set of (attribute set)

Default:

{ }

Declared by:

Hostname of the LDAP authentication backend.

Type: string

Example:

"ldap.example.com"

Declared by:

Port of the LDAP authentication backend.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Example:

"389"

Declared by:

Mount configuration. This is an output option.

Use it to initialize a block implementing the “mount” contract. For example, with a zfs dataset:

shb.zfs.datasets."authelia" = {
  poolName = "root";
} // config.shb.authelia.mount;

Type: open submodule of anything (read only)

Default:

{
  path = "/var/lib/authelia-authelia.example.com";
}

Declared by:

Path to be mounted.

Type: string

Declared by:

Mount configuration for Redis. This is an output option.

Use it to initialize a block implementing the “mount” contract. For example, with a zfs dataset:

shb.zfs.datasets."redis-authelia" = {
  poolName = "root";
} // config.shb.authelia.mountRedis;

Type: open submodule of anything (read only)

Default:

{
  path = "/var/lib/redis-authelia";
}

Declared by:

Path to be mounted.

Type: string

Declared by:

OIDC clients

Type: list of (open submodule of attribute set of anything)

Default:

[
  {
    authorization_policy = "one_factor";
    client_id = "dummy_client";
    client_name = "Dummy Client so Authelia can start";
    client_secret = {
      source = <derivation dummy.secret>;
    };
    public = false;
    redirect_uris = [ ];
  }
]

Declared by:

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default:

"one_factor"

Declared by:

Claim policy.

Defaults to ‘default’ to provide a backwards compatible experience. Read this document for more information.

Type: null or string

Default:

"default"

Declared by:

Unique identifier of the OIDC client.

Type: string

Declared by:

Human readable description of the OIDC client.

Type: null or string

Default:

null

Declared by:

File containing the shared secret with the OIDC client.

Generate with:

nix run nixpkgs#authelia -- \
    crypto hash generate pbkdf2 \
    --variant sha512 \
    --random \
    --random.length 72 \
    --random.charset rfc3986

Type: submodule

Declared by:

File containing the value.

Type: absolute path

Declared by:

An optional function to transform the secret.

Type: raw value

Default:

null

Example:

v: "prefix-$${v}-suffix"

Declared by:

If the OIDC client is public or not.

Type: boolean

Default:

false

Declared by:

List of uris that are allowed to be redirected to.

Type: list of string

Default:

[ ]

Declared by:

Scopes to ask for. See https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims

Type: list of string

Default:

[ ]

Example:

[
  "openid"
  "profile"
  "email"
  "groups"
]

Declared by:

If given, adds a port to the <subdomain>.<domain> endpoint.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by:

Rule based clients

Type: list of anything

Default:

[ ]

Declared by:

Secrets needed by Authelia

Type: submodule

Declared by:

Identity provider OIDC HMAC secret. Must be >= 40 characters.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

Identity provider OIDC issuer private key.

Generate one with nix run nixpkgs#openssl -- genrsa -out keypair.pem 2048

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

JWT secret.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string

Default:

"authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

LDAP admin user password.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

Linux user owning the secret file.

Type: string