​

settings.fleet.connectionUser
string
default: "fleet-connection-user"

User to connect to the upstream machine and patch the kubeconfig secret of the downstream cluster

Declared in modules/fleet/default.nix.

​

settings.fleet.enable
boolean
default: false

Enable fleet.

By default, fleet is enabled if kubernetes is enabled.

Declared in modules/fleet/default.nix.

​

settings.fleet.fleetNamespace
string
default: "fleet-system"

Namespace where fleet will run

Declared in modules/fleet/default.nix.

​

settings.fleet.helmChartVersion
string
default: "0.9.0"

Fleet Helm chart version

Declared in modules/fleet/default.nix.

​

settings.fleet.labels
attribute set of string
default: {}

Labels to add to the cluster

Declared in modules/fleet/default.nix.

​

settings.fleet.upstream.clustersNamespace
string
default: "clusters"

Namespace where the clusters are defined.

Declared in modules/fleet/upstream.nix.

​

settings.fleet.upstream.enable
boolean
default: false

Enable the upstream mode for the fleet

Declared in modules/fleet/upstream.nix.

​

settings.fleet.values
attribute set of string
default: {}

Template values of the cluster

Declared in modules/fleet/default.nix.

​

settings.fs.enable
boolean
default: true

Enable services related to better filesystem management, for instance fstrim and udisks2.

Declared in modules/fs/default.nix.

​

settings.git.repos
attribute set of path
default: {}

Set of local git repositories to be committed locally on each activation.

Declared in modules/git/default.nix.

​

settings.impermanence.enable
boolean
default: false

Whether to enable impermanence.

Example
true

Declared in modules/impermanence/default.nix.

​

settings.impermanence.persistentSystemPath
string
default: "/nix/persist/system"

Path to where the persisted part of the system lies

Declared in modules/impermanence/default.nix.

​

settings.kubernetes.enable
boolean
default: false

Run a k3s Kubernetes node on the machine.

Declared in modules/kubernetes/default.nix.

​

settings.kubernetes.group
string
default: "k8s-admin"

Group that has access to the k3s config and data.

Declared in modules/kubernetes/default.nix.

​

settings.kubernetes.vpn.cidr
string
default: "10.101.0.0/24"

CIDR that defines the VPN network of the Kubernetes cluster.

Declared in modules/kubernetes/vpn.nix.

​

settings.kubernetes.vpn.domain
string
default: "cluster"

Domain name of the cluster.

The clusters will then be accessible through hostname.domain.

Declared in modules/kubernetes/vpn.nix.

​

settings.local-server.enable
boolean
default: false

Label this machine as a local server.

Declared in modules/local-server/default.nix.

​

settings.localIP
null or string

IP of the machine in the local network

Declared in modules/networking/default.nix.

​

settings.mdns.enable
boolean
default: true

Enable mDNS service (avahi).

Declared in modules/mdns/default.nix.

​

settings.nix-builder.enable
boolean
default: false

Whether to enable the machine as a Nix builder for the other machines.

Example
true

Declared in modules/nix-builder/default.nix.

​

settings.nix-builder.maxJobs
signed integer
default: 1

The maximum number of jobs that can be run in parallel on the builder. The default is nix.settings.cores if it is greater than 0, otherwise 1

Declared in modules/nix-builder/default.nix.

​

settings.nix-builder.speedFactor
signed integer
default: 1

The speed factor of the builder. The speed factor is used to prioritize builders when multiple builders are available. The higher the speed factor, the more likely it is that the builder will be used.

Declared in modules/nix-builder/default.nix.

​

settings.nix-builder.ssh.privateKeyFile
null or string

The private key file of the Nix builder.

Declared in modules/nix-builder/default.nix.

​

settings.nix-builder.ssh.publicKey
null or string

The public key of the Nix builder.

Declared in modules/nix-builder/default.nix.

​

settings.nix-builder.ssh.user
string
default: "builder"

The user name of the Nix builder.

Declared in modules/nix-builder/default.nix.

​

settings.nix-builder.supportedFeatures
list of string
default: ["nixos-test","benchmark","big-parallel","kvm"]

A list of features that the builder supports

Declared in modules/nix-builder/default.nix.

​

settings.prometheus.enable
boolean
default: false

Label the machine as using the Prometheus monitoring system.

By default, the machine is labeled when the Kubernetes cluster is enabled.

Declared in modules/prometheus/default.nix.

​

settings.prometheus.federation.enable
boolean
default: true

Label the machine as using Prometheus in a federation of multiple Prometheus instances.

Declared in modules/prometheus/default.nix.

​

settings.prometheus.federation.upstream.enable
boolean
default: true

Label the machine as being the upstream Prometheus instance in a federation.

Declared in modules/prometheus/default.nix.

​

settings.publicIP
null or string

Public IP of the machine

Declared in modules/networking/default.nix.

​

settings.ssh.fail2ban.enable
boolean
default: false

Enable fail2ban to block SSH brute force attacks.

By default, Fail2ban is enabled if sshguard is disabled.

Declared in modules/ssh/default.nix.

​

settings.ssh.sshguard.enable
boolean
default: true

Enable sshguard to block SSH brute force attacks.

Declared in modules/ssh/default.nix.

​

settings.sshPublicKey
string
required

SSH public key of the machine.

This option is required to decode the secrets defined in the main features like users, wireless networks, vpn, etc.

Declared in modules/ssh/default.nix.

​

settings.swap.file.enable
boolean
default: true

Enable a swap file on the root partition.

Declared in modules/swap/default.nix.

​

settings.swap.file.size
integer between 0 and 10 (both inclusive)
default: 1

Size of the swap file in GiB.

Declared in modules/swap/default.nix.

​

settings.swap.zram.enable
boolean
default: true

Enable a swap file in a zram device.

Declared in modules/swap/default.nix.

​

settings.time.enable
boolean
default: true

Enable timesyncd and htpdate.

Declared in modules/time/default.nix.

​

settings.users.users
attribute set of (submodule)
default: {}

Set of users to create and configure.

Declared in modules/users/default.nix.

​

settings.users.users.<name>.enable
boolean
default: false

Whether the user is enabled in the machine.

Declared in modules/users/default.nix.

​

settings.users.users.<name>.isAdmin
boolean
default: false

Whether the user is an admin of the machine.

Declared in modules/users/default.nix.

​

settings.users.users.<name>.isSystemUser
boolean
default: false

Whether the user is a system user.

Declared in modules/users/default.nix.

​

settings.users.users.<name>.publicKeys
list of valid ecdsa-sha2-nistp256 or ssh-ed25519 or ssh-rsa key, meaning a string matching the pattern ^ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTY[[:lower:][:upper:][:digit:]\/+]{108}=$|^ssh-ed25519 AAAAC3NzaC1lZDI1NTE5[[:lower:][:upper:][:digit:]\/+]{48}$|^ssh-rsa AAAAB3NzaC1yc2E[[:lower:][:upper:][:digit:]\/+]{355,}={0,2}$
default: []

Public keys of the user, without the comment (user@host) part.

Declared in modules/users/default.nix.

​

settings.vpn.bastion.cidr
string
default: "10.100.0.0/24"

CIDR that defines the VPN network.

It is also required to determine the machine IP address from the machine ID on the VPN.

For instance, if the CIDR is 10.100.0.0/24 and settings.vpn.id is 5, then the machine IP address will be 10.100.0.5.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.domain
string
default: "vpn"

Domain name of the VPN.

The machines will then be accessible through hostname.domain.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.enable
boolean
default: false

Whether to enable the Wireguard VPN server on this machine.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.externalInterface
string
default: "eth0"

External interface of the bastion for NAT.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.extraPeers
attribute set of (submodule)
default: {}

Extra machines to add to the VPN.

This is useful when you want to add a machine to the VPN that is not part of the cluster.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.extraPeers.<name>.id
null or signed integer

Id of the machine. Each machine must have an unique value.

This id will be translated into an IP with settings.vpn.bastion.cidr when using the VPN module.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.extraPeers.<name>.publicKey
null or string

Wireguard public key of the machine.

This value is required when the VPN is enabled.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.bastion.port
signed integer
default: 51820

This port must not be block by an external firewall so clients can reach it.

Declared in modules/vpn/bastion.nix.

​

settings.vpn.enable
boolean
default: false

Whether to enable the Wireguard VPN.

Example
true

Declared in modules/vpn/default.nix.

​

settings.vpn.id
null or signed integer

Id of the machine. Each machine must have an unique value.

This id will be translated into an IP with settings.vpn.bastion.cidr when using the VPN module.

Declared in modules/vpn/default.nix.

​

settings.vpn.publicKey
null or string

Wireguard public key of the machine.

This value is required when the VPN is enabled.

Declared in modules/vpn/default.nix.

Was this page helpful?

Nicos optionsHardware modules