Appendix A. All Options

Configuration for bazarr

Type: submodule

Default: { }

Declared by:

Whether to enable bazarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."bazarr" = {
  request = config.shb.bazarr.backup;
  settings = {
    enable = true;
  };
}

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".db-shm"
    ".db-wal"
    ".mono"
  ];
  sourceDirectories = [
    "/var/lib/bazarr"
  ];
  user = "bazarr";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Directory where bazarr stores data.

Type: string

Default: "/var/lib/bazarr"

Declared by:

Domain under which bazarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for bazarr.

Type: XML value

Default: { }

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which bazarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive) (read only)

Default: 6767

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which bazarr will be served.

Type: string

Example: "bazarr"

Declared by:

Configuration for jackett

Type: submodule

Default: { }

Declared by:

Whether to enable jackett.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."jackett" = {
  request = config.shb.jackett.backup;
  settings = {
    enable = true;
  };
}

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".db-shm"
    ".db-wal"
    ".mono"
  ];
  sourceDirectories = [
    "/var/lib/jackett"
  ];
  user = "jackett";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Directory where jackett stores data.

Type: string

Default: "/var/lib/jackett"

Declared by:

Domain under which jackett will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for jackett.

Type: JSON value

Default: { }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

FlareSolverr endpoint.

Type: null or string

Default: null

Declared by:

File containing the Open Movie Database API key.

Type: null or (submodule)

Default: null

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Port on which jackett listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive) (read only)

Default: 9117

Declared by:

Port of the proxy. Ignored if ProxyType is set to -1

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: null

Declared by:

-1 = disabled 0 = HTTP 1 = SOCKS4 2 = SOCKS5

Type: one of “-1”, “0”, “1”, “2”

Default: "-1"

Declared by:

URL of the proxy. Ignored if ProxyType is set to -1

Type: null or string

Default: null

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which jackett will be served.

Type: string

Example: "jackett"

Declared by:

Configuration for lidarr

Type: submodule

Default: { }

Declared by:

Whether to enable lidarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."lidarr" = {
  request = config.shb.lidarr.backup;
  settings = {
    enable = true;
  };
}

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".db-shm"
    ".db-wal"
    ".mono"
  ];
  sourceDirectories = [
    "/var/lib/lidarr"
  ];
  user = "lidarr";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Directory where lidarr stores data.

Type: string

Default: "/var/lib/lidarr"

Declared by:

Domain under which lidarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for lidarr.

Type: XML value

Default: { }

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which lidarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8686

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which lidarr will be served.

Type: string

Example: "lidarr"

Declared by:

Configuration for radarr

Type: submodule

Default: { }

Declared by:

Whether to enable radarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."radarr" = {
  request = config.shb.radarr.backup;
  settings = {
    enable = true;
  };
}

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".db-shm"
    ".db-wal"
    ".mono"
  ];
  sourceDirectories = [
    "/var/lib/radarr"
  ];
  user = "radarr";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Directory where radarr stores data.

Type: string

Default: "/var/lib/radarr"

Declared by:

Domain under which radarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for radarr.

Type: XML value

Default: { }

Declared by:

Wether to send anonymous data or not.

Type: boolean

Default: false

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which radarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 7878

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which radarr will be served.

Type: string

Example: "radarr"

Declared by:

Configuration for readarr

Type: submodule

Default: { }

Declared by:

Whether to enable readarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."readarr" = {
  request = config.shb.readarr.backup;
  settings = {
    enable = true;
  };
}

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".db-shm"
    ".db-wal"
    ".mono"
  ];
  sourceDirectories = [
    "/var/lib/readarr"
  ];
  user = "readarr";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Directory where readarr stores data.

Type: string

Default: "/var/lib/readarr"

Declared by:

Domain under which readarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for readarr.

Type: XML value

Default: { }

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which readarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8787

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which readarr will be served.

Type: string

Example: "readarr"

Declared by:

Configuration for sonarr

Type: submodule

Default: { }

Declared by:

Whether to enable sonarr.

Type: boolean

Default: false

Example: true

Declared by:

Endpoint to the SSO provider. Leave null to not have SSO configured.

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."sonarr" = {
  request = config.shb.sonarr.backup;
  settings = {
    enable = true;
  };
}

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".db-shm"
    ".db-wal"
    ".mono"
  ];
  sourceDirectories = [
    "/var/lib/sonarr"
  ];
  user = "sonarr";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Directory where sonarr stores data.

Type: string

Default: "/var/lib/sonarr"

Declared by:

Domain under which sonarr will be served.

Type: string

Example: "example.com"

Declared by:

Specific options for sonarr.

Type: XML value

Default: { }

Declared by:

Path to api key secret file.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Log level.

Type: one of “debug”, “info”

Default: "info"

Declared by:

Port on which sonarr listens to incoming requests.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8989

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which sonarr will be served.

Type: string

Example: "sonarr"

Declared by:

Whether to enable selfhostblocks.audiobookshelf.

Type: boolean

Default: false

Example: true

Declared by:

OIDC endpoint for SSO

Type: string

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."audiobookshelf" = {
  request = config.shb.audiobookshelf.backup;
  settings = {
    enable = true;
  };
};

Type: submodule (read only)

Default:

{
  sourceDirectories = [
    "/var/lib/audiobookshelf"
  ];
  user = "audiobookshelf";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

domain under which audiobookshelf will be served.

Type: string

Example: "mydomain.com"

Declared by:

Extra configuration given to the systemd service file.

Type: attribute set of string

Default: { }

Example:

{
  MemoryHigh = "512M";
  MemoryMax = "900M";
}

Declared by:

Enable logging.

Type: null or one of “critical”, “error”, “warning”, “info”, “debug”

Default: false

Example: true

Declared by:

OIDC admin group

Type: string

Default: "audiobookshelf_admin"

Declared by:

Client ID for the OIDC endpoint

Type: string

Default: "audiobookshelf"

Declared by:

OIDC provider name

Type: string

Default: "Authelia"

Declared by:

OIDC user group

Type: string

Default: "audiobookshelf_user"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

SSO shared secret.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "audiobookshelf"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "audiobookshelfd.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Subdomain under which audiobookshelf will be served.

Type: string

Example: "abs"

Declared by:

Audiobookshelf web port

Type: signed integer

Default: 8113

Declared by:

Whether to enable selfhostblocks.authelia.

Type: boolean

Default: false

Example: true

Declared by:

System user for this Authelia instance.

Type: string

Default: "authelia"

Declared by:

dc domain for ldap.

Type: string

Example: "dc=mydomain,dc=com"

Declared by:

domain under which Authelia will be served.

Type: string

Example: "mydomain.com"

Declared by:

Hostname of the LDAP authentication backend.

Type: string

Example: "ldap.example.com"

Declared by:

Port of the LDAP authentication backend.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Example: "389"

Declared by:

Mount configuration. This is an output option.

Use it to initialize a block implementing the “mount” contract. For example, with a zfs dataset:

shb.zfs.datasets."authelia" = {
  poolName = "root";
} // config.shb.authelia.mount;

Type: anything (read only)

Default:

{
  path = "/var/lib/authelia-authelia.example.com";
}

Declared by:

Path to be mounted.

Type: string

Declared by:

Mount configuration for Redis. This is an output option.

Use it to initialize a block implementing the “mount” contract. For example, with a zfs dataset:

shb.zfs.datasets."redis-authelia" = {
  poolName = "root";
} // config.shb.authelia.mountRedis;

Type: anything (read only)

Default:

{
  path = "/var/lib/redis-authelia";
}

Declared by:

Path to be mounted.

Type: string

Declared by:

OIDC clients

Type: list of (attribute set of anything)

Default:

[
  {
    authorization_policy = "one_factor";
    client_id = "dummy_client";
    client_name = "Dummy Client so Authelia can start";
    client_secret = {
      source = <derivation dummy.secret>;
    };
    public = false;
    redirect_uris = [ ];
  }
]

Declared by:

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default: "one_factor"

Declared by:

Unique identifier of the OIDC client.

Type: string

Declared by:

Human readable description of the OIDC client.

Type: null or string

Default: null

Declared by:

File containing the shared secret with the OIDC client.

Generate with:

nix run nixpkgs#authelia -- \
    crypto hash generate pbkdf2 \
    --variant sha512 \
    --random \
    --random.length 72 \
    --random.charset rfc3986

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

If the OIDC client is public or not.

Type: boolean

Default: false

Declared by:

List of uris that are allowed to be redirected to.

Type: list of string

Declared by:

Scopes to ask for

Type: list of string

Default: [ ]

Example:

[
  "openid"
  "profile"
  "email"
  "groups"
]

Declared by:

If given, adds a port to the <subdomain>.<domain> endpoint.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: null

Declared by:

Rule based clients

Type: list of anything

Default: [ ]

Declared by:

Secrets needed by Authelia

Type: submodule

Declared by:

Identity provider OIDC HMAC secret.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Identity provider OIDC issuer private key.

Generate one with nix run nixpkgs#openssl -- genrsa -out keypair.pem 2048

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

JWT secret.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

LDAP admin user password.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Session secret.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Storage encryption key.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "authelia-shb.authelia.subdomain.shb.authelia.domain"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

If a string is given, writes notifications to the given path.Otherwise, send notifications by smtp.

https://www.authelia.com/configuration/notifications/introduction/

Type: string or null or (submodule)

Default: "/tmp/authelia-notifications"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which Authelia will be served.

Type: string

Example: "auth"

Declared by:

Generate a self-signed Certificate Authority.

Type: attribute set of (submodule)

Default: { }

Declared by:

Certificate Authority Name. You can put what you want here, it will be displayed by the browser.

Type: string

Default: "Self Host Blocks Certificate"

Declared by:

Paths where CA certs will be located.

This option implements the SSL Generator contract.

Type: anything

Default:

{
  cert = "/var/lib/certs/cas/‹name›.cert";
  key = "/var/lib/certs/cas/‹name›.key";
}

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certs.

This option implements the SSL Generator contract.

Type: string

Default: "shb-certs-ca-‹name›.service"

Declared by:

Generate certificates signed by Let’s Encrypt.

Type: attribute set of (submodule)

Default: { }

Declared by:

Additional environment variables used to configure the DNS provider.

For secrets, use shb.ssl.credentialsFile instead.

See the chosen provider’s documentation for available options.

Type: attribute set of string

Default: { }

Example:

{
  DNSPROVIDER_TIMEOUT = "10";
  DNSPROVIDER_PROPAGATION_TIMEOUT = "240";
}

Declared by:

Admin email in case certificate retrieval goes wrong.

Type: string

Declared by:

Systemd service(s) that must start successfully before attempting to reach acme.

Type: list of string

Default: [ ]

Example:

[ "dnsmasq.service" ]

Declared by:

Credentials file location for the chosen DNS provider.

The content of this file must expose environment variables as written in the documentation of each DNS provider.

For example, if the documentation says the credential must be located in the environment variable DNSPROVIDER_TOKEN, then the file content must be:

DNSPROVIDER_TOKEN=xyz

You can put non-secret environment variables here too or use shb.ssl.additionalcfg instead.

Type: null or path

Default: null

Example: "/run/secrets/ssl"

Declared by:

Enable debug logging

Type: boolean

Default: false

Declared by:

DNS provider to use.

See https://go-acme.github.io/lego/dns/ for the list of supported providers.

If null is given, use instead the reverse proxy to validate the domain.

Type: null or string

Default: null

Example: "linode"

Declared by:

IP of a DNS server used to resolve hostnames.

Type: string

Default: "8.8.8.8"

Declared by:

Domain to generate a certificate for. This can be a wildcard domain like *.example.com.

Type: string

Example: "example.com"

Declared by:

Other domains to generate a certificate for.

Type: list of string

Default: [ ]

Example:

[
  "sub1.example.com"
  "sub2.example.com"
]

Declared by:

Unix group owning this certificate.

Type: null or string

Default: "acme"

Example: "nginx"

Declared by:

Make all certificates available to given user.

Type: null or string

Default: null

Declared by:

Paths where certs will be located.

This option implements the SSL Generator contract.

Type: anything

Default:

{
  cert = "/var/lib/acme/‹name›/cert.pem";
  key = "/var/lib/acme/‹name›/key.pem";
}

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

The list of systemd services to call systemctl try-reload-or-restart on.

Type: list of string

Default: [ ]

Example:

[
  "nginx.service"
]

Declared by:

User Let’s Encrypt’s staging server.

Type: boolean

Default: false

Declared by:

Systemd oneshot service used to generate the certs.

This option implements the SSL Generator contract.

Type: string

Default: "shb-certs-cert-letsencrypt-‹name›.service"

Declared by:

Generate self-signed certificates signed by a Certificate Authority.

Type: attribute set of (submodule)

Default: { }

Declared by:

CA used to generate this certificate. Only used for self-signed.

This contract input takes the contract output of the shb.certs.cas SSL block.

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the CA will be located.

This option is the contract output of the shb.certs.cas SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the CA. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "ca-generator.service"

Declared by:

Domain to generate a certificate for. This can be a wildcard domain like *.example.com.

Type: string

Example: "example.com"

Declared by:

Other domains to generate a certificate for.

Type: list of string

Default: [ ]

Example:

[
  "sub1.example.com"
  "sub2.example.com"
]

Declared by:

Unix group owning this certificate.

Type: string

Default: "root"

Example: "nginx"

Declared by:

Paths where certs will be located.

This option implements the SSL Generator contract.

Type: anything

Default:

{
  cert = "/var/lib/certs/selfsigned/‹name›.cert";
  key = "/var/lib/certs/selfsigned/‹name›.key";
}

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

The list of systemd services to call systemctl try-reload-or-restart on.

Type: list of string

Default: [ ]

Example:

[
  "nginx.service"
]

Declared by:

Systemd oneshot service used to generate the certs.

This option implements the SSL Generator contract.

Type: string

Default: "shb-certs-cert-selfsigned-‹name›.service"

Declared by:

Systemd oneshot service used to generate the Certificate Authority bundle.

Type: string

Default: "shb-ca-bundle.service"

Declared by:

Contract for backing up files between a requester module and a provider module.

The requester communicates to the provider what files to backup through the request options.

The provider reads from the request options and backs up the requested files. It communicates to the requester what script is used to backup and restore the files through the result options.

Type: submodule

Declared by:

Options set by a requester module of the backup contract.

Type: submodule

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Options set by a provider module of the backup contract.

Type: submodule

Declared by:

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start my_backup_service.service

Type: string

Default: null

Declared by:

Name of script that can restore the database. One can then list snapshots with:

$ my_restore_script snapshots

And restore the database with:

$ my_restore_script restore latest

Type: string

Default: null

Declared by:

Contract for SSL Certificate generator.

Type: anything

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

List of mounts.

Type: list of (submodule)

Default: [ ]

Declared by:

Create a systemd automount unit

Type: boolean

Default: true

Declared by:

Directory creation mode

Type: null or string

Default: null

Example: "2775"

Declared by:

File creation mode

Type: null or string

Default: null

Example: "0664"

Declared by:

Group owner of the mount point.

Type: null or signed integer

Default: null

Example: 1000

Declared by:

Mount point to mount the webdav endpoint on.

Type: string

Example: "/mnt"

Declared by:

Password to connect to the webdav endpoint.

Type: string

Declared by:

Webdav endpoint to connect to.

Type: string

Example: "https://my.domain.com/dav"

Declared by:

User owner of the mount point.

Type: null or signed integer

Default: null

Example: 1000

Declared by:

Username to connect to the webdav endpoint.

Type: string

Declared by:

Whether to enable selfhostblocks.deluge.

Type: boolean

Default: false

Example: true

Declared by:

Plugins to enable, can include those from additionalPlugins.

Label is automatically enabled if any of the shb.arr.* service is enabled.

Type: list of string

Default: [ ]

Example:

[
  "Label"
]

Declared by:

Location of additional plugins. Each item in the list must be the path to the directory containing the plugin .egg file.

Type: list of path

Default: [ ]

Example:

additionalPlugins = [
  (pkgs.callPackage ({ python3, fetchFromGitHub }: python3.pkgs.buildPythonPackage {
    name = "deluge-autotracker";
    version = "1.0.0";
    src = fetchFromGitHub {
      owner = "ibizaman";
      repo = "deluge-autotracker";
      rev = "cc40d816a497bbf1c2ebeb3d8b1176210548a3e6";
      sha256 = "sha256-0LpVdv1fak2a5eX4unjhUcN7nMAl9fgpr3X+7XnQE6c=";
    } + "/autotracker";
    doCheck = false;
    format = "other";
    nativeBuildInputs = [ python3.pkgs.setuptools ];
    buildPhase = ''
    mkdir "$out"
    python3 setup.py install --install-lib "$out"
    '';
    doInstallPhase = false;
  }) {})
];

Declared by:

OIDC endpoint for SSO

Type: null or string

Default: null

Example: "https://authelia.example.com"

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."vaultwarden" = {
  request = config.shb.vaultwarden.backup;
  settings = {
    enable = true;
  };
};

Type: submodule (read only)

Default:

{
  sourceDirectories = [
    "/var/lib/deluge"
  ];
  user = "deluge";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Deluge daemon listen ports

Type: list of signed integer

Default:

[
  6881
  6889
]

Declared by:

Deluge daemon port

Type: signed integer

Default: 58846

Declared by:

Path where all configuration and state is stored.

Type: string

Default: "/var/lib/deluge"

Declared by:

domain under which deluge will be served.

Type: string

Example: "mydomain.com"

Declared by:

Extra configuration given to the systemd service file.

Type: attribute set of string

Default: { }

Example:

{
  MemoryHigh = "512M";
  MemoryMax = "900M";
}

Declared by:

Users having access to this deluge instance. Attrset of username to user options.

Type: attribute set of (submodule)

Declared by:

File containing the user password.

Type: submodule

Declared by:

File containing the value.

Type: path

Declared by:

An optional function to transform the secret.

Type: raw value

Default: null

Example:

v: "prefix-$${v}-suffix"

Declared by:

Password for mandatory localclient user.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "deluge"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "deluged.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Enable logging.

Type: null or one of “critical”, “error”, “warning”, “info”, “debug”

Default: null

Example: true

Declared by: