orangc's Flake Documentation Options

aagl.enableNixpkgsReleaseBranchCheck Link copied!

Type: boolean

Determines whether to check for release version mismatch between AAGL and Nixpkgs. Using mismatched versions is likely to cause errors and unexpected behavior.

Default: true

modules.core.boot.enable Link copied!

Type: boolean

Whether to enable boot(loader) configuration.

Default: false
Example: true

modules.core.locale Link copied!

Type: string

The system locale

Default: "en_GB.UTF-8"

modules.core.networking.enable Link copied!

Type: boolean

Whether to enable Enable networking.

Default: false
Example: true

modules.core.users.autoDeclare Link copied!

Type: boolean

automatic declaration of user accounts

Default: true

modules.core.users.home-manager.autoDeclare Link copied!

Type: boolean

automatic declaration of home-manager users

Default: true

modules.core.users.home-manager.stateVersion Link copied!

Type: string

The state version of home-manager to use for all automatically declared users on this machine

Default: "26.05"

modules.desktop.compositors.hyprland.enable Link copied!

Type: boolean

Whether to enable Enable hyprland.

Default: false
Example: true

modules.desktop.display-managers.sddm.enable Link copied!

Type: boolean

Whether to enable Enable SDDM.

Default: false
Example: true

modules.desktop.display-managers.sddm.theme Link copied!

Type: string

The SDDM theme to use

Default: "sddm-astronaut-theme"

modules.desktop.display-managers.sddm.wallpaper Link copied!

Type: absolute path

Wallpaper to use for the SDDM Astronaut theme

Default: <derivation misty-boat>

modules.desktop.file-managers.thunar.archive-plugin.enable Link copied!

Type: boolean

Whether to enable Enable thunar's archive plugin.

Default: false
Example: true

modules.desktop.file-managers.thunar.enable Link copied!

Type: boolean

Whether to enable Enable thunar.

Default: false
Example: true

modules.desktop.fonts.enable Link copied!

Type: boolean

Whether to enable Enable fonts.

Default: false
Example: true

modules.gaming.bottles.enable Link copied!

Type: boolean

Whether to enable Bottles for gaming.

Default: false
Example: true

modules.gaming.heroic.enable Link copied!

Type: boolean

Whether to enable Heroic Launcher.

Default: false
Example: true

modules.gaming.hoyoverse.enable Link copied!

Type: boolean

Whether to enable An Anime Game Launcher.

Default: false
Example: true

modules.gaming.hoyoverse.genshin.enable Link copied!

Type: boolean

Whether to enable Genshin Impact.

Default: false
Example: true

modules.gaming.hoyoverse.honkai.enable Link copied!

Type: boolean

Whether to enable Honkai Impact.

Default: false
Example: true

modules.gaming.hoyoverse.zzz.enable Link copied!

Type: boolean

Whether to enable Zenless Zone Zero.

Default: false
Example: true

modules.gaming.lutris.enable Link copied!

Type: boolean

Whether to enable Lutris for gaming.

Default: false
Example: true

modules.gaming.minecraft.enable Link copied!

Type: boolean

Whether to enable PrismLauncher for Minecraft.

Default: false
Example: true

modules.gaming.minecraft.labymod.enable Link copied!

Type: boolean

Whether to enable Labymod Launcher for Minecraft.

Default: false
Example: true

modules.gaming.minecraft.modrinth.enable Link copied!

Type: boolean

Whether to enable Modrinth Launcher for Minecraft.

Default: false
Example: true

modules.gaming.osu.enable Link copied!

Type: boolean

Whether to enable Osu!.

Default: false
Example: true

modules.gaming.steam.enable Link copied!

Type: boolean

Whether to enable Steam.

Default: false
Example: true

modules.gaming.wine.enable Link copied!

Type: boolean

Whether to enable Wine and associated packages for gaming.

Default: false
Example: true

modules.hardware.bluetooth.enable Link copied!

Type: boolean

Whether to enable Enable bluetooth.

Default: false
Example: true

modules.hardware.btrfs.enable Link copied!

Type: boolean

Whether to enable Enable btrfs autoscrub.

Default: false
Example: true

modules.hardware.drivers.amd.enable Link copied!

Type: boolean

Whether to enable Enable AMD Drivers.

Default: false
Example: true

modules.hardware.drivers.intel.enable Link copied!

Type: boolean

Whether to enable Enable Intel Graphics Drivers.

Default: false
Example: true

modules.hardware.drivers.nvidia.enable Link copied!

Type: boolean

Whether to enable Enable Nvidia Drivers.

Default: false
Example: true

modules.hardware.printing.enable Link copied!

Type: boolean

Whether to enable Enable printing.

Default: false
Example: true

modules.hardware.sound.enable Link copied!

Type: boolean

Whether to enable sound with pipewire.

Default: false
Example: true

modules.programs.appimages.enable Link copied!

Type: boolean

Whether to enable Enable AppImages.

Default: false
Example: true

modules.programs.syncthing.enable Link copied!

Type: boolean

Whether to enable Syncthing folder syncing.

Default: false
Example: true

modules.security.restic.enable Link copied!

Type: boolean

Whether to enable Enable restic backups.

Default: false
Example: true

modules.security.restic.keepLast Link copied!

Type: signed integer

Number of snapshots (of backups) to keep

Default: 5

modules.security.restic.paths Link copied!

Type: list of string

Paths to files/folders to backup

Default: [ ]

modules.security.restic.repository Link copied!

Type: string

Location of the restic repository to backup to

Default: "/mnt/backup"

modules.security.sops.enable Link copied!

Type: boolean

Whether to enable Enable sops-nix secret management.

Default: false
Example: true

modules.security.sops.secrets.<name>.format Link copied!

Type: one of "yaml", "json", "binary", "dotenv", "ini"

File format used to decrypt the sops secret. Binary files are written to the target file as is.

Default: "yaml"

modules.security.sops.secrets.<name>.gid Link copied!

Type: null or signed integer

GID of the file, only applied when group is null. The GID will be applied even if the corresponding group doesn't exist.

Default: 0

modules.security.sops.secrets.<name>.group Link copied!

Type: null or string

Group of the file. Can only be set if gid is 0.

Default: {option}`config.users.users.${owner}.group`

modules.security.sops.secrets.<name>.key Link copied!

Type: string

Key used to lookup in the sops file. No tested data structures are supported right now. This option is ignored if format is binary. "" means whole file.

Default: "‹name›"

modules.security.sops.secrets.<name>.mode Link copied!

Type: string

Permissions mode of the in octal.

Default: "0400"

modules.security.sops.secrets.<name>.name Link copied!

Type: string

Name of the file used in /run/secrets

Default: "‹name›"

modules.security.sops.secrets.<name>.neededForUsers Link copied!

Type: boolean

Enabling this option causes the secret to be decrypted before users and groups are created. This can be used to retrieve user's passwords from sops-nix. Setting this option moves the secret to /run/secrets-for-users and disallows setting owner and group to anything else than root.

Default: false

modules.security.sops.secrets.<name>.owner Link copied!

Type: null or string

User of the file. Can only be set if uid is 0.

Default: null

modules.security.sops.secrets.<name>.path Link copied!

Type: string

Path where secrets are symlinked to. If the default is kept no symlink is created.

Default: "/run/secrets-for-users/$name when neededForUsers is set, /run/secrets/$name when otherwise."

modules.security.sops.secrets.<name>.reloadUnits Link copied!

Type: list of string

Names of units that should be reloaded when this secret changes. This works the same way as <xref linkend="opt-systemd.services.name.reloadTriggers" />.

Default: [ ]
Example:
[
  "sshd.service"
]

modules.security.sops.secrets.<name>.restartUnits Link copied!

Type: list of string

Names of units that should be restarted when this secret changes. This works the same way as <xref linkend="opt-systemd.services.name.restartTriggers" />.

Default: [ ]
Example:
[
  "sshd.service"
]

modules.security.sops.secrets.<name>.sopsFile Link copied!

Type: absolute path

Sops file the secret is loaded from.

Default: ${config.sops.defaultSopsFile}

modules.security.sops.secrets.<name>.sopsFileHash Link copied!

Type: string

Hash of the sops file, useful in <xref linkend="opt-systemd.services.name.restartTriggers" />.

modules.security.sops.secrets.<name>.uid Link copied!

Type: null or signed integer

UID of the file, only applied when owner is null. The UID will be applied even if the corresponding user doesn't exist.

Default: 0

modules.security.sudo-rs Link copied!

Type: submodule

Alias of security.sudo-rs.

modules.services.databases.couchdb.enable Link copied!

Type: boolean

Whether to enable CouchDB Server.

Default: false
Example: true

modules.services.databases.postgresql.databases Link copied!

Type: list of string

Names of database to ensure exist in PostgreSQL.

Default: [ ]

modules.services.databases.postgresql.enable Link copied!

Type: boolean

Whether to enable Enable postgresql.

Default: false
Example: true

modules.services.databases.postgresql.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port for postgresql to be hosted at

Default: 5432

modules.services.databases.postgresql.users Link copied!

Type: list of string

Names of users to ensure exist in PostgreSQL.

Default: [ ]

modules.services.files.copyparty.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.files.copyparty.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Copyparty.

Default: false
Example: true

modules.services.files.copyparty.enable Link copied!

Type: boolean

Whether to enable Copyparty.

Default: false
Example: true

modules.services.files.copyparty.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Copyparty in the Glance dashboard.

Default: false
Example: true

modules.services.files.copyparty.glance.icon Link copied!

Type: string

The icon for Copyparty to be displayed in the Glance dashboard.

Default: "sh:copyparty"

modules.services.files.copyparty.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Copyparty at files.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.files.copyparty.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Copyparty"

modules.services.files.copyparty.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Copyparty goes down.

Default: false
Example: true

modules.services.files.copyparty.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Copyparty is hosted at.

Default: 8800

modules.services.files.copyparty.subdomain Link copied!

Type: string

The domain at which Copyparty is hosted at.

Default: "files"

modules.services.files.cryptpad.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.files.cryptpad.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Cryptpad.

Default: false
Example: true

modules.services.files.cryptpad.enable Link copied!

Type: boolean

Whether to enable Cryptpad.

Default: false
Example: true

modules.services.files.cryptpad.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Cryptpad in the Glance dashboard.

Default: false
Example: true

modules.services.files.cryptpad.glance.icon Link copied!

Type: string

The icon for Cryptpad to be displayed in the Glance dashboard.

Default: "sh:cryptpad"

modules.services.files.cryptpad.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Cryptpad at pad.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.files.cryptpad.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Cryptpad"

modules.services.files.cryptpad.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Cryptpad goes down.

Default: false
Example: true

modules.services.files.cryptpad.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Cryptpad is hosted at.

Default: 8800

modules.services.files.cryptpad.subdomain Link copied!

Type: string

The domain at which Cryptpad is hosted at.

Default: "pad"

modules.services.files.microbin.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.files.microbin.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Microbin.

Default: false
Example: true

modules.services.files.microbin.enable Link copied!

Type: boolean

Whether to enable Microbin.

Default: false
Example: true

modules.services.files.microbin.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Microbin in the Glance dashboard.

Default: false
Example: true

modules.services.files.microbin.glance.icon Link copied!

Type: string

The icon for Microbin to be displayed in the Glance dashboard.

Default: "sh:microbin"

modules.services.files.microbin.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Microbin at bin.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.files.microbin.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Microbin"

modules.services.files.microbin.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Microbin goes down.

Default: false
Example: true

modules.services.files.microbin.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Microbin is hosted at.

Default: 8800

modules.services.files.microbin.subdomain Link copied!

Type: string

The domain at which Microbin is hosted at.

Default: "bin"

modules.services.files.wastebin.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.files.wastebin.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Wastebin.

Default: false
Example: true

modules.services.files.wastebin.enable Link copied!

Type: boolean

Whether to enable Wastebin.

Default: false
Example: true

modules.services.files.wastebin.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Wastebin in the Glance dashboard.

Default: false
Example: true

modules.services.files.wastebin.glance.icon Link copied!

Type: string

The icon for Wastebin to be displayed in the Glance dashboard.

Default: "sh:wastebin"

modules.services.files.wastebin.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Wastebin at bin.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.files.wastebin.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Wastebin"

modules.services.files.wastebin.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Wastebin goes down.

Default: false
Example: true

modules.services.files.wastebin.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Wastebin is hosted at.

Default: 8800

modules.services.files.wastebin.subdomain Link copied!

Type: string

The domain at which Wastebin is hosted at.

Default: "bin"

modules.services.files.zipline.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.files.zipline.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Zipline.

Default: false
Example: true

modules.services.files.zipline.enable Link copied!

Type: boolean

Whether to enable Zipline.

Default: false
Example: true

modules.services.files.zipline.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Zipline in the Glance dashboard.

Default: false
Example: true

modules.services.files.zipline.glance.icon Link copied!

Type: string

The icon for Zipline to be displayed in the Glance dashboard.

Default: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/zipline.png"

modules.services.files.zipline.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Zipline at zip.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.files.zipline.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Zipline"

modules.services.files.zipline.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Zipline goes down.

Default: false
Example: true

modules.services.files.zipline.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Zipline is hosted at.

Default: 8800

modules.services.files.zipline.subdomain Link copied!

Type: string

The domain at which Zipline is hosted at.

Default: "zip"

modules.services.gaming.minecraft.enable Link copied!

Type: boolean

Whether to enable Enable minecraft.

Default: false
Example: true

modules.services.gaming.minecraft.juniper-s10.enable Link copied!

Type: boolean

Whether to enable Enable Juniper SMP server.

Default: false
Example: true

modules.services.gaming.minecraft.juniper-s10.gamerules Link copied!

Type: attribute set

Server gamerules

Default: { commandBlockOutput = false; commandModificationBlockLimit = 1000; keepInventory = true; }

modules.services.gaming.minecraft.juniper-s10.maxRAM Link copied!

Type: signed integer

Maximum amount of RAM for Juniper to use in gigabytes

Default: 8

modules.services.gaming.minecraft.juniper-s10.minRAM Link copied!

Type: signed integer

Minimum amount of RAM for Juniper to use in gigabytes

Default: 4

modules.services.gaming.minecraft.juniper-s10.motd Link copied!

Type: string

The message displayed in the server list of the client

Default: "Powered by NixOS!"

modules.services.gaming.minecraft.juniper-s10.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port for Juniper to be hosted at

Default: 8800

modules.services.gaming.minecraft.juniper-s11.enable Link copied!

Type: boolean

Whether to enable Enable Juniper SMP server.

Default: false
Example: true

modules.services.gaming.minecraft.juniper-s11.gamerules Link copied!

Type: attribute set

Server gamerules

Default: { commandBlockOutput = false; commandModificationBlockLimit = 1000; keepInventory = true; }

modules.services.gaming.minecraft.juniper-s11.maxRAM Link copied!

Type: signed integer

Maximum amount of RAM for Juniper to use in gigabytes

Default: 8

modules.services.gaming.minecraft.juniper-s11.minRAM Link copied!

Type: signed integer

Minimum amount of RAM for Juniper to use in gigabytes

Default: 4

modules.services.gaming.minecraft.juniper-s11.motd Link copied!

Type: string

The message displayed in the server list of the client

Default: "Powered by NixOS!"

modules.services.gaming.minecraft.juniper-s11.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port for Juniper to be hosted at

Default: 8800

modules.services.infrastructure.caddy.enable Link copied!

Type: boolean

Whether to enable Enable Caddy.

Default: false
Example: true

modules.services.infrastructure.caddy.virtualHosts Link copied!

Type: attribute set of (open submodule of (attribute set))

Collect virtual host entries from other modules

Default: { }

modules.services.infrastructure.cloudflared.enable Link copied!

Type: boolean

Whether to enable Enable Cloudflared.

Default: false
Example: true

modules.services.infrastructure.cloudflared.ingress Link copied!

Type: attribute set of string

Collect ingress entries from other modules

Default: { }

modules.services.infrastructure.duckdns.enable Link copied!

Type: boolean

Whether to enable Enable duckdns.

Default: false
Example: true

modules.services.infrastructure.tailscale.enable Link copied!

Type: boolean

Whether to enable Enable tailscale.

Default: false
Example: true

modules.services.infrastructure.tailscale.name Link copied!

Type: string

This option has no description.

Default: "Tailscale"

modules.services.infrastructure.technitium.enable Link copied!

Type: boolean

Whether to enable Enable technitium.

Default: false
Example: true

modules.services.media.immich.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.media.immich.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Immich.

Default: false
Example: true

modules.services.media.immich.enable Link copied!

Type: boolean

Whether to enable Immich.

Default: false
Example: true

modules.services.media.immich.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Immich in the Glance dashboard.

Default: false
Example: true

modules.services.media.immich.glance.icon Link copied!

Type: string

The icon for Immich to be displayed in the Glance dashboard.

Default: "sh:immich"

modules.services.media.immich.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Immich at media.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.media.immich.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Immich"

modules.services.media.immich.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Immich goes down.

Default: false
Example: true

modules.services.media.immich.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Immich is hosted at.

Default: 8800

modules.services.media.immich.subdomain Link copied!

Type: string

The domain at which Immich is hosted at.

Default: "media"

modules.services.media.jellyfin.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.media.jellyfin.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Jellyfin.

Default: false
Example: true

modules.services.media.jellyfin.enable Link copied!

Type: boolean

Whether to enable Jellyfin.

Default: false
Example: true

modules.services.media.jellyfin.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Jellyfin in the Glance dashboard.

Default: false
Example: true

modules.services.media.jellyfin.glance.icon Link copied!

Type: string

The icon for Jellyfin to be displayed in the Glance dashboard.

Default: "sh:jellyfin"

modules.services.media.jellyfin.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Jellyfin at jf.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.media.jellyfin.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Jellyfin"

modules.services.media.jellyfin.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Jellyfin goes down.

Default: false
Example: true

modules.services.media.jellyfin.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Jellyfin is hosted at.

Default: 8800

modules.services.media.jellyfin.subdomain Link copied!

Type: string

The domain at which Jellyfin is hosted at.

Default: "jf"

modules.services.media.kavita.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.media.kavita.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Kavita.

Default: false
Example: true

modules.services.media.kavita.enable Link copied!

Type: boolean

Whether to enable Kavita.

Default: false
Example: true

modules.services.media.kavita.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Kavita in the Glance dashboard.

Default: false
Example: true

modules.services.media.kavita.glance.icon Link copied!

Type: string

The icon for Kavita to be displayed in the Glance dashboard.

Default: "sh:kavita"

modules.services.media.kavita.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Kavita at read.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.media.kavita.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Kavita"

modules.services.media.kavita.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Kavita goes down.

Default: false
Example: true

modules.services.media.kavita.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Kavita is hosted at.

Default: 8800

modules.services.media.kavita.subdomain Link copied!

Type: string

The domain at which Kavita is hosted at.

Default: "read"

modules.services.media.linkwarden.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.media.linkwarden.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Linkwarden.

Default: false
Example: true

modules.services.media.linkwarden.enable Link copied!

Type: boolean

Whether to enable Linkwarden.

Default: false
Example: true

modules.services.media.linkwarden.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Linkwarden in the Glance dashboard.

Default: false
Example: true

modules.services.media.linkwarden.glance.icon Link copied!

Type: string

The icon for Linkwarden to be displayed in the Glance dashboard.

Default: "sh:linkwarden"

modules.services.media.linkwarden.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Linkwarden at links.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.media.linkwarden.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Linkwarden"

modules.services.media.linkwarden.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Linkwarden goes down.

Default: false
Example: true

modules.services.media.linkwarden.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Linkwarden is hosted at.

Default: 8800

modules.services.media.linkwarden.subdomain Link copied!

Type: string

The domain at which Linkwarden is hosted at.

Default: "links"

modules.services.media.nixflix.enable Link copied!

Type: boolean

Whether to enable Enable nixflix.

Default: false
Example: true

modules.services.media.nixflix.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port 'range' to use. Services in nixflix will use a port starting from here and adding +1

Default: 4520

modules.services.misc.matrix-synapse.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.misc.matrix-synapse.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Matrix Synapse.

Default: false
Example: true

modules.services.misc.matrix-synapse.enable Link copied!

Type: boolean

Whether to enable Matrix Synapse.

Default: false
Example: true

modules.services.misc.matrix-synapse.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Matrix Synapse in the Glance dashboard.

Default: false
Example: true

modules.services.misc.matrix-synapse.glance.icon Link copied!

Type: string

The icon for Matrix Synapse to be displayed in the Glance dashboard.

Default: "auto-invert sh:matrix"

modules.services.misc.matrix-synapse.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Matrix Synapse at matrix.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.misc.matrix-synapse.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Matrix Synapse"

modules.services.misc.matrix-synapse.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Matrix Synapse goes down.

Default: false
Example: true

modules.services.misc.matrix-synapse.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Matrix Synapse is hosted at.

Default: 8800

modules.services.misc.matrix-synapse.serverName Link copied!

Type: string

Matrix server name (used in MXIDs)

Default: "orangc.net"

modules.services.misc.matrix-synapse.subdomain Link copied!

Type: string

The domain at which Matrix Synapse is hosted at.

Default: "matrix"

modules.services.misc.miniflux.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.misc.miniflux.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Miniflux.

Default: false
Example: true

modules.services.misc.miniflux.enable Link copied!

Type: boolean

Whether to enable Miniflux.

Default: false
Example: true

modules.services.misc.miniflux.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Miniflux in the Glance dashboard.

Default: false
Example: true

modules.services.misc.miniflux.glance.icon Link copied!

Type: string

The icon for Miniflux to be displayed in the Glance dashboard.

Default: "auto-invert sh:miniflux"

modules.services.misc.miniflux.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Miniflux at feed.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.misc.miniflux.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Miniflux"

modules.services.misc.miniflux.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Miniflux goes down.

Default: false
Example: true

modules.services.misc.miniflux.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Miniflux is hosted at.

Default: 8800

modules.services.misc.miniflux.subdomain Link copied!

Type: string

The domain at which Miniflux is hosted at.

Default: "feed"

modules.services.misc.moodle.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.misc.moodle.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Moodle.

Default: false
Example: true

modules.services.misc.moodle.enable Link copied!

Type: boolean

Whether to enable Moodle.

Default: false
Example: true

modules.services.misc.moodle.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Moodle in the Glance dashboard.

Default: false
Example: true

modules.services.misc.moodle.glance.icon Link copied!

Type: string

The icon for Moodle to be displayed in the Glance dashboard.

Default: "sh:moodle"

modules.services.misc.moodle.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Moodle at Moodle.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.misc.moodle.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Moodle"

modules.services.misc.moodle.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Moodle goes down.

Default: false
Example: true

modules.services.misc.moodle.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Moodle is hosted at.

Default: 8800

modules.services.misc.moodle.subdomain Link copied!

Type: string

The domain at which Moodle is hosted at.

Default: "moodle"

modules.services.misc.takina.enable Link copied!

Type: boolean

Whether to enable Takina Discord bot.

Default: false
Example: true

modules.services.misc.vaultwarden.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.misc.vaultwarden.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Vaultwarden.

Default: false
Example: true

modules.services.misc.vaultwarden.enable Link copied!

Type: boolean

Whether to enable Vaultwarden.

Default: false
Example: true

modules.services.misc.vaultwarden.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Vaultwarden in the Glance dashboard.

Default: false
Example: true

modules.services.misc.vaultwarden.glance.icon Link copied!

Type: string

The icon for Vaultwarden to be displayed in the Glance dashboard.

Default: "auto-invert sh:vaultwarden"

modules.services.misc.vaultwarden.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Vaultwarden at vault.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.misc.vaultwarden.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Vaultwarden"

modules.services.misc.vaultwarden.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Vaultwarden goes down.

Default: false
Example: true

modules.services.misc.vaultwarden.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Vaultwarden is hosted at.

Default: 8800

modules.services.misc.vaultwarden.subdomain Link copied!

Type: string

The domain at which Vaultwarden is hosted at.

Default: "vault"

modules.services.monitoring.changedetection.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.changedetection.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for ChangeDetection.

Default: false
Example: true

modules.services.monitoring.changedetection.enable Link copied!

Type: boolean

Whether to enable ChangeDetection.

Default: false
Example: true

modules.services.monitoring.changedetection.glance.enable Link copied!

Type: boolean

Whether to enable visibility for ChangeDetection in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.changedetection.glance.icon Link copied!

Type: string

The icon for ChangeDetection to be displayed in the Glance dashboard.

Default: "sh:changedetection"

modules.services.monitoring.changedetection.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for ChangeDetection at detect.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.changedetection.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "ChangeDetection"

modules.services.monitoring.changedetection.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this ChangeDetection goes down.

Default: false
Example: true

modules.services.monitoring.changedetection.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which ChangeDetection is hosted at.

Default: 8800

modules.services.monitoring.changedetection.subdomain Link copied!

Type: string

The domain at which ChangeDetection is hosted at.

Default: "detect"

modules.services.monitoring.glance.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.glance.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Glance.

Default: false
Example: true

modules.services.monitoring.glance.enable Link copied!

Type: boolean

Whether to enable Glance.

Default: false
Example: true

modules.services.monitoring.glance.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Glance in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.glance.glance.icon Link copied!

Type: string

The icon for Glance to be displayed in the Glance dashboard.

Default: "sh:glance"

modules.services.monitoring.glance.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Glance at Glance.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.glance.monitoredSites Link copied!

Type: list of (attribute set)

Collect services definitions from different modules

Default: [ ]

modules.services.monitoring.glance.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Glance"

modules.services.monitoring.glance.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Glance goes down.

Default: false
Example: true

modules.services.monitoring.glance.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Glance is hosted at.

Default: 8800

modules.services.monitoring.glance.subdomain Link copied!

Type: string

The domain at which Glance is hosted at.

Default: "glance"

modules.services.monitoring.grafana.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.grafana.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Grafana.

Default: false
Example: true

modules.services.monitoring.grafana.enable Link copied!

Type: boolean

Whether to enable Grafana.

Default: false
Example: true

modules.services.monitoring.grafana.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Grafana in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.grafana.glance.icon Link copied!

Type: string

The icon for Grafana to be displayed in the Glance dashboard.

Default: "sh:grafana"

modules.services.monitoring.grafana.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Grafana at Grafana.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.grafana.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Grafana"

modules.services.monitoring.grafana.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Grafana goes down.

Default: false
Example: true

modules.services.monitoring.grafana.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Grafana is hosted at.

Default: 8800

modules.services.monitoring.grafana.subdomain Link copied!

Type: string

The domain at which Grafana is hosted at.

Default: "grafana"

modules.services.monitoring.ntfy.acl Link copied!

Type: list of string

Access control rules for individual topics.

Default: [ ]
Example:
[
  "user:topic:perm"
  "orangc:food:write"
  "reimu:touhou:read"
  "cirno:frogs:read-write"
]

modules.services.monitoring.ntfy.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.ntfy.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Ntfy.

Default: false
Example: true

modules.services.monitoring.ntfy.enable Link copied!

Type: boolean

Whether to enable Ntfy.

Default: false
Example: true

modules.services.monitoring.ntfy.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Ntfy in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.ntfy.glance.icon Link copied!

Type: string

The icon for Ntfy to be displayed in the Glance dashboard.

Default: "sh:ntfy"

modules.services.monitoring.ntfy.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Ntfy at Ntfy.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.ntfy.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Ntfy"

modules.services.monitoring.ntfy.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Ntfy goes down.

Default: false
Example: true

modules.services.monitoring.ntfy.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Ntfy is hosted at.

Default: 8800

modules.services.monitoring.ntfy.scripts.services.enable Link copied!

Type: boolean

Whether to enable Enable services script for Ntfy.

Default: false
Example: true

modules.services.monitoring.ntfy.subdomain Link copied!

Type: string

The domain at which Ntfy is hosted at.

Default: "ntfy"

modules.services.monitoring.scrutiny.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.scrutiny.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Scrutiny.

Default: false
Example: true

modules.services.monitoring.scrutiny.enable Link copied!

Type: boolean

Whether to enable Scrutiny.

Default: false
Example: true

modules.services.monitoring.scrutiny.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Scrutiny in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.scrutiny.glance.icon Link copied!

Type: string

The icon for Scrutiny to be displayed in the Glance dashboard.

Default: "auto-invert sh:scrutiny"

modules.services.monitoring.scrutiny.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Scrutiny at Scrutiny.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.scrutiny.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Scrutiny"

modules.services.monitoring.scrutiny.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Scrutiny goes down.

Default: false
Example: true

modules.services.monitoring.scrutiny.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Scrutiny is hosted at.

Default: 8800

modules.services.monitoring.scrutiny.subdomain Link copied!

Type: string

The domain at which Scrutiny is hosted at.

Default: "scrutiny"

modules.services.monitoring.speedtest.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.speedtest.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Speedtest Tracker.

Default: false
Example: true

modules.services.monitoring.speedtest.enable Link copied!

Type: boolean

Whether to enable Speedtest Tracker.

Default: false
Example: true

modules.services.monitoring.speedtest.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Speedtest Tracker in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.speedtest.glance.icon Link copied!

Type: string

The icon for Speedtest Tracker to be displayed in the Glance dashboard.

Default: "sh:speedtest-tracker"

modules.services.monitoring.speedtest.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Speedtest Tracker at speedtest.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.speedtest.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Speedtest Tracker"

modules.services.monitoring.speedtest.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Speedtest Tracker goes down.

Default: false
Example: true

modules.services.monitoring.speedtest.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Speedtest Tracker is hosted at.

Default: 8800

modules.services.monitoring.speedtest.subdomain Link copied!

Type: string

The domain at which Speedtest Tracker is hosted at.

Default: "speedtest"

modules.services.monitoring.umami.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.umami.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Umami.

Default: false
Example: true

modules.services.monitoring.umami.enable Link copied!

Type: boolean

Whether to enable Umami.

Default: false
Example: true

modules.services.monitoring.umami.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Umami in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.umami.glance.icon Link copied!

Type: string

The icon for Umami to be displayed in the Glance dashboard.

Default: "auto-invert sh:umami"

modules.services.monitoring.umami.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Umami at Umami.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.umami.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Umami"

modules.services.monitoring.umami.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Umami goes down.

Default: false
Example: true

modules.services.monitoring.umami.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Umami is hosted at.

Default: 8800

modules.services.monitoring.umami.subdomain Link copied!

Type: string

The domain at which Umami is hosted at.

Default: "umami"

modules.services.monitoring.wakapi.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.monitoring.wakapi.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for WakAPI.

Default: false
Example: true

modules.services.monitoring.wakapi.enable Link copied!

Type: boolean

Whether to enable WakAPI.

Default: false
Example: true

modules.services.monitoring.wakapi.glance.enable Link copied!

Type: boolean

Whether to enable visibility for WakAPI in the Glance dashboard.

Default: false
Example: true

modules.services.monitoring.wakapi.glance.icon Link copied!

Type: string

The icon for WakAPI to be displayed in the Glance dashboard.

Default: "sh:wakapi"

modules.services.monitoring.wakapi.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for WakAPI at waka.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.monitoring.wakapi.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "WakAPI"

modules.services.monitoring.wakapi.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this WakAPI goes down.

Default: false
Example: true

modules.services.monitoring.wakapi.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which WakAPI is hosted at.

Default: 8800

modules.services.monitoring.wakapi.subdomain Link copied!

Type: string

The domain at which WakAPI is hosted at.

Default: "waka"

modules.services.productivity.davis.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.productivity.davis.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Davis.

Default: false
Example: true

modules.services.productivity.davis.enable Link copied!

Type: boolean

Whether to enable Davis.

Default: false
Example: true

modules.services.productivity.davis.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Davis in the Glance dashboard.

Default: false
Example: true

modules.services.productivity.davis.glance.icon Link copied!

Type: string

The icon for Davis to be displayed in the Glance dashboard.

Default: "di:davis"

modules.services.productivity.davis.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Davis at cal.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.productivity.davis.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Davis"

modules.services.productivity.davis.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Davis goes down.

Default: false
Example: true

modules.services.productivity.davis.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Davis is hosted at.

Default: 8800

modules.services.productivity.davis.subdomain Link copied!

Type: string

The domain at which Davis is hosted at.

Default: "cal"

modules.services.productivity.forgejo.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.productivity.forgejo.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Forgejo.

Default: false
Example: true

modules.services.productivity.forgejo.enable Link copied!

Type: boolean

Whether to enable Forgejo.

Default: false
Example: true

modules.services.productivity.forgejo.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Forgejo in the Glance dashboard.

Default: false
Example: true

modules.services.productivity.forgejo.glance.icon Link copied!

Type: string

The icon for Forgejo to be displayed in the Glance dashboard.

Default: "sh:forgejo"

modules.services.productivity.forgejo.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Forgejo at git.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.productivity.forgejo.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Forgejo"

modules.services.productivity.forgejo.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Forgejo goes down.

Default: false
Example: true

modules.services.productivity.forgejo.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Forgejo is hosted at.

Default: 8800

modules.services.productivity.forgejo.renovate.enable Link copied!

Type: boolean

Whether to enable Renovate bot.

Default: false
Example: true

modules.services.productivity.forgejo.subdomain Link copied!

Type: string

The domain at which Forgejo is hosted at.

Default: "git"

modules.services.productivity.ollama.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.productivity.ollama.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Ollama.

Default: false
Example: true

modules.services.productivity.ollama.enable Link copied!

Type: boolean

Whether to enable Ollama.

Default: false
Example: true

modules.services.productivity.ollama.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Ollama in the Glance dashboard.

Default: false
Example: true

modules.services.productivity.ollama.glance.icon Link copied!

Type: string

The icon for Ollama to be displayed in the Glance dashboard.

Default: "sh:ollama"

modules.services.productivity.ollama.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Ollama at ai.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.productivity.ollama.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Ollama"

modules.services.productivity.ollama.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Ollama goes down.

Default: false
Example: true

modules.services.productivity.ollama.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Ollama is hosted at.

Default: 8800

modules.services.productivity.ollama.subdomain Link copied!

Type: string

The domain at which Ollama is hosted at.

Default: "ai"

modules.services.productivity.vikunja.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.productivity.vikunja.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Vikunja.

Default: false
Example: true

modules.services.productivity.vikunja.enable Link copied!

Type: boolean

Whether to enable Vikunja.

Default: false
Example: true

modules.services.productivity.vikunja.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Vikunja in the Glance dashboard.

Default: false
Example: true

modules.services.productivity.vikunja.glance.icon Link copied!

Type: string

The icon for Vikunja to be displayed in the Glance dashboard.

Default: "sh:vikunja"

modules.services.productivity.vikunja.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Vikunja at tasks.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.productivity.vikunja.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Vikunja"

modules.services.productivity.vikunja.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Vikunja goes down.

Default: false
Example: true

modules.services.productivity.vikunja.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Vikunja is hosted at.

Default: 8800

modules.services.productivity.vikunja.subdomain Link copied!

Type: string

The domain at which Vikunja is hosted at.

Default: "tasks"

modules.services.productivity.vscode.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.productivity.vscode.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for VSCode Server.

Default: false
Example: true

modules.services.productivity.vscode.enable Link copied!

Type: boolean

Whether to enable VSCode Server.

Default: false
Example: true

modules.services.productivity.vscode.glance.enable Link copied!

Type: boolean

Whether to enable visibility for VSCode Server in the Glance dashboard.

Default: false
Example: true

modules.services.productivity.vscode.glance.icon Link copied!

Type: string

The icon for VSCode Server to be displayed in the Glance dashboard.

Default: "si:vscodium"

modules.services.productivity.vscode.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for VSCode Server at code.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.productivity.vscode.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "VSCode Server"

modules.services.productivity.vscode.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this VSCode Server goes down.

Default: false
Example: true

modules.services.productivity.vscode.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which VSCode Server is hosted at.

Default: 8800

modules.services.productivity.vscode.subdomain Link copied!

Type: string

The domain at which VSCode Server is hosted at.

Default: "code"

modules.services.tools.convertx.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.tools.convertx.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for ConvertX.

Default: false
Example: true

modules.services.tools.convertx.enable Link copied!

Type: boolean

Whether to enable ConvertX.

Default: false
Example: true

modules.services.tools.convertx.glance.enable Link copied!

Type: boolean

Whether to enable visibility for ConvertX in the Glance dashboard.

Default: false
Example: true

modules.services.tools.convertx.glance.icon Link copied!

Type: string

The icon for ConvertX to be displayed in the Glance dashboard.

Default: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/convertx.png"

modules.services.tools.convertx.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for ConvertX at convert.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.tools.convertx.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "ConvertX"

modules.services.tools.convertx.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this ConvertX goes down.

Default: false
Example: true

modules.services.tools.convertx.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which ConvertX is hosted at.

Default: 8800

modules.services.tools.convertx.subdomain Link copied!

Type: string

The domain at which ConvertX is hosted at.

Default: "convert"

modules.services.tools.it-tools.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.tools.it-tools.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for IT-Tools.

Default: false
Example: true

modules.services.tools.it-tools.enable Link copied!

Type: boolean

Whether to enable IT-Tools.

Default: false
Example: true

modules.services.tools.it-tools.glance.enable Link copied!

Type: boolean

Whether to enable visibility for IT-Tools in the Glance dashboard.

Default: false
Example: true

modules.services.tools.it-tools.glance.icon Link copied!

Type: string

The icon for IT-Tools to be displayed in the Glance dashboard.

Default: "sh:it-tools"

modules.services.tools.it-tools.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for IT-Tools at tools.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.tools.it-tools.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "IT-Tools"

modules.services.tools.it-tools.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this IT-Tools goes down.

Default: false
Example: true

modules.services.tools.it-tools.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which IT-Tools is hosted at.

Default: 8800

modules.services.tools.it-tools.subdomain Link copied!

Type: string

The domain at which IT-Tools is hosted at.

Default: "tools"

modules.services.tools.libretranslate.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.tools.libretranslate.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for LibreTranslate.

Default: false
Example: true

modules.services.tools.libretranslate.enable Link copied!

Type: boolean

Whether to enable LibreTranslate.

Default: false
Example: true

modules.services.tools.libretranslate.glance.enable Link copied!

Type: boolean

Whether to enable visibility for LibreTranslate in the Glance dashboard.

Default: false
Example: true

modules.services.tools.libretranslate.glance.icon Link copied!

Type: string

The icon for LibreTranslate to be displayed in the Glance dashboard.

Default: "sh:libretranslate"

modules.services.tools.libretranslate.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for LibreTranslate at translate.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.tools.libretranslate.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "LibreTranslate"

modules.services.tools.libretranslate.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this LibreTranslate goes down.

Default: false
Example: true

modules.services.tools.libretranslate.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which LibreTranslate is hosted at.

Default: 8800

modules.services.tools.libretranslate.subdomain Link copied!

Type: string

The domain at which LibreTranslate is hosted at.

Default: "translate"

modules.services.tools.searxng.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: true

modules.services.tools.searxng.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for SearXNG.

Default: false
Example: true

modules.services.tools.searxng.enable Link copied!

Type: boolean

Whether to enable SearXNG.

Default: false
Example: true

modules.services.tools.searxng.glance.enable Link copied!

Type: boolean

Whether to enable visibility for SearXNG in the Glance dashboard.

Default: false
Example: true

modules.services.tools.searxng.glance.icon Link copied!

Type: string

The icon for SearXNG to be displayed in the Glance dashboard.

Default: "sh:searxng"

modules.services.tools.searxng.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for SearXNG at search.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.tools.searxng.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "SearXNG"

modules.services.tools.searxng.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this SearXNG goes down.

Default: false
Example: true

modules.services.tools.searxng.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which SearXNG is hosted at.

Default: 8800

modules.services.tools.searxng.subdomain Link copied!

Type: string

The domain at which SearXNG is hosted at.

Default: "search"

modules.services.webpages.main.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: false

modules.services.webpages.main.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Webpagc.

Default: false
Example: true

modules.services.webpages.main.enable Link copied!

Type: boolean

Whether to enable Webpagc.

Default: false
Example: true

modules.services.webpages.main.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Webpagc in the Glance dashboard.

Default: false
Example: true

modules.services.webpages.main.glance.icon Link copied!

Type: string

The icon for Webpagc to be displayed in the Glance dashboard.

Default: "https://orangc.net/leaf.png"

modules.services.webpages.main.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Webpagc at .cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.webpages.main.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Webpagc"

modules.services.webpages.main.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Webpagc goes down.

Default: false
Example: true

modules.services.webpages.main.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Webpagc is hosted at.

Default: 8800

modules.services.webpages.main.redirects Link copied!

Type: list of (submodule)

This option has no description.

Default: [ ]

modules.services.webpages.main.redirects.*.code Link copied!

Type: signed integer

This option has no description.

Default: 301

modules.services.webpages.main.subdomain Link copied!

Type: string

The domain at which Webpagc is hosted at.

Default: ""

modules.services.webpages.ndg.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: false

modules.services.webpages.ndg.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Flake Documentation.

Default: false
Example: true

modules.services.webpages.ndg.enable Link copied!

Type: boolean

Whether to enable Flake Documentation.

Default: false
Example: true

modules.services.webpages.ndg.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Flake Documentation in the Glance dashboard.

Default: false
Example: true

modules.services.webpages.ndg.glance.icon Link copied!

Type: string

The icon for Flake Documentation to be displayed in the Glance dashboard.

Default: "sh:nixos"

modules.services.webpages.ndg.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Flake Documentation at flake.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.webpages.ndg.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Flake Documentation"

modules.services.webpages.ndg.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Flake Documentation goes down.

Default: false
Example: true

modules.services.webpages.ndg.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Flake Documentation is hosted at.

Default: 8800

modules.services.webpages.ndg.subdomain Link copied!

Type: string

The domain at which Flake Documentation is hosted at.

Default: "flake"

modules.services.webpages.notes.autoConfiguredServiceInfra Link copied!

Type: boolean

Whether Caddy, Tailscale, Cloudflared, and other infrastructure are able to automatically configure this service

Default: false

modules.services.webpages.notes.cloudflared.enable Link copied!

Type: boolean

Whether to enable Cloudflare Tunnelling for Blog.

Default: false
Example: true

modules.services.webpages.notes.enable Link copied!

Type: boolean

Whether to enable Blog.

Default: false
Example: true

modules.services.webpages.notes.glance.enable Link copied!

Type: boolean

Whether to enable visibility for Blog in the Glance dashboard.

Default: false
Example: true

modules.services.webpages.notes.glance.icon Link copied!

Type: string

The icon for Blog to be displayed in the Glance dashboard.

Default: "https://notes.orangc.net/leaf.png"

modules.services.webpages.notes.internalTailscaleDomain.enable Link copied!

Type: boolean

Whether to enable an internal tailnet domain for Blog at notes.cormorant-emperor.ts.net.

Default: false
Example: true

modules.services.webpages.notes.name Link copied!

Type: string

Set the name of the service with correct capitalisation if necessary for other modules such as modules.glance to access.

Default: "Blog"

modules.services.webpages.notes.ntfyChecking.enable Link copied!

Type: boolean

Whether to enable Ntfy sending notifications when this Blog goes down.

Default: false
Example: true

modules.services.webpages.notes.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port at which Blog is hosted at.

Default: 8800

modules.services.webpages.notes.subdomain Link copied!

Type: string

The domain at which Blog is hosted at.

Default: "notes"

networking.mihoyo-telemetry.block Link copied!

Type: boolean

Whether to block miHoYo telemetry servers.

Default: false

networking.stevenBlackHosts.blockFakenews Link copied!

Type: boolean

Whether to enable fakenews hosts entries.

Default: false
Example: true

networking.stevenBlackHosts.blockGambling Link copied!

Type: boolean

Whether to enable gambling hosts entries.

Default: false
Example: true

networking.stevenBlackHosts.blockPorn Link copied!

Type: boolean

Whether to enable porn hosts entries.

Default: false
Example: true

networking.stevenBlackHosts.blockSocial Link copied!

Type: boolean

Whether to enable social hosts entries.

Default: false
Example: true

networking.stevenBlackHosts.enable Link copied!

Type: boolean

Whether to enable Steven Black's hosts file.

Default: false
Example: true

networking.stevenBlackHosts.enableIPv6 Link copied!

Type: boolean

Whether to enable IPv6 rules.

Default: config.networking.enableIPv6
Example: true

nixflix.caddy.addHostsEntries Link copied!

Type: boolean

Whether to add networking.hosts entries mapping service subdomains to 127.0.0.1.

Enable if you don't have a separate DNS setup.

Default: false

nixflix.caddy.domain Link copied!

Type: string

Base domain for subdomain-based reverse proxy routing. Each service is accessible at <subdomain>.<domain>.

Default: "nixflix"
Example: "internal"

nixflix.caddy.enable Link copied!

Type: boolean

Whether to enable Caddy reverse proxy for all services.

Default: false

nixflix.caddy.tls.acmeEmail Link copied!

Type: null or string

Email for ACME certificate registration. Required when using a public ACME provider.

Default: null

nixflix.caddy.tls.enable Link copied!

Type: boolean

Whether to enable TLS. Caddy handles ACME automatically when enabled with a public domain.

Default: false

nixflix.caddy.tls.internal Link copied!

Type: boolean

Use Caddy's internal (self-signed) CA instead of a public ACME provider. Useful for local/internal domains.

Default: false

nixflix.downloadarr Link copied!

Type: submodule

Downloadarr is a service that is responsible for configuring Starr services with download clients. When you enable the service for that client to run, Downloadarr integrates it automatically with each Starr service.

The list is small right now. However, Downloadarr itself supports supports more integrations than Nixflix supports. It just has less magic built in.

Each module is currently only a subset of the options available. You can add more options reqresented in the UI if you know their keys.

Default: { }

nixflix.downloadarr.deluge Link copied!

Type: open submodule of attribute set of anything

Deluge download client definition for Starr services.

Default: { }

nixflix.downloadarr.deluge.categories Link copied!

Type: submodule

Categories per Starr service instance

Default: { }

nixflix.downloadarr.deluge.categories.lidarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "lidarr"

nixflix.downloadarr.deluge.categories.prowlarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "prowlarr"

nixflix.downloadarr.deluge.categories.radarr Link copied!

Type: string

The categories to use for the Radarr instance

Default: "radarr"

nixflix.downloadarr.deluge.categories.sonarr Link copied!

Type: string

The categories to use for the Sonarr instance

Default: "sonarr"

nixflix.downloadarr.deluge.categories.sonarr-anime Link copied!

Type: string

The categories to use for the Sonarr Anime instance

Default: "sonarr-anime"

nixflix.downloadarr.deluge.dependencies Link copied!

Type: list of string

systemd services that this integration depends on

Default: [ ]

nixflix.downloadarr.deluge.enable Link copied!

Type: boolean

Whether or not this download client is enabled.

Default: false

nixflix.downloadarr.deluge.host Link copied!

Type: string

Host of the download client.

Default: "127.0.0.1"
Example: "example.com"

nixflix.downloadarr.deluge.implementationName Link copied!

Type: string

Type of download client to configure (matches schema implementationName).

Default: "Deluge"

nixflix.downloadarr.deluge.name Link copied!

Type: string

User-defined name for the download client instance.

Default: "Deluge"

nixflix.downloadarr.deluge.password Link copied!

Type: string or (submodule)

Password for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.deluge.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port of the download client.

Default: 8112

nixflix.downloadarr.deluge.urlBase Link copied!

Type: string

Adds a prefix to the deluge json url, see http://[host]:[port]/[urlBase]/json

Default: ""
Example: "deluge"

nixflix.downloadarr.enable Link copied!

Type: boolean

Whether to enable Downloadarr.

Default: true

nixflix.downloadarr.extraClients Link copied!

Type: list of attribute set of anything

For more clients or if you have more than one instance of a specific client. Follows the same schema general schema as the other options. implementationName is a required field.

A list of implementation names can be acquired with:

curl -s -H "X-Api-Key: $(sudo cat </path/to/prowlarr/api_key>)" "http://127.0.0.1:9696/api/v1/downloadclient/schema" | jq '.[].implementationName'

You can run the following command to get the field names for a particular implementationName:

curl -s -H "X-Api-Key: $(sudo cat </path/to/prowlarr/apiKey>)" "http://127.0.0.1:9696/api/v1/downloadclient/schema" | jq '.[] | select(.implementationName=="<clientName>") | .fields'
Default: [ ]

nixflix.downloadarr.qbittorrent Link copied!

Type: open submodule of attribute set of anything

qBittorrent download client definition for Starr services.

Default: { }

nixflix.downloadarr.qbittorrent.categories Link copied!

Type: submodule

Categories per Starr service instance

Default: { }

nixflix.downloadarr.qbittorrent.categories.lidarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "lidarr"

nixflix.downloadarr.qbittorrent.categories.prowlarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "prowlarr"

nixflix.downloadarr.qbittorrent.categories.radarr Link copied!

Type: string

The categories to use for the Radarr instance

Default: "radarr"

nixflix.downloadarr.qbittorrent.categories.sonarr Link copied!

Type: string

The categories to use for the Sonarr instance

Default: "sonarr"

nixflix.downloadarr.qbittorrent.categories.sonarr-anime Link copied!

Type: string

The categories to use for the Sonarr Anime instance

Default: "sonarr-anime"

nixflix.downloadarr.qbittorrent.dependencies Link copied!

Type: list of string

systemd services that this integration depends on

Default: [ "qbittorrent.service" ]

nixflix.downloadarr.qbittorrent.enable Link copied!

Type: boolean

Whether or not this download client is enabled.

Default: config.nixflix.torrentClients.qbittorrent.enable

nixflix.downloadarr.qbittorrent.host Link copied!

Type: string

Host of the download client.

Default: config.nixflix.torrentClients.qbittorrent.connectionAddress
Example: "example.com"

nixflix.downloadarr.qbittorrent.implementationName Link copied!

Type: string

Type of download client to configure (matches schema implementationName).

Default: "qBittorrent"

nixflix.downloadarr.qbittorrent.name Link copied!

Type: string

User-defined name for the download client instance.

Default: "qBittorrent"

nixflix.downloadarr.qbittorrent.password Link copied!

Type: null or string or (submodule)

Password for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: config.nixflix.torrentClients.qbittorrent.password
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.qbittorrent.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port of the download client.

Default: config.services.qbittorrent.webuiPort
Example: 8080

nixflix.downloadarr.qbittorrent.urlBase Link copied!

Type: string

Adds a prefix to the qBittorrent url, such as http://[host]:[port]/[urlBase].

Default: ""
Example: "qbittorrent"

nixflix.downloadarr.qbittorrent.username Link copied!

Type: null or string or (submodule)

Username key for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: config.services.qbittorrent.serverConfig.Preferences.WebUI.Username
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.rtorrent Link copied!

Type: open submodule of attribute set of anything

rTorrent download client definition for Starr services.

Default: { }

nixflix.downloadarr.rtorrent.categories Link copied!

Type: submodule

Categories per Starr service instance

Default: { }

nixflix.downloadarr.rtorrent.categories.lidarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "lidarr"

nixflix.downloadarr.rtorrent.categories.prowlarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "prowlarr"

nixflix.downloadarr.rtorrent.categories.radarr Link copied!

Type: string

The categories to use for the Radarr instance

Default: "radarr"

nixflix.downloadarr.rtorrent.categories.sonarr Link copied!

Type: string

The categories to use for the Sonarr instance

Default: "sonarr"

nixflix.downloadarr.rtorrent.categories.sonarr-anime Link copied!

Type: string

The categories to use for the Sonarr Anime instance

Default: "sonarr-anime"

nixflix.downloadarr.rtorrent.dependencies Link copied!

Type: list of string

systemd services that this integration depends on

Default: [ ]

nixflix.downloadarr.rtorrent.enable Link copied!

Type: boolean

Whether or not this download client is enabled.

Default: false

nixflix.downloadarr.rtorrent.host Link copied!

Type: string

Host of the download client.

Default: "127.0.0.1"
Example: "example.com"

nixflix.downloadarr.rtorrent.implementationName Link copied!

Type: string

Type of download client to configure (matches schema implementationName).

Default: "rTorrent"

nixflix.downloadarr.rtorrent.name Link copied!

Type: string

User-defined name for the download client instance.

Default: "rTorrent"

nixflix.downloadarr.rtorrent.password Link copied!

Type: string or (submodule)

Password for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.rtorrent.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port of the download client. This competes with SABnzbd.

Default: 8080

nixflix.downloadarr.rtorrent.urlBase Link copied!

Type: string

Path to the XMLRPC endpoint, see http(s)://[host]:[port]/[urlPath]. This is usually RPC2 or [path to ruTorrent]/plugins/rpc/rpc.php when using ruTorrent.

Default: "RPC2"
Example: "rtorrent/RPC2"

nixflix.downloadarr.rtorrent.username Link copied!

Type: string or (submodule)

Username key for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.sabnzbd Link copied!

Type: open submodule of attribute set of anything

SABnzbd download client definition for Starr services.

Default: { }

nixflix.downloadarr.sabnzbd.apiKey Link copied!

Type: null or string or (submodule)

API key for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: config.nixflix.usenetClients.sabnzbd.settings.misc.api_key
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.sabnzbd.categories Link copied!

Type: submodule

Categories per Starr service instance

Default: { }

nixflix.downloadarr.sabnzbd.categories.lidarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "lidarr"

nixflix.downloadarr.sabnzbd.categories.prowlarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "prowlarr"

nixflix.downloadarr.sabnzbd.categories.radarr Link copied!

Type: string

The categories to use for the Radarr instance

Default: "radarr"

nixflix.downloadarr.sabnzbd.categories.sonarr Link copied!

Type: string

The categories to use for the Sonarr instance

Default: "sonarr"

nixflix.downloadarr.sabnzbd.categories.sonarr-anime Link copied!

Type: string

The categories to use for the Sonarr Anime instance

Default: "sonarr-anime"

nixflix.downloadarr.sabnzbd.dependencies Link copied!

Type: list of string

systemd services that this integration depends on

Default: [ "sabnzbd-categories.service" ]

nixflix.downloadarr.sabnzbd.enable Link copied!

Type: boolean

Whether or not this download client is enabled.

Default: config.nixflix.usenetClients.sabnzbd.enable

nixflix.downloadarr.sabnzbd.host Link copied!

Type: string

Host of the download client.

Default: config.nixflix.usenetClients.sabnzbd.connectionAddress
Example: "example.com"

nixflix.downloadarr.sabnzbd.implementationName Link copied!

Type: string

Type of download client to configure (matches schema implementationName).

Default: "SABnzbd"

nixflix.downloadarr.sabnzbd.name Link copied!

Type: string

User-defined name for the download client instance.

Default: "SABnzbd"

nixflix.downloadarr.sabnzbd.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port of the download client.

Default: config.nixflix.usenetClients.sabnzbd.settings.misc.port
Example: 8080

nixflix.downloadarr.sabnzbd.urlBase Link copied!

Type: string

Adds a prefix to the SABnzbd url, such as http://[host]:[port]/[urlBase].

Default: if config.nixflix.usenetClients.sabnzbd.settings.misc.url_base == "" then "" else lib.removePrefix "/" config.nixflix.usenetClients.sabnzbd.settings.misc.url_base;
Example: "/sabnzbd"

nixflix.downloadarr.transmission Link copied!

Type: open submodule of attribute set of anything

Transmission Deluge download client definition for Starr services.

Default: { }

nixflix.downloadarr.transmission.categories Link copied!

Type: submodule

Categories per Starr service instance

Default: { }

nixflix.downloadarr.transmission.categories.lidarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "lidarr"

nixflix.downloadarr.transmission.categories.prowlarr Link copied!

Type: string

The categories to use for the Lidarr instance

Default: "prowlarr"

nixflix.downloadarr.transmission.categories.radarr Link copied!

Type: string

The categories to use for the Radarr instance

Default: "radarr"

nixflix.downloadarr.transmission.categories.sonarr Link copied!

Type: string

The categories to use for the Sonarr instance

Default: "sonarr"

nixflix.downloadarr.transmission.categories.sonarr-anime Link copied!

Type: string

The categories to use for the Sonarr Anime instance

Default: "sonarr-anime"

nixflix.downloadarr.transmission.dependencies Link copied!

Type: list of string

systemd services that this integration depends on

Default: [ ]

nixflix.downloadarr.transmission.enable Link copied!

Type: boolean

Whether or not this download client is enabled.

Default: false

nixflix.downloadarr.transmission.host Link copied!

Type: string

Host of the download client.

Default: "127.0.0.1"
Example: "example.com"

nixflix.downloadarr.transmission.implementationName Link copied!

Type: string

Type of download client to configure (matches schema implementationName).

Default: "Transmission"

nixflix.downloadarr.transmission.name Link copied!

Type: string

User-defined name for the download client instance.

Default: "Transmission"

nixflix.downloadarr.transmission.password Link copied!

Type: string or (submodule)

Password for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadarr.transmission.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port of the download client.

Default: 9091

nixflix.downloadarr.transmission.urlBase Link copied!

Type: string

Adds a prefix to the Transmission rpc url, eg http://[host]:[port]/[urlBase]/rpc

Default: "/transmission/"

nixflix.downloadarr.transmission.username Link copied!

Type: string or (submodule)

Username key for the download client.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.downloadsDir Link copied!

Type: absolute path

The location of the downloads directory for download clients.

!!! warning

All parent directories must have execute permissions for everyone.

!!! warning

Setting this to any path, where the subpath is not owned by root, will fail! For example:

```nix
mediaDir = /home/user/data
```

Is not supported, because `/home/user` is owned by `user`.
Default: "/data/downloads"
Example: "/data/downloads"

nixflix.enable Link copied!

Type: boolean

Whether to enable Nixflix.

Default: false
Example: true

nixflix.flaresolverr.enable Link copied!

Type: boolean

Whether or not to enable FlareSolverr for Prowlarr.

Default: false
Example: true

nixflix.flaresolverr.port Link copied!

Type: signed integer or floating point number

Port for FlareSolverr to listen on.

Default: 8191

nixflix.globals Link copied!

Type: attribute set

Global values to be used by nixflix services

Default: { }

nixflix.jellyfin.apiKey Link copied!

Type: string or (submodule)

API key to inject into Jellyfin's database. Used by nixflix management services to authenticate to Jellyfin.

Can be created with the following:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.branding.customCss Link copied!

Type: strings concatenated with "\n"

Custom CSS to be injected into the web client.

Default: if config.nixflix.theme.enable then ''@import url("https://theme-park.dev/css/base/jellyfin/$${config.nixflix.theme.name}.css");'' else "";

nixflix.jellyfin.branding.loginDisclaimer Link copied!

Type: strings concatenated with "\n"

Sets the text shown during login underneath the form.

Default: ""

nixflix.jellyfin.branding.splashscreenEnabled Link copied!

Type: boolean

Enables a splashscreen to be shown during loading.

Default: false

nixflix.jellyfin.branding.splashscreenLocation Link copied!

Type: absolute path or string

Location of the splashscreen image. Custom images should be in a 16x9 aspect ratio at a minimum size of 1920x1080.

nixflix.jellyfin.cacheDir Link copied!

Type: absolute path

Directory containing the jellyfin server cache, passed with --cachedir see #cache-directory

Default: "/var/cache/jellyfin"

nixflix.jellyfin.configDir Link copied!

Type: absolute path

Directory containing the server configuration files, passed with --configdir see configuration-directory

Default: "${config.nixflix.stateDir}/jellyfin/config"

nixflix.jellyfin.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.jellyfin.dataDir Link copied!

Type: absolute path

Directory containing the Jellyfin data files

Default: "${config.nixflix.stateDir}/jellyfin"

nixflix.jellyfin.enable Link copied!

Type: boolean

Whether to enable Jellyfin media server

Default: false

nixflix.jellyfin.encoding.allowAv1Encoding Link copied!

Type: boolean

Whether AV1 encoding is enabled

Default: false

nixflix.jellyfin.encoding.allowHevcEncoding Link copied!

Type: boolean

Whether HEVC encoding is enabled

Default: false

nixflix.jellyfin.encoding.allowOnDemandMetadataBasedKeyframeExtractionForExtensions Link copied!

Type: list of string

imma be real i have no idea what this option is. Just leave it as the default

Default: [ "mkv" ]

nixflix.jellyfin.encoding.deinterlaceDoubleRate Link copied!

Type: boolean

Whether to enable This setting uses the field rate when deinterlacing, often referred to as bob deinterlacing, which doubles the frame rate of the video to provide full motion like what you would see when viewing interlaced video on a TV. .

Default: false
Example: true

nixflix.jellyfin.encoding.deinterlaceMethod Link copied!

Type: one of "yadif", "bwdif"

Select the deinterlacing method to use when software transcoding interlaced content. When hardware acceleration supporting hardware deinterlacing is enabled the hardware deinterlacer will be used instead of this setting.

Default: "yadif"

nixflix.jellyfin.encoding.downMixAudioBoost Link copied!

Type: signed integer or floating point number

Boost audio when downmixing. A value of one will preserve the original volume.

Default: 2

nixflix.jellyfin.encoding.downMixStereoAlgorithm Link copied!

Type: one of "None", "Dave750", "NightmodeDialogue", "Rfc7845", "Ac4"

Algorithm used to downmix multi-channel audio to stereo.

Default: "None"

nixflix.jellyfin.encoding.enableAudioVbr Link copied!

Type: boolean

Whether to enable Enable VBR Audio.

Default: false
Example: true

nixflix.jellyfin.encoding.enableDecodingColorDepth10Hevc Link copied!

Type: boolean

Enable hardware decoding for HEVC 10bit

Default: true

nixflix.jellyfin.encoding.enableDecodingColorDepth10HevcRext Link copied!

Type: boolean

Whether to enable Enable hardware decoding for HEVC RExt 8/10bit.

Default: false
Example: true

nixflix.jellyfin.encoding.enableDecodingColorDepth10Vp9 Link copied!

Type: boolean

Enable hardware decoding for VP9 10bit

Default: true

nixflix.jellyfin.encoding.enableDecodingColorDepth12HevcRext Link copied!

Type: boolean

Whether to enable Enable hardware decoding for HEVC RExt 12bit.

Default: false
Example: true

nixflix.jellyfin.encoding.enableEnhancedNvdecDecoder Link copied!

Type: boolean

Enable enhanced NVDEC decoder. Requires Nvidia GPU with enhanced NVDEC support.

Default: true

nixflix.jellyfin.encoding.enableFallbackFont Link copied!

Type: boolean

Whether to enable Enable fallback font.

Default: false
Example: true

nixflix.jellyfin.encoding.enableHardwareEncoding Link copied!

Type: boolean

Whether to do Hardware Acceleration

Default: true

nixflix.jellyfin.encoding.enableIntelLowPowerH264HwEncoder Link copied!

Type: boolean

Whether to enable Low-Power Encoding can keep unnecessary CPU-GPU sync. On Linux they must be disabled if the i915 HuC firmware is not configured.

https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#configure-and-verify-lp-mode-on-linux .

Default: false
Example: true

nixflix.jellyfin.encoding.enableIntelLowPowerHevcHwEncoder Link copied!

Type: boolean

Whether to enable Low-Power Encoding can keep unnecessary CPU-GPU sync. On Linux they must be disabled if the i915 HuC firmware is not configured.

https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#configure-and-verify-lp-mode-on-linux .

Default: false
Example: true

nixflix.jellyfin.encoding.enableSegmentDeletion Link copied!

Type: boolean

Whether to enable Delete old segments after they have been downloaded by the client. This prevents having to store the entire transcoded file on disk. Turn this off if you experience playback issues. .

Default: false
Example: true

nixflix.jellyfin.encoding.enableSubtitleExtraction Link copied!

Type: boolean

Embedded subtitles can be extracted from videos and delivered to clients in plain text, in order to help prevent video transcoding. On some systems this can take a long time and cause video playback to stall during the extraction process. Disable this to have embedded subtitles burned in with video transcoding when they are not natively supported by the client device.

Default: true

nixflix.jellyfin.encoding.enableThrottling Link copied!

Type: boolean

Whether to enable When a transcode or remux gets far enough ahead from the current playback position, pause the process so it will consume fewer resources. This is most useful when watching without seeking often. Turn this off if you experience playback issues. .

Default: false
Example: true

nixflix.jellyfin.encoding.enableTonemapping Link copied!

Type: boolean

Whether to enable Tone-mapping can transform the dynamic range of a video from HDR to SDR while maintaining image details and colors, which are very important information for representing the original scene. Currently works only with 10bit HDR10, HLG and DoVi videos. This requires the corresponding GPGPU runtime. .

Default: false
Example: true

nixflix.jellyfin.encoding.enableVideoToolboxTonemapping Link copied!

Type: boolean

Whether to enable Apple VideoToolbox based tone-mapping. Works only on macOS with supported hardware. .

Default: false
Example: true

nixflix.jellyfin.encoding.enableVppTonemapping Link copied!

Type: boolean

Whether to enable Full Intel driver based tone-mapping. Currently works only on certain hardware with HDR10 videos. This has a higher priority compared to another OpenCL implementation. .

Default: false
Example: true

nixflix.jellyfin.encoding.encoderAppPathDisplay Link copied!

Type: string

The path to the FFmpeg application file or folder containing FFmpeg.

Default: "$${pkgs.jellyfin-ffmpeg}/bin/ffmpeg"

nixflix.jellyfin.encoding.encoderPreset Link copied!

Type: one of "auto", "placebo", "veryslow", "slower", "slow", "medium", "fast", "faster", "veryfast", "superfast", "ultrafast"

Pick a faster value to improve performance, or a slower value to improve quality.

Default: "auto"

nixflix.jellyfin.encoding.encodingThreadCount Link copied!

Type: signed integer

Amount of threads used for encoding.

Set to -1 for automatic and 0 for max.

Default: -1

nixflix.jellyfin.encoding.fallbackFontPath Link copied!

Type: string

Path to fallback font file for subtitle burning

Default: ""

nixflix.jellyfin.encoding.h264Crf Link copied!

Type: signed integer

The 'Constant Rate Factor' (CRF) is the default quality setting for the x264 and x265 software encoders. You can set the values between 0 and 51, where lower values would result in better quality (at the expense of higher file sizes). Sane values are between 18 and 28.

Hardware encoders do not use these settings.

Default: 23

nixflix.jellyfin.encoding.h265Crf Link copied!

Type: signed integer

The 'Constant Rate Factor' (CRF) is the default quality setting for the x264 and x265 software encoders. You can set the values between 0 and 51, where lower values would result in better quality (at the expense of higher file sizes). Sane values are between 18 and 28.

Hardware encoders do not use these settings.

Default: 28

nixflix.jellyfin.encoding.hardwareAccelerationType Link copied!

Type: one of "none", "qsv", "amf", "nvenc", "vaapi", "rkmpp", "videotoolbox", "v4l2m2m"

Whether or not to use hardware acceleration for transcoding.

If you misconfigure this your streams will not work!. More info: https://jellyfin.org/docs/general/administration/hardware-acceleration/

Default: "none"

nixflix.jellyfin.encoding.hardwareDecodingCodecs Link copied!

Type: list of (one of "h264", "hevc", "mpeg2video", "vc1", "vp8", "vp9", "av1")

List of codec types to enable hardware decoding for. Should only include codecs your hardware has support for.

Consult https://jellyfin.org/docs/general/administration/hardware-acceleration/ for more info.

Default: [ "h264" "hevc" "mpeg2video" "vc1" ]

nixflix.jellyfin.encoding.maxMuxingQueueSize Link copied!

Type: signed integer

Maximum number of packets that can be buffered while waiting for all streams to initialize. Try to increase it if you still meet "Too many packets buffered for output stream" error in FFmpeg logs.

The recommended value is 2048.

Default: 2048

nixflix.jellyfin.encoding.preferSystemNativeHwDecoder Link copied!

Type: boolean

Prefer system native hardware decoder over FFmpeg implementations.

Default: true

nixflix.jellyfin.encoding.qsvDevice Link copied!

Type: string

Specify the device for Intel QSV on a multi-GPU system. On Linux, this is the render node, e.g., /dev/dri/renderD128. Leave blank unless you know what you are doing.

Default: ""

nixflix.jellyfin.encoding.segmentKeepSeconds Link copied!

Type: signed integer

Time in seconds for which segments should be kept after they are downloaded by the client. Only works if segment deletion is enabled.

Default: 720

nixflix.jellyfin.encoding.throttleDelaySeconds Link copied!

Type: signed integer

Time in seconds after which the transcoder will be throttled. Must be large enough for the client to maintain a healthy buffer. Only works if throttling is enabled.

Default: 180

nixflix.jellyfin.encoding.tonemappingAlgorithm Link copied!

Type: one of "none", "bt2390", "clip", "linear", "gamma", "reinhard", "hable", "mobius"

Tone mapping can be fine-tuned. If you are not familiar with these options, just keep the default.

Default: "bt2390"

nixflix.jellyfin.encoding.tonemappingDesat Link copied!

Type: signed integer or floating point number

Apply desaturation for highlights that exceed this level of brightness. The higher the parameter, the more color information will be preserved. This setting helps prevent unnaturally blown-out colors for super-highlights, by (smoothly) turning into white instead. This makes images feel more natural, at the cost of reducing information about out-of-range colors.

The recommended and default values are 0 and 0.5.

Default: 0

nixflix.jellyfin.encoding.tonemappingMode Link copied!

Type: one of "auto", "max", "rgb", "lum", "itp"

Select the tone mapping mode. If you experience blown out highlights try switching to the RGB mode.

Default: "auto"

nixflix.jellyfin.encoding.tonemappingParam Link copied!

Type: signed integer or floating point number

Tune the tone mapping algorithm. The recommended and default values are 0.

Recommended to leave unchanged

Default: 0

nixflix.jellyfin.encoding.tonemappingPeak Link copied!

Type: signed integer or floating point number

Override signal/nominal/reference peak with this value. Useful when the embedded peak information in display metadata is not reliable or when tone mapping from a lower range to a higher range.

The recommended and default values are 100 and 0.

Default: 100

nixflix.jellyfin.encoding.tonemappingRange Link copied!

Type: one of "auto", "tv", "pc"

Select the output color range. Auto is the same as the input range.

Default: "auto"

nixflix.jellyfin.encoding.transcodingTempPath Link copied!

Type: string

Path for temporary transcoded files when streaming

Default: "${config.nixflix.jellyfin.cacheDir}/transcodes"

nixflix.jellyfin.encoding.vaapiDevice Link copied!

Type: string

This is the render node that is used for hardware acceleration. Only used if HardwareAccelerationType is set to vaapi.

Default: "/dev/dri/renderD128"

nixflix.jellyfin.encoding.vppTonemappingBrightness Link copied!

Type: signed integer or floating point number

Apply brightness gain in VPP tone mapping.

The recommended and default values are 16 and 0.

Default: 16

nixflix.jellyfin.encoding.vppTonemappingContrast Link copied!

Type: signed integer or floating point number

Apply contrast gain in VPP tone mapping.

Both recommended and default values are 1.

Default: 1

nixflix.jellyfin.group Link copied!

Type: string

Group under which the service runs

Default: config.nixflix.globals.libraryOwner.group

nixflix.jellyfin.libraries Link copied!

Type: attribute set of (null or (submodule))

Jellyfin media libraries to manage declaratively.

By default, libraries are automatically created for enabled Arr services:

  • Shows: Created when Sonarr is enabled
  • Movies: Created when Radarr is enabled
  • Music: Created when Lidarr is enabled
  • Anime: Created when either Sonarr anime or Radarr anime is enabled

Default libraries can be removed with the following:

  • nixflix.jellyfin.libraries.Movies = lib.mkForce {};
Default: { }
Example:
{
  "Family Photos" = {
    collectionType = "homevideos";
    enablePhotos = true;
    paths = [
      "/mnt/photos"
    ];
  };
  Movies = {
    collectionType = "movies";
    enableRealtimeMonitor = true;
    metadataCountryCode = "US";
    paths = [
      "/mnt/movies"
    ];
    preferredMetadataLanguage = "en";
  };
  Shows = {
    collectionType = "tvshows";
    paths = [
      "/mnt/tv"
    ];
    seasonZeroDisplayName = "Specials";
  };
}

nixflix.jellyfin.libraries.<name>.allowEmbeddedSubtitles Link copied!

Type: one of "AllowAll", "AllowText", "AllowImage", "AllowNone"

Control which types of embedded subtitles to allow:

  • AllowAll: Allow all embedded subtitles
  • AllowText: Allow only text-based embedded subtitles
  • AllowImage: Allow only image-based embedded subtitles
  • AllowNone: Don't allow any embedded subtitles
Default: "AllowAll"

nixflix.jellyfin.libraries.<name>.automaticRefreshIntervalDays Link copied!

Type: signed integer

Days between automatic metadata refreshes (0 to disable)

Default: 0

nixflix.jellyfin.libraries.<name>.automaticallyAddToCollection Link copied!

Type: boolean

Automatically add items to collections based on metadata

Default: false

nixflix.jellyfin.libraries.<name>.collectionType Link copied!

Type: one of "movies", "tvshows", "music", "musicvideos", "homevideos", "boxsets", "books", "mixed"

The type of media library.

  • movies: Movie library
  • tvshows: TV Shows library
  • music: Music library
  • musicvideos: Music Videos library
  • homevideos: Home Videos (and Photos) library
  • boxsets: Box Sets library
  • books: Books library
  • mixed: Mixed Movies and TV Shows library
Example: "movies"

nixflix.jellyfin.libraries.<name>.customTagDelimiters Link copied!

Type: list of string

Custom delimiters for parsing tags

Default: [ ]

nixflix.jellyfin.libraries.<name>.delimiterWhitelist Link copied!

Type: list of string

Whitelist of delimiters to preserve

Default: [ ]

nixflix.jellyfin.libraries.<name>.disabledLocalMetadataReaders Link copied!

Type: list of string

List of local metadata readers to disable

Default: [ ]

nixflix.jellyfin.libraries.<name>.disabledLyricFetchers Link copied!

Type: list of string

List of lyric fetchers to disable

Default: [ ]

nixflix.jellyfin.libraries.<name>.disabledMediaSegmentProviders Link copied!

Type: list of string

List of media segment providers to disable

Default: [ ]

nixflix.jellyfin.libraries.<name>.disabledSubtitleFetchers Link copied!

Type: list of string

List of subtitle fetchers to disable

Default: [ ]

nixflix.jellyfin.libraries.<name>.enableEmbeddedEpisodeInfos Link copied!

Type: boolean

Use embedded episode information from media files

Default: true

nixflix.jellyfin.libraries.<name>.enableLUFSScan Link copied!

Type: boolean

Enable LUFS (Loudness Units Full Scale) audio normalization scanning

Default: true

nixflix.jellyfin.libraries.<name>.enablePhotos Link copied!

Type: boolean

Enable photo support in this library

Default: true

nixflix.jellyfin.libraries.<name>.enableRealtimeMonitor Link copied!

Type: boolean

Monitor the library folders for file changes in real-time

Default: true

nixflix.jellyfin.libraries.<name>.enableTrickplayImageExtraction Link copied!

Type: boolean

Extract trickplay images (thumbnails for seeking)

Default: true

nixflix.jellyfin.libraries.<name>.enabled Link copied!

Type: boolean

Whether this library is enabled

Default: true

nixflix.jellyfin.libraries.<name>.extractChapterImagesDuringLibraryScan Link copied!

Type: boolean

Extract chapter images during library scan (vs on-demand)

Default: true

nixflix.jellyfin.libraries.<name>.extractTrickplayImagesDuringLibraryScan Link copied!

Type: boolean

Extract trickplay images during library scan (vs on-demand)

Default: true

nixflix.jellyfin.libraries.<name>.localMetadataReaderOrder Link copied!

Type: list of string

Order in which to use local metadata readers

Default: [ ]

nixflix.jellyfin.libraries.<name>.lyricFetcherOrder Link copied!

Type: list of string

Order in which to use lyric fetchers

Default: [ ]

nixflix.jellyfin.libraries.<name>.mediaSegmentProviderOrder Link copied!

Type: list of string

Order in which to use media segment providers

Default: [ ]

nixflix.jellyfin.libraries.<name>.metadataCountryCode Link copied!

Type: null or string

Country code for metadata (e.g., 'US', 'GB', 'FR')

Default: null
Example: "US"

nixflix.jellyfin.libraries.<name>.metadataSavers Link copied!

Type: list of string

List of metadata savers to enable

Default: [ ]

nixflix.jellyfin.libraries.<name>.paths Link copied!

Type: list of string

List of media folder paths for this library

Default: [ ]
Example:
[
  "/mnt/movies"
  "/media/films"
]

nixflix.jellyfin.libraries.<name>.preferNonstandardArtistsTag Link copied!

Type: boolean

Prefer non-standard artist tags in music files

Default: false

nixflix.jellyfin.libraries.<name>.preferredMetadataLanguage Link copied!

Type: null or string

Preferred language for metadata (e.g., 'en', 'fr', 'de')

Default: null
Example: "en"

nixflix.jellyfin.libraries.<name>.requirePerfectSubtitleMatch Link copied!

Type: boolean

Requiring a perfect match will filter subtitles to include only those that have been tested and verified with your exact video file. Unchecking this will increase the likelihood of subtitles being downloaded, but will increase the chances of mistimed or incorrect subtitle text.

Default is false because the requirements are pretty strict and make it difficult to actually find any subtitles at all.

Default: true

nixflix.jellyfin.libraries.<name>.saveLocalMetadata Link copied!

Type: boolean

Save metadata to .nfo files alongside media

Default: true

nixflix.jellyfin.libraries.<name>.saveLyricsWithMedia Link copied!

Type: boolean

Save downloaded lyrics alongside media files

Default: false

nixflix.jellyfin.libraries.<name>.saveSubtitlesWithMedia Link copied!

Type: boolean

Save downloaded subtitles alongside media files

Default: true

nixflix.jellyfin.libraries.<name>.saveTrickplayWithMedia Link copied!

Type: boolean

Save trickplay images alongside media files

Default: false

nixflix.jellyfin.libraries.<name>.seasonZeroDisplayName Link copied!

Type: string

Display name for season 0 (specials)

Default: "Specials"

nixflix.jellyfin.libraries.<name>.skipSubtitlesIfAudioTrackMatches Link copied!

Type: boolean

Uncheck this to ensure all videos have subtitles, regardless of audio language.

Default: false

nixflix.jellyfin.libraries.<name>.skipSubtitlesIfEmbeddedSubtitlesPresent Link copied!

Type: boolean

Keeping text versions of subtitles will result in more efficient delivery and decrease the likelihood of video transcoding.

Default: true

nixflix.jellyfin.libraries.<name>.subtitleDownloadLanguages Link copied!

Type: list of string

Languages to download subtitles for

Default: [ ]
Example:
[
  "eng"
  "fra"
]

nixflix.jellyfin.libraries.<name>.subtitleFetcherOrder Link copied!

Type: list of string

Order in which to use subtitle fetchers

Default: lib.optional config.nixflix.jellyfin.plugins."Open Subtitles".enable "Open Subtitles" ++ lib.optional config.nixflix.jellyfin.plugins."subbuzz".enable "subbuzz";

nixflix.jellyfin.libraries.<name>.typeOptions Link copied!

Type: list of (submodule)

Content type-specific metadata and image fetcher configuration

Default: [ ]
Example:
[
  {
    imageFetchers = [
      "TheMovieDb"
    ];
    metadataFetchers = [
      "TheMovieDb"
      "The Open Movie Database"
    ];
    type = "Movie";
  }
]

nixflix.jellyfin.libraries.<name>.typeOptions.*.imageFetchers Link copied!

Type: list of string

List of image fetchers to enable for this type

Default: [ ]

nixflix.jellyfin.libraries.<name>.typeOptions.*.imageOptions Link copied!

Type: list of (submodule)

Image download options for this type

Default: [ ]

nixflix.jellyfin.libraries.<name>.typeOptions.*.imageOptions.*.limit Link copied!

Type: signed integer

Maximum number of images of this type (0 for unlimited)

Default: 0

nixflix.jellyfin.libraries.<name>.typeOptions.*.imageOptions.*.type Link copied!

Type: one of "Primary", "Art", "Backdrop", "Banner", "Logo", "Thumb", "Disc", "Box", "Screenshot", "Menu", "Chapter", "BoxRear", "Profile"

The image type

nixflix.jellyfin.libraries.<name>.typeOptions.*.metadataFetchers Link copied!

Type: list of string

List of metadata fetchers to enable for this type

Default: [ ]

nixflix.jellyfin.libraries.<name>.typeOptions.*.type Link copied!

Type: string

The content type (e.g., 'Movie', 'Series', 'Season', 'Episode', 'MusicAlbum', 'MusicArtist', 'Audio')

Example: "Movie"

nixflix.jellyfin.libraries.<name>.useCustomTagDelimiters Link copied!

Type: boolean

Use custom tag delimiters for parsing metadata

Default: false

nixflix.jellyfin.logDir Link copied!

Type: absolute path

Directory where the Jellyfin logs will be stored, passed with --logdir see #log-directory

Default: "${config.nixflix.stateDir}/jellyfin/log"

nixflix.jellyfin.network.baseUrl Link copied!

Type: string

Base URL for Jellyfin (URL prefix) http://localhost:8096/<baseUrl>

Default: ""
Example: "jellyfin"

nixflix.jellyfin.network.certificatePassword Link copied!

Type: string or (submodule)

Certificate password.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.network.certificatePath Link copied!

Type: string or absolute path

Path to certificate file

Default: ""

nixflix.jellyfin.network.enablePublishedServerUriByRequest Link copied!

Type: boolean

Enable published server URI by request

Default: false

nixflix.jellyfin.network.enableRemoteAccess Link copied!

Type: boolean

Enable remote access. (Disabling this can cause unexpected authentication failures)

Default: true

nixflix.jellyfin.network.internalHttpPort Link copied!

Type: integer between 0 and 65535 (both inclusive)

Internal HTTP port

Default: 8096

nixflix.jellyfin.network.internalHttpsPort Link copied!

Type: integer between 0 and 65535 (both inclusive)

Internal HTTPS port

Default: 8920

nixflix.jellyfin.network.knownProxies Link copied!

Type: list of string

List of IP addresses or hostnames of known proxies used when connecting to your Jellyfin instance. This is required to make proper use of 'X-Forwarded-For' headers.

Default: [ ]

nixflix.jellyfin.network.localNetworkAddresses Link copied!

Type: list of string

Override the local IP address for the HTTP server. If left empty, the server will bind to all available addresses.

Default: if (config.nixflix.reverseProxy.enable && !config.nixflix.jellyfin.vpn.enable) then [ "127.0.0.1" ] else [ ]

nixflix.jellyfin.network.localNetworkSubnets Link copied!

Type: list of string

IP addresses or IP/netmask entries for networks that will be considered on local network when enforcing bandwidth and remote access restrictions. If left blank, all RFC1918 addresses are considered local.

Default: [ ]

nixflix.jellyfin.network.publicHttpPort Link copied!

Type: integer between 0 and 65535 (both inclusive)

Public HTTP port

Default: 8096

nixflix.jellyfin.network.publicHttpsPort Link copied!

Type: integer between 0 and 65535 (both inclusive)

Public HTTPS port

Default: 8920

nixflix.jellyfin.network.publishedServerUriBySubnet Link copied!

Type: list of string

List of published server URIs by subnet

Default: [ ]

nixflix.jellyfin.network.remoteIpFilter Link copied!

Type: list of string

Remote IP filter list

Default: [ ]

nixflix.jellyfin.network.virtualInterfaceNames Link copied!

Type: list of string

List of virtual interface names

Default: [ "veth" ]

nixflix.jellyfin.openFirewall Link copied!

Type: boolean

Open ports in the firewall for Jellyfin. TCP ports 8096 and 8920, UDP ports 1900 and 7359.

Default: false

nixflix.jellyfin.package Link copied!

Type: package

Jellyfin package to use

Default: pkgs.jellyfin

nixflix.jellyfin.plugins Link copied!

Type: open submodule of attribute set of (submodule)

Jellyfin plugins to manage declaratively.

Each key is the plugin name exactly as it appears in the Jellyfin repository manifest (e.g. "Anime", "Bookshelf", "Trakt"). Plugin names must be unique across all configured plugin repositories.

Plugins are installed from package. This can either be a normal Nix derivation, or a repository lookup created with nixflix.lib.jellyfinPlugins.fromRepo.

Plugin changes (installs, removals, version updates) cause Jellyfin to restart automatically. Plan plugin changes for maintenance windows to avoid interrupting active streams.

Default: { }
Example:
{
  "Bookshelf" = {
    package = nixflix.lib.jellyfinPlugins.fromRepo {
      version = "13.0.0.0";
      hash = "sha256-16jaQRh1rIFE27nSSEWNF7UjVsPJDaRf24Ews0BZGas=";
    };
    config = {
      # Plain string (visible in Nix store)
      ComicVineApiKey = "my-api-key";
      # Or as a secret (read from file at activation time)
      # ComicVineApiKey._secret = "/run/secrets/comic-vine-api-key";
    };
  };

  "Intro Skipper" = {
    package = myJellyfinPlugin;
  };
}

nixflix.jellyfin.plugins."Open Subtitles" Link copied!

Type: submodule

This option has no description.

Default: { }

nixflix.jellyfin.plugins."Open Subtitles".apiName Link copied!

Type: string

The plugin's Name as reported by the Jellyfin /Plugins API. Defaults to the attribute name. Set this when the plugin's self-reported API name differs from its manifest name (e.g. the SSO-Auth plugin is listed in the manifest as "SSO Authentication" but reports itself via the API as "SSO-Auth").

Can be found when running the following while the plugin is installed:

curl -s -H "Authorization: MediaBrowser Token=$(sudo cat /run/jellyfin/auth-token)" \
                     http://127.0.0.1:8096/Plugins | jq '.[].Name'
Default: "‹name›"
Example: "SSO-Auth"

nixflix.jellyfin.plugins."Open Subtitles".config Link copied!

Type: submodule

Open Subtitles plugin configuration payload as posted to the Jellyfin API. You can utilize this plugin by editing a library and modifying the options for subtitle downloads.

Default: { }

nixflix.jellyfin.plugins."Open Subtitles".config.Password Link copied!

Type: string or (submodule)

Password for OpenSubtitles.com

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.plugins."Open Subtitles".enable Link copied!

Type: boolean

Whether this plugin should be installed. When false, the plugin is treated as absent: if it was previously installed by nixflix it will be uninstalled on the next nixos-rebuild. This is equivalent to removing the attribute entirely from nixflix.jellyfin.plugins.

Default: false

nixflix.jellyfin.plugins."Open Subtitles".package Link copied!

Type: null or package or (submodule)

Nix package containing the unpacked Jellyfin plugin files to copy into Jellyfin's plugin directory.

For repository-managed plugins, use nixflix.lib.jellyfinPlugins.fromRepo { version = ...; hash = ...; } to resolve a deterministic package from the pinned plugin manifests.

Default: { hash = "sha256-b6sgmgBlvhUAhFuq0p/EjB3604NGBkpS4NP33n1hfKc="; repository = null; version = "24.0.0.0"; }
Example:
nixflix.lib.jellyfinPlugins.fromRepo {
  version = "13.0.0.0";
  hash = "sha256-16jaQRh1rIFE27nSSEWNF7UjVsPJDaRf24Ews0BZGas=";
}

nixflix.jellyfin.plugins."Subtitle Extract".apiName Link copied!

Type: string

The plugin's Name as reported by the Jellyfin /Plugins API. Defaults to the attribute name. Set this when the plugin's self-reported API name differs from its manifest name (e.g. the SSO-Auth plugin is listed in the manifest as "SSO Authentication" but reports itself via the API as "SSO-Auth").

Can be found when running the following while the plugin is installed:

curl -s -H "Authorization: MediaBrowser Token=$(sudo cat /run/jellyfin/auth-token)" \
                     http://127.0.0.1:8096/Plugins | jq '.[].Name'
Default: "‹name›"
Example: "SSO-Auth"

nixflix.jellyfin.plugins."Subtitle Extract".config Link copied!

Type: submodule

Plugin to automatically extract embedded subtitles.

Default: { }

nixflix.jellyfin.plugins."Subtitle Extract".config.AllSubtitleCodecs Link copied!

Type: list of (submodule)

Full list of all supported subtitle codecs with their display names. Only works when IsAdvancedMode = true;.

Default: [ { Text = "ASS (Advanced SSA) subtitle (.ass & .ssa files - often found on anime)"; Value = "ass"; } { Text = "DVD subtitles"; Value = "DVDSUB"; } { Text = "SubRip subtitle (.srt files - most common type of subtitles)"; Value = "subrip"; } { Text = "HDMV Presentation Graphic Stream subtitles (often found on Blu-ray)"; Value = "PGSSUB"; } { Text = "DVB subtitles"; Value = "DVBSUB"; } { Text = "EIA-608 closed captions"; Value = "eia_608"; } { Text = "JACOsub subtitle"; Value = "jacosub"; } { Text = "MicroDVD subtitle"; Value = "microdvd"; } { Text = "MOV text"; Value = "mov_text"; } { Text = "MPL2 subtitle"; Value = "mpl2"; } { Text = "PJS (Phoenix Japanimation Society) subtitle"; Value = "pjs"; } { Text = "RealText subtitle"; Value = "realtext"; } { Text = "SAMI subtitle"; Value = "sami"; } { Text = "Spruce subtitle format"; Value = "stl"; } { Text = "SubViewer subtitle"; Value = "subviewer"; } { Text = "SubViewer v1 subtitle"; Value = "subviewer1"; } { Text = "raw UTF-8 text"; Value = "text"; } { Text = "VPlayer subtitle"; Value = "vplayer"; } { Text = "WebVTT subtitle"; Value = "webvtt"; } { Text = "XSUB"; Value = "xsub"; } ]

nixflix.jellyfin.plugins."Subtitle Extract".config.ExtractionDuringLibraryScan Link copied!

Type: boolean

Whether to extract embedded subtitles and attachments during a library scan.

Default: false

nixflix.jellyfin.plugins."Subtitle Extract".config.IncludeGraphicalSubtitles Link copied!

Type: boolean

Includes: DVD subtitles (VOBSUB), Blu-ray subtitles (PGS), and other image-based formats. It will extract subtitles from medias containing at least one graphical subtitle.

Default: true

nixflix.jellyfin.plugins."Subtitle Extract".config.IncludeTextSubtitles Link copied!

Type: boolean

Includes: SRT, ASS/SSA, WebVTT, and other text-based subtitle formats. It will extract subtitles from medias containing only text subtitles.

Default: true

nixflix.jellyfin.plugins."Subtitle Extract".config.IsAdvancedMode Link copied!

Type: boolean

Enable advanced codec selection for fine-grained control

Default: false

nixflix.jellyfin.plugins."Subtitle Extract".config.SelectedAttachmentsLibraries Link copied!

Type: list of string

List of libraries from which attachments will be extracted.

Default: [ ]

nixflix.jellyfin.plugins."Subtitle Extract".config.SelectedCodecs Link copied!

Type: list of string

Limit subtitle extraction to media with all subtitle streams matching the selected codecs. Only works when IsAdvancedMode = true;.

Default: [ "ass" "DVDSUB" "subrip" "PGSSUB" "DVBSUB" "eia_608" "jacosub" "microdvd" "mov_text" "mpl2" "pjs" "realtext" "sami" "stl" "subviewer" "subviewer1" "text" "vplayer" "webvtt" "xsub" ]

nixflix.jellyfin.plugins."Subtitle Extract".config.SelectedSubtitlesLibraries Link copied!

Type: list of string

List of libraries from which subtitles will be extracted.

Default: [ ]

nixflix.jellyfin.plugins."Subtitle Extract".enable Link copied!

Type: boolean

Whether this plugin should be installed. When false, the plugin is treated as absent: if it was previously installed by nixflix it will be uninstalled on the next nixos-rebuild. This is equivalent to removing the attribute entirely from nixflix.jellyfin.plugins.

Default: false

nixflix.jellyfin.plugins."Subtitle Extract".package Link copied!

Type: null or package or (submodule)

Nix package containing the unpacked Jellyfin plugin files to copy into Jellyfin's plugin directory.

For repository-managed plugins, use nixflix.lib.jellyfinPlugins.fromRepo { version = ...; hash = ...; } to resolve a deterministic package from the pinned plugin manifests.

Default: { hash = "sha256-vnSYKFf0L6Bk6jOegxs/Rk+2n5oEAQpxTbLqxNpYh2o="; repository = null; version = "7.0.0.0"; }
Example:
nixflix.lib.jellyfinPlugins.fromRepo {
  version = "13.0.0.0";
  hash = "sha256-16jaQRh1rIFE27nSSEWNF7UjVsPJDaRf24Ews0BZGas=";
}

nixflix.jellyfin.plugins.<name>.apiName Link copied!

Type: string

The plugin's Name as reported by the Jellyfin /Plugins API. Defaults to the attribute name. Set this when the plugin's self-reported API name differs from its manifest name (e.g. the SSO-Auth plugin is listed in the manifest as "SSO Authentication" but reports itself via the API as "SSO-Auth").

Can be found when running the following while the plugin is installed:

curl -s -H "Authorization: MediaBrowser Token=$(sudo cat /run/jellyfin/auth-token)" \
                     http://127.0.0.1:8096/Plugins | jq '.[].Name'
Default: "‹name›"
Example: "SSO-Auth"
Declared in: nixflix.jellyfin.plugins..apiName

nixflix.jellyfin.plugins.<name>.config Link copied!

Type: attribute set of anything

Plugin configuration payload as seen in the Jellyfin UI/API. All attributes under this option are POSTed to /Plugins/<id>/Configuration.

Default: { }
Example:
{
  ComicVineApiKey._secret = "/run/secrets/comic-vine-api-key";
}
Declared in: nixflix.jellyfin.plugins..config

nixflix.jellyfin.plugins.<name>.enable Link copied!

Type: boolean

Whether this plugin should be installed. When false, the plugin is treated as absent: if it was previously installed by nixflix it will be uninstalled on the next nixos-rebuild. This is equivalent to removing the attribute entirely from nixflix.jellyfin.plugins.

Default: true
Declared in: nixflix.jellyfin.plugins..enable

nixflix.jellyfin.plugins.<name>.package Link copied!

Type: null or package or (submodule)

Nix package containing the unpacked Jellyfin plugin files to copy into Jellyfin's plugin directory.

For repository-managed plugins, use nixflix.lib.jellyfinPlugins.fromRepo { version = ...; hash = ...; } to resolve a deterministic package from the pinned plugin manifests.

Default: null
Example:
nixflix.lib.jellyfinPlugins.fromRepo {
  version = "13.0.0.0";
  hash = "sha256-16jaQRh1rIFE27nSSEWNF7UjVsPJDaRf24Ews0BZGas=";
}
Declared in: nixflix.jellyfin.plugins..package

nixflix.jellyfin.plugins.subbuzz Link copied!

Type: submodule

This option has no description.

Default: { }

nixflix.jellyfin.plugins.subbuzz.apiName Link copied!

Type: string

The plugin's Name as reported by the Jellyfin /Plugins API. Defaults to the attribute name. Set this when the plugin's self-reported API name differs from its manifest name (e.g. the SSO-Auth plugin is listed in the manifest as "SSO Authentication" but reports itself via the API as "SSO-Auth").

Can be found when running the following while the plugin is installed:

curl -s -H "Authorization: MediaBrowser Token=$(sudo cat /run/jellyfin/auth-token)" \
                     http://127.0.0.1:8096/Plugins | jq '.[].Name'
Default: "‹name›"
Example: "SSO-Auth"

nixflix.jellyfin.plugins.subbuzz.config Link copied!

Type: submodule

SubBuzz plugin configuration payload as posted to the Jellyfin API.

Default: { }

nixflix.jellyfin.plugins.subbuzz.config.Cache Link copied!

Type: submodule

Settings controlling subtitle and search result caching behaviour.

Default: { }

nixflix.jellyfin.plugins.subbuzz.config.Cache.BasePath Link copied!

Type: string

Specify a custom location for the cache files. Leave blank to use the default.

Default: ""

nixflix.jellyfin.plugins.subbuzz.config.Cache.Search Link copied!

Type: boolean

Save results from search requests and reuse them for a specified period of time.

Default: true

nixflix.jellyfin.plugins.subbuzz.config.Cache.SearchLifeInMinutes Link copied!

Type: (one of 1440, 60, 10080, 720, 2880, 120, 20160, 4320, 30240, 5760, 240, 40320, 480, 0) or (one of "1 day", "1 hour", "1 week", "12 hours", "2 days", "2 hours", "2 weeks", "3 days", "3 weeks", "4 days", "4 hours", "4 weeks", "8 hours", "Use cache only in case of error") convertible to it

Send search requests to the providers again only after the selected period expires.

Default: "4 hours"

nixflix.jellyfin.plugins.subbuzz.config.Cache.SubLifeInMinutes Link copied!

Type: (one of 1440, 60, 10080, 720, 2880, 120, 20160, 4320, 30240, 43200, 240, 86400, 480, 129600, 1000001, 0) or (one of "1 day", "1 hour", "1 week", "12 hours", "2 days", "2 hours", "2 weeks", "3 days", "3 weeks", "30 days", "4 hours", "60 days", "8 hours", "90 days", "Always", "Use cache only in case of error") convertible to it

The subtitles will be downloaded again only when the selected period expires. Usually, once the subtitles are uploaded, they are never updated. Therefore, you may consider increasing the default period to speed up subsequent subtitle downloads.

Default: "1 week"

nixflix.jellyfin.plugins.subbuzz.config.Cache.Subtitle Link copied!

Type: boolean

Store the downloaded subtitle files locally to reduce the requests to the providers.

Default: true

nixflix.jellyfin.plugins.subbuzz.config.EnableAddic7ed Link copied!

Type: boolean

Enable the Addic7ed subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableOpenSubtitles Link copied!

Type: boolean

Enable the OpenSubtitles subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnablePodnapisiNet Link copied!

Type: boolean

Enable the Podnapisi.NET subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableSubSource Link copied!

Type: boolean

Enable the SubSource subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableSubdlCom Link copied!

Type: boolean

Enable the Subdl.com subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableSubf2m Link copied!

Type: boolean

Enable the Subf2m subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableSubscene Link copied!

Type: boolean

Enable the Subscene subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableSubssabbz Link copied!

Type: boolean

Enable the Subssabbz subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableSubsunacsNet Link copied!

Type: boolean

Enable the Subsunacs.net subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.EnableYavkaNet Link copied!

Type: boolean

Enable the Yavka.net subtitle provider.

Default: false

nixflix.jellyfin.plugins.subbuzz.config.HashMatchByScore Link copied!

Type: signed integer

Score threshold at which a subtitle is considered a hash match.

Default: 100

nixflix.jellyfin.plugins.subbuzz.config.MinScore Link copied!

Type: signed integer

Minimum score a subtitle must achieve to be downloaded.

Default: 50

nixflix.jellyfin.plugins.subbuzz.config.OpenSubApiKey Link copied!

Type: string or (submodule)

API Key for the OpenSubtitles service.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.plugins.subbuzz.config.OpenSubPassword Link copied!

Type: string or (submodule)

Password for authenticating with OpenSubtitles.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.plugins.subbuzz.config.OpenSubToken Link copied!

Type: string or (submodule)

Session token for the OpenSubtitles service. Can be found on the OpenSubtitles.com profile page.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.plugins.subbuzz.config.OpenSubUseHash Link copied!

Type: boolean

When enabled, the hash of the video file will be sent in the search requests to opensubtitles.com

Default: true

nixflix.jellyfin.plugins.subbuzz.config.OpenSubUserName Link copied!

Type: string

Username for authenticating with OpenSubtitles.

Default: ""

nixflix.jellyfin.plugins.subbuzz.config.SubEncoding Link copied!

Type: submodule

Settings controlling subtitle character encoding detection and conversion.

Default: { }

nixflix.jellyfin.plugins.subbuzz.config.SubEncoding.AutoDetectEncoding Link copied!

Type: boolean

Whether to automatically detect the encoding of subtitle files.

Default: true

nixflix.jellyfin.plugins.subbuzz.config.SubEncoding.DefaultEncoding Link copied!

Type: string

Use this encoding in cases where automatic encoding detection is disabled or when automatic detection fails.

Default: "utf-8"

nixflix.jellyfin.plugins.subbuzz.config.SubPostProcessing Link copied!

Type: submodule

Settings for post-processing subtitle files after download.

Default: { }

nixflix.jellyfin.plugins.subbuzz.config.SubPostProcessing.AdjustDurationCps Link copied!

Type: signed integer

Characters per second target used when adjusting subtitle duration.

Default: 15

nixflix.jellyfin.plugins.subbuzz.config.SubPostProcessing.AdjustDurationExtendOnly Link copied!

Type: boolean

When adjusting subtitles do not decrease the original duration.

Default: true

nixflix.jellyfin.plugins.subbuzz.config.SubSourceApiKey Link copied!

Type: string or (submodule)

Provide your API Key for doing API requests, if left empty provider will be disabled.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.plugins.subbuzz.config.SubdlApiKey Link copied!

Type: string or (submodule)

Provide your API Key for doing API requests, if left empty provider will be disabled.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.plugins.subbuzz.config.SubtitleInfoWithHtml Link copied!

Type: boolean

Format subtitle information displayed in search dialog using HTML. This may cause display issues in clients that doesn't support HTML. To use this with Jellyfin web interface you need to patch Jellyfin Web Client.

Default: false

nixflix.jellyfin.plugins.subbuzz.enable Link copied!

Type: boolean

Whether this plugin should be installed. When false, the plugin is treated as absent: if it was previously installed by nixflix it will be uninstalled on the next nixos-rebuild. This is equivalent to removing the attribute entirely from nixflix.jellyfin.plugins.

Default: false

nixflix.jellyfin.plugins.subbuzz.package Link copied!

Type: null or package or (submodule)

Nix package containing the unpacked Jellyfin plugin files to copy into Jellyfin's plugin directory.

For repository-managed plugins, use nixflix.lib.jellyfinPlugins.fromRepo { version = ...; hash = ...; } to resolve a deterministic package from the pinned plugin manifests.

Default: { hash = "sha256-MtHFChAU2ZAtWROSbqxKW8fle8UeAhUt1jIEvw/VZjs="; repository = null; version = "1.4.1.0"; }
Example:
nixflix.lib.jellyfinPlugins.fromRepo {
  version = "13.0.0.0";
  hash = "sha256-16jaQRh1rIFE27nSSEWNF7UjVsPJDaRf24Ews0BZGas=";
}

nixflix.jellyfin.reverseProxy.expose Link copied!

Type: boolean

Whether to expose Jellyfin via the reverse proxy.

Default: true

nixflix.jellyfin.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy.

Default: "jellyfin"

nixflix.jellyfin.system.activityLogRetentionDays Link copied!

Type: null or signed integer

Number of days to retain activity logs. Set to null to never delete.

Default: 30

nixflix.jellyfin.system.allowClientLogUpload Link copied!

Type: boolean

This option has no description.

Default: true

nixflix.jellyfin.system.cachePath Link copied!

Type: string

Specify a custom location for server cache files such as images.

Default: "${config.nixflix.jellyfin.cacheDir}"

nixflix.jellyfin.system.cacheSize Link copied!

Type: signed integer

Cache size in MB. Must be at least 3 due to Jellyfin's internal caching implementation. The default of 1800 matches Jellyfin's built-in default.

Default: 1800

nixflix.jellyfin.system.castReceiverApplications Link copied!

Type: list of (submodule)

This option has no description.

Default: [ { id = "F007D354"; name = "Stable"; } { id = "6F511C87"; name = "Unstable"; } ]

nixflix.jellyfin.system.chapterImageResolution Link copied!

Type: one of "MatchSource", "P2160", "P1440", "P1080", "P720", "P480", "P360", "P240", "P144"

The resolution of the extracted chapter images. Changing this will have no effect on existing dummy chapters.

Default: "MatchSource"

nixflix.jellyfin.system.codecsUsed Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.system.contentTypes Link copied!

Type: list of (submodule)

This option has no description.

Default: [ ]

nixflix.jellyfin.system.corsHosts Link copied!

Type: list of string

This option has no description.

Default: [ "*" ]

nixflix.jellyfin.system.dummyChapterDuration Link copied!

Type: signed integer

This option has no description.

Default: 0

nixflix.jellyfin.system.enableFolderView Link copied!

Type: boolean

Whether to enable .

Default: false
Example: true

nixflix.jellyfin.system.enableGroupingMoviesIntoCollections Link copied!

Type: boolean

Whether to enable grouping movies into collections.

Default: false
Example: true

nixflix.jellyfin.system.enableGroupingShowsIntoCollections Link copied!

Type: boolean

Whether to enable grouping shows into collections.

Default: false
Example: true

nixflix.jellyfin.system.enableLegacyAuthorization Link copied!

Type: boolean

Enable legacy authorization mode for backwards compatibility.

Default: true

nixflix.jellyfin.system.enableMetrics Link copied!

Type: boolean

Whether to enable metrics.

Default: false
Example: true

nixflix.jellyfin.system.imageSavingConvention Link copied!

Type: one of "Legacy", "Compatible"

Specifies how images are saved. Legacy uses the old format, Compatible uses a more widely compatible format.

Default: "Legacy"

nixflix.jellyfin.system.inactiveSessionThreshold Link copied!

Type: signed integer

This option has no description.

Default: 0

nixflix.jellyfin.system.isPortAuthorized Link copied!

Type: boolean

This option has no description.

Default: true

nixflix.jellyfin.system.isStartupWizardCompleted Link copied!

Type: boolean

Controls whether or not the startup wizard is marked as completed. Set to false to show the startup wizard when visiting jellyfin (not recommended as this will happen every time jellyfin is restarted)

Default: true

nixflix.jellyfin.system.libraryMetadataRefreshConcurrency Link copied!

Type: signed integer

Maximum number of parallel tasks during library scans. Setting this to 0 will choose a limit based on your systems core count.

!!! warning

Setting this number too high may cause issues with network file systems; if you encounter problems lower this number.
Default: 0

nixflix.jellyfin.system.libraryMonitorDelay Link copied!

Type: signed integer

This option has no description.

Default: 60

nixflix.jellyfin.system.libraryScanFanoutConcurrency Link copied!

Type: signed integer

Maximum number of parallel tasks during library scans. Setting this to 0 will choose a limit based on your systems core count.

!!! warning

Setting this number too high may cause issues with network file systems; if you encounter problems lower this number.
Default: 0

nixflix.jellyfin.system.libraryUpdateDuration Link copied!

Type: signed integer

This option has no description.

Default: 30

nixflix.jellyfin.system.logFileRetentionDays Link copied!

Type: signed integer

The amount of days that jellyfin should keep log files before deleting.

Default: 3

nixflix.jellyfin.system.maxAudiobookResume Link copied!

Type: signed integer

Titles are assumed fully played if stopped when the remaining duration is less than this value.

Default: 5

nixflix.jellyfin.system.maxResumePct Link copied!

Type: signed integer

Titles are assumed fully played if stopped after this time.

Default: 90

nixflix.jellyfin.system.metadataCountryCode Link copied!

Type: string

Country code for language. Determines stuff like dates, comma placement etc.

Default: "US"

nixflix.jellyfin.system.metadataOptions Link copied!

Type: list of (submodule)

Configure metadata fetching options for different media types. Each entry specifies which metadata and image sources to use or disable.

Default: [ { itemType = "Movie"; } { disabledImageFetchers = [ "The Open Movie Database" ]; disabledMetadataFetchers = [ "The Open Movie Database" ]; itemType = "MusicVideo"; } { itemType = "Series"; } { disabledMetadataFetchers = [ "TheAudioDB" ]; itemType = "MusicAlbum"; } { disabledMetadataFetchers = [ "TheAudioDB" ]; itemType = "MusicArtist"; } { itemType = "BoxSet"; } { itemType = "Season"; } { itemType = "Episode"; } ]

nixflix.jellyfin.system.metadataOptions.*.disabledImageFetchers Link copied!

Type: list of string

List of image fetchers to disable for this media type

Default: [ ]

nixflix.jellyfin.system.metadataOptions.*.disabledMetadataFetchers Link copied!

Type: list of string

List of metadata fetchers to disable for this media type

Default: [ ]

nixflix.jellyfin.system.metadataOptions.*.disabledMetadataSavers Link copied!

Type: list of string

List of metadata savers to disable for this media type

Default: [ ]

nixflix.jellyfin.system.metadataOptions.*.imageFetcherOrder Link copied!

Type: list of string

Priority order for fetching images from remote sources

Default: [ ]

nixflix.jellyfin.system.metadataOptions.*.localMetadataReaderOrder Link copied!

Type: list of string

Priority order for reading local metadata

Default: [ ]

nixflix.jellyfin.system.metadataOptions.*.metadataFetcherOrder Link copied!

Type: list of string

Priority order for fetching metadata from remote sources

Default: [ ]

nixflix.jellyfin.system.metadataPath Link copied!

Type: string

Specify a custom location for downloaded artwork and metadata.

Default: "/var/lib/jellyfin/metadata"

nixflix.jellyfin.system.minAudiobookResume Link copied!

Type: signed integer

Titles are assumed unplayed if stopped before this time.

Default: 5

nixflix.jellyfin.system.minResumeDurationSeconds Link copied!

Type: signed integer

The shortest video length in seconds that will save playback location and let you resume.

Default: 300

nixflix.jellyfin.system.minResumePct Link copied!

Type: signed integer

Titles are assumed unplayed if stopped before this time.

Default: 5

nixflix.jellyfin.system.parallelImageEncodingLimit Link copied!

Type: signed integer

Maximum number of image encodings that are allowed to run in parallel. Setting this to 0 will choose a limit based on your systems core count.

Default: 0

nixflix.jellyfin.system.pathSubstitutions Link copied!

Type: list of (submodule)

This option has no description.

Default: [ ]

nixflix.jellyfin.system.pluginRepositories Link copied!

Type: attribute set of (submodule)

Configure which plugin repositories you use. Jellyfin Stable is always present in the set. Adding new plugin repositories will not remove it.

Default: { "Jellyfin Stable" = { url = "https://repo.jellyfin.org/files/plugin/manifest.json"; hash = "1ykrpwya7px7dz4h92994kpqlf5jd429z7r4dckbw13236x5mpbx"; enabled = true; }; }

nixflix.jellyfin.system.pluginRepositories.<name>.enabled Link copied!

Type: boolean

Whether to enable this plugin repository

Default: true
Example: false

nixflix.jellyfin.system.pluginRepositories.<name>.hash Link copied!

Type: string

Fixed-output hash for the repository manifest. This pins the manifest used to resolve plugin versions to source URLs.

Supports SRI (sha256-Uc6ovnXI3T0WfCqzcnwUZwYCH1tTDYb86pfNlvbOam0=) or nix32 (0vbarvv9dkcpxby8c3akbcgh41k72iy75craghb3vpf8fnzaikji) formats.

Example: "0vbarvv9dkcpxby8c3akbcgh41k72iy75craghb3vpf8fnzaikji"

nixflix.jellyfin.system.pluginRepositories.<name>.url Link copied!

Type: string

URL for the plugin repository manifest

Example: "https://repo.jellyfin.org/files/plugin/manifest.json"

nixflix.jellyfin.system.quickConnectAvailable Link copied!

Type: boolean

Whether or not to enable quickconnect

Default: true

nixflix.jellyfin.system.remoteClientBitrateLimit Link copied!

Type: signed integer

This option has no description.

Default: 0

nixflix.jellyfin.system.removeOldPlugins Link copied!

Type: boolean

This option has no description.

Default: true

nixflix.jellyfin.system.saveMetadataHidden Link copied!

Type: boolean

Whether to enable .

Default: false
Example: true

nixflix.jellyfin.system.serverName Link copied!

Type: string

This name will be used to identify the server and will default to the server's hostname.

Default: "${config.networking.hostName}"

nixflix.jellyfin.system.slowResponseThresholdMs Link copied!

Type: signed integer

How slow (in ms) would a response have to be before a warning is shown

Default: 500

nixflix.jellyfin.system.sortRemoveCharacters Link copied!

Type: list of string

This option has no description.

Default: [ "," "&" "-" "{" "}" "'" ]

nixflix.jellyfin.system.sortRemoveWords Link copied!

Type: list of string

This option has no description.

Default: [ "the" "a" "an" ]

nixflix.jellyfin.system.sortReplaceCharacters Link copied!

Type: list of string

This option has no description.

Default: [ "." "+" "%" ]

nixflix.jellyfin.system.trickplayOptions.enableHwAcceleration Link copied!

Type: boolean

Whether to enable hardware acceleration.

Default: false
Example: true

nixflix.jellyfin.system.trickplayOptions.enableHwEncoding Link copied!

Type: boolean

Whether to enable hardware encoding.

Currently only available on QSV, VA-API, VideoToolbox and RKMPP, this option has no effect on other hardware acceleration methods.

Default: false
Example: true

nixflix.jellyfin.system.trickplayOptions.enableKeyFrameOnlyExtraction Link copied!

Type: boolean

Whether to enable key frame only extraction.

Extract key frames only for significantly faster processing with less accurate timing. If the configured hardware decoder does not support this mode, will use the software decoder instead.

Default: false
Example: true

nixflix.jellyfin.system.trickplayOptions.interval Link copied!

Type: signed integer

Interval of time (ms) between each new trickplay image.

Default: 10000

nixflix.jellyfin.system.trickplayOptions.jpegQuality Link copied!

Type: integer between 0 and 100 (both inclusive)

The JPEG compression quality for trickplay images.

Default: 90

nixflix.jellyfin.system.trickplayOptions.processPriority Link copied!

Type: one of "High", "AboveNormal", "Normal", "BelowNormal", "Idle"

Setting this lower or higher will determine how the CPU prioritizes the ffmpeg trickplay generation process in relation to other processes. If you notice slowdown while generating trickplay images but don't want to fully stop their generation, try lowering this as well as the thread count.

Default: "BelowNormal"

nixflix.jellyfin.system.trickplayOptions.processThreads Link copied!

Type: signed integer

The number of threads to pass to the '-threads' argument of ffmpeg.

Default: 1

nixflix.jellyfin.system.trickplayOptions.qscale Link copied!

Type: integer between 2 and 31 (both inclusive)

The quality scale of images output by ffmpeg, with 2 being the highest quality and 31 being the lowest.

Default: 4

nixflix.jellyfin.system.trickplayOptions.scanBehavior Link copied!

Type: one of "NonBlocking", "Blocking"

The default behavior is non blocking, which will add media to the library before trickplay generation is done. Blocking will ensure trickplay files are generated before media is added to the library, but will make scans significantly longer.

Default: "NonBlocking"

nixflix.jellyfin.system.trickplayOptions.tileHeight Link copied!

Type: signed integer

Maximum number of images per tile in the X direction.

Default: 10

nixflix.jellyfin.system.trickplayOptions.tileWidth Link copied!

Type: signed integer

Maximum number of images per tile in the X direction.

Default: 10

nixflix.jellyfin.system.trickplayOptions.widthResolutions Link copied!

Type: list of signed integer

List of the widths (px) that trickplay images will be generated at. All images should generate proportionally to the source, so a width of 320 on a 16:9 video ends up around 320x180.

Default: [ 320 ]

nixflix.jellyfin.system.uiCulture Link copied!

Type: string

This option has no description.

Default: "en-US"

nixflix.jellyfin.user Link copied!

Type: string

User under which the service runs

Default: "jellyfin"

nixflix.jellyfin.users Link copied!

Type: attribute set of (submodule)

User configuration.

Important: At least one user must have policy.isAdministrator = true. This user will be created during the initial setup wizard and used for subsequent API operations.

Default: { }
Example:
{
  admin = {
    password = {
      _secret = "/run/secrets/jellyfin-admin-password";
    };
    policy = {
      isAdministrator = true;
    };
  };
}

nixflix.jellyfin.users.<name>.configuration Link copied!

Type: submodule

Configuration for this user

Default: { }
Example:
{
  enableNextEpisodeAutoPlay = true;
  subtitleMode = "Always";
}

nixflix.jellyfin.users.<name>.configuration.audioLanguagePreference Link copied!

Type: null or string

The audio language preference. Defaults to 'Any Language'

Default: null
Example: "eng"

nixflix.jellyfin.users.<name>.configuration.displayCollectionsView Link copied!

Type: boolean

Whether to show the Collections View

Default: false
Example: true

nixflix.jellyfin.users.<name>.configuration.displayMissingEpisodes Link copied!

Type: boolean

Whether to show missing episodes

Default: false
Example: true

nixflix.jellyfin.users.<name>.configuration.enableLocalPassword Link copied!

Type: boolean

This option has no description.

Default: false
Example: true

nixflix.jellyfin.users.<name>.configuration.enableNextEpisodeAutoPlay Link copied!

Type: boolean

Automatically play the next episode

Default: true
Example: false

nixflix.jellyfin.users.<name>.configuration.hidePlayedInLatest Link copied!

Type: boolean

Whether to hide already played titles in the 'Latest' section

Default: true
Example: false

nixflix.jellyfin.users.<name>.configuration.orderedViews Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.configuration.playDefaultAudioTrack Link copied!

Type: boolean

This option has no description.

Default: true
Example: false

nixflix.jellyfin.users.<name>.configuration.rememberAudioSelections Link copied!

Type: boolean

This option has no description.

Default: true
Example: false

nixflix.jellyfin.users.<name>.configuration.rememberSubtitleSelections Link copied!

Type: boolean

This option has no description.

Default: true
Example: false

nixflix.jellyfin.users.<name>.configuration.subtitleLanguagePreference Link copied!

Type: null or string

The subtitle language preference. Defaults to 'Any Language'

Default: null
Example: "eng"

nixflix.jellyfin.users.<name>.configuration.subtitleMode Link copied!

Type: one of "Default", "Always", "OnlyForced", "None", "Smart"
  • Default: The default subtitle playback mode.
  • Always: Always show subtitles.
  • OnlyForced: Only show forced subtitles.
  • None: Don't show subtitles.
  • Smart: Only show subtitles when the current audio stream is in a different language.
Default: "Default"

nixflix.jellyfin.users.<name>.enableAutoLogin Link copied!

Type: boolean

This option has no description.

Default: false
Example: true

nixflix.jellyfin.users.<name>.id Link copied!

Type: null or string

The ID of the user

Default: null
Example: "18B51E25-33FD-46B6-BBF8-DB4DD77D0679"

nixflix.jellyfin.users.<name>.lastActivityDate Link copied!

Type: null or string

This option has no description.

Default: null

nixflix.jellyfin.users.<name>.lastLoginDate Link copied!

Type: null or string

This option has no description.

Default: null

nixflix.jellyfin.users.<name>.mutable Link copied!

Type: boolean

Functions like mutableUsers in NixOS users.users."user" If true, the first time the user is created, all configured options are overwritten. Any modifications from the GUI will take priority, and no nix configuration changes will have any effect. If false however, all options are overwritten as specified in the nix configuration, which means any change through the Jellyfin GUI will have no effect after a rebuild.

Note: Passwords are only set during user creation and are never updated declaratively, regardless of the mutable setting. To change a user's password, use the Jellyfin web interface.

Default: true
Example: false

nixflix.jellyfin.users.<name>.password Link copied!

Type: string or (submodule)

User's password.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.jellyfin.users.<name>.policy Link copied!

Type: submodule

Policy for this user

Default: { }
Example:
{
  enableContentDeletion = false;
  enableSubtitleManagement = true;
  isAdministrator = true;
  isDisabled = false;
}

nixflix.jellyfin.users.<name>.policy.accessSchedules Link copied!

Type: list of (submodule)

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.accessSchedules.*.dayOfWeek Link copied!

Type: one of "Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Everyday", "Weekday", "Weekend"

This option has no description.

nixflix.jellyfin.users.<name>.policy.accessSchedules.*.endHour Link copied!

Type: integer between 0 and 23 (both inclusive)

This option has no description.

nixflix.jellyfin.users.<name>.policy.accessSchedules.*.startHour Link copied!

Type: integer between 0 and 23 (both inclusive)

This option has no description.

nixflix.jellyfin.users.<name>.policy.allowedTags Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.authenticationProviderId Link copied!

Type: string

Authentication provider ID

Default: "Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider"

nixflix.jellyfin.users.<name>.policy.blockUnratedItems Link copied!

Type: list of (one of "Movie", "Trailer", "Series", "Music", "Book", "LiveTvChannel", "LiveTvProgram", "ChannelContent", "Other")

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.blockedChannels Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.blockedMediaFolders Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.blockedTags Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.enableAllChannels Link copied!

Type: boolean

Whether the user has access to all channels

Default: true

nixflix.jellyfin.users.<name>.policy.enableAllDevices Link copied!

Type: boolean

Whether the user has access to all devices

Default: true

nixflix.jellyfin.users.<name>.policy.enableAllFolders Link copied!

Type: boolean

Whether the user has access to all folders

Default: true

nixflix.jellyfin.users.<name>.policy.enableAudioPlaybackTranscoding Link copied!

Type: boolean

Whether the server should transcode audio for the user if requested

Default: true

nixflix.jellyfin.users.<name>.policy.enableCollectionManagement Link copied!

Type: boolean

Whether the user can create, modify and delete collections

Default: false

nixflix.jellyfin.users.<name>.policy.enableMediaConversion Link copied!

Type: boolean

Whether the user can do media conversion

Default: true

nixflix.jellyfin.users.<name>.policy.enablePlaybackRemuxing Link copied!

Type: boolean

Whether the user is permitted to do playback remuxing

Default: true

nixflix.jellyfin.users.<name>.policy.enablePublicSharing Link copied!

Type: boolean

Whether to enable public sharing for the user

Default: true

nixflix.jellyfin.users.<name>.policy.enableRemoteAccess Link copied!

Type: boolean

Whether the user can access the server remotely

Default: true

nixflix.jellyfin.users.<name>.policy.enableRemoteControlOfOtherUsers Link copied!

Type: boolean

Whether the user can remotely control other users

Default: false

nixflix.jellyfin.users.<name>.policy.enableSharedDeviceControl Link copied!

Type: boolean

Whether the user can control shared devices

Default: true

nixflix.jellyfin.users.<name>.policy.enableSyncTranscoding Link copied!

Type: boolean

Whether to enable sync transcoding for the user

Default: true

nixflix.jellyfin.users.<name>.policy.enableVideoPlaybackTranscoding Link copied!

Type: boolean

Whether the server should transcode video for the user if requested

Default: true

nixflix.jellyfin.users.<name>.policy.enabledChannels Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.enabledDevices Link copied!

Type: list of string

This option has no description.

Default: [ ]

nixflix.jellyfin.users.<name>.policy.forceRemoteSourceTranscoding Link copied!

Type: boolean

Whether the server should force transcoding on remote connections for the user

Default: false

nixflix.jellyfin.users.<name>.policy.isAdministrator Link copied!

Type: boolean

Whether the user is an administrator

Default: false

nixflix.jellyfin.users.<name>.policy.loginAttemptsBeforeLockout Link copied!

Type: null or signed integer

The number of login attempts the user can make before they are locked out. 0 for default (3 for normal users, 5 for admins). null for unlimited

Default: 3
Example: 10

nixflix.jellyfin.users.<name>.policy.maxActiveSessions Link copied!

Type: signed integer

The maximum number of active sessions the user can have at once. 0 for unlimited

Default: 0
Example: 5

nixflix.jellyfin.users.<name>.policy.maxParentalRating Link copied!

Type: null or signed integer

This option has no description.

Default: null

nixflix.jellyfin.users.<name>.policy.maxParentalSubRating Link copied!

Type: null or signed integer

This option has no description.

Default: null

nixflix.jellyfin.users.<name>.policy.passwordResetProviderId Link copied!

Type: string

Password reset provider ID

Default: "Jellyfin.Server.Implementations.Users.DefaultPasswordResetProvider"

nixflix.jellyfin.users.<name>.policy.syncPlayAccess Link copied!

Type: one of "CreateAndJoinGroups", "JoinGroups", "None"

Whether or not this user has access to SyncPlay

Default: "CreateAndJoinGroups"
Example: "None"

nixflix.jellyfin.vpn.enable Link copied!

Type: boolean

Whether to route Jellyfin traffic through the VPN.

When false, Jellyfin bypasses the VPN. When true, Jellyfin is confined to the WireGuard network namespace (requires nixflix.vpn.enable = true).

Default: config.nixflix.vpn.enable

nixflix.lidarr.config.apiKey Link copied!

Type: string or (submodule)

API key for Lidarr. Can be created by running:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.lidarr.config.apiVersion Link copied!

Type: string

Current version of the API of the service

Default: "v3"

nixflix.lidarr.config.delayProfiles Link copied!

Type: list of (submodule)

List of delay profiles to configure via the API /delayprofile endpoint.

Profiles are created/updated in id order. If no profile with id=1 is provided, a default profile will be added automatically.

Default: [ { enableUsenet = true; enableTorrent = true; preferredProtocol = "usenet"; usenetDelay = 0; torrentDelay = 0; bypassIfHighestQuality = true; bypassIfAboveCustomFormatScore = false; minimumCustomFormatScore = 0; order = 2147483647; tags = []; id = 1; }; ]

nixflix.lidarr.config.delayProfiles.*.bypassIfAboveCustomFormatScore Link copied!

Type: boolean

Bypass delay if custom format score is above minimum

Default: false

nixflix.lidarr.config.delayProfiles.*.bypassIfHighestQuality Link copied!

Type: boolean

Bypass delay if release is the highest quality available

Default: true

nixflix.lidarr.config.delayProfiles.*.enableTorrent Link copied!

Type: boolean

Enable Torrent protocol for this profile

Default: true

nixflix.lidarr.config.delayProfiles.*.enableUsenet Link copied!

Type: boolean

Enable Usenet protocol for this profile

Default: true

nixflix.lidarr.config.delayProfiles.*.id Link copied!

Type: signed integer

Unique identifier for the delay profile

nixflix.lidarr.config.delayProfiles.*.minimumCustomFormatScore Link copied!

Type: signed integer

Minimum custom format score to bypass delay

Default: 0

nixflix.lidarr.config.delayProfiles.*.order Link copied!

Type: signed integer

Order/priority of this delay profile (lower values = higher priority)

Default: 50

nixflix.lidarr.config.delayProfiles.*.preferredProtocol Link copied!

Type: one of "usenet", "torrent"

Preferred download protocol when both are available

Default: "usenet"

nixflix.lidarr.config.delayProfiles.*.tags Link copied!

Type: list of signed integer

List of tag IDs this delay profile applies to (empty = applies to all)

Default: [ ]

nixflix.lidarr.config.delayProfiles.*.torrentDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Torrent release

Default: 0

nixflix.lidarr.config.delayProfiles.*.usenetDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Usenet release

Default: 0

nixflix.lidarr.config.hostConfig Link copied!

Type: submodule

Host configuration options that will be set via the API /config/host endpoint

Default: { }

nixflix.lidarr.config.hostConfig.authenticationMethod Link copied!

Type: one of "none", "basic", "forms", "external"

Authentication method

Default: "forms"

nixflix.lidarr.config.hostConfig.authenticationRequired Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Authentication requirement level

Default: "enabled"

nixflix.lidarr.config.hostConfig.backupFolder Link copied!

Type: string

Backup folder name

Default: "Backups"

nixflix.lidarr.config.hostConfig.backupInterval Link copied!

Type: signed integer

Backup interval in days

Default: 7

nixflix.lidarr.config.hostConfig.backupRetention Link copied!

Type: signed integer

Backup retention in days

Default: 28

nixflix.lidarr.config.hostConfig.bindAddress Link copied!

Type: string

Address to bind to

Default: "0.0.0.0"

nixflix.lidarr.config.hostConfig.certificateValidation Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Certificate validation

Default: "enabled"

nixflix.lidarr.config.hostConfig.launchBrowser Link copied!

Type: boolean

Launch browser on start (not applicable for NixOS services)

Default: false

nixflix.lidarr.config.hostConfig.logLevel Link copied!

Type: one of "info", "debug", "trace"

Log level

Default: "info"

nixflix.lidarr.config.hostConfig.logSizeLimit Link copied!

Type: signed integer

Log size limit in MB

Default: 1

nixflix.lidarr.config.hostConfig.password Link copied!

Type: null or string or (submodule)

Password for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.lidarr.config.hostConfig.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port the service listens on

nixflix.lidarr.config.hostConfig.proxyBypassLocalAddresses Link copied!

Type: boolean

Proxy bypass local addresses

Default: true

nixflix.lidarr.config.hostConfig.proxyPassword Link copied!

Type: string or (submodule)

Proxy password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.lidarr.config.hostConfig.proxyPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Proxy port

Default: 8080

nixflix.lidarr.config.hostConfig.proxyType Link copied!

Type: one of "http", "socks4", "socks5"

Proxy type

Default: "http"

nixflix.lidarr.config.hostConfig.proxyUsername Link copied!

Type: string or (submodule)

Proxy username

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.lidarr.config.hostConfig.sslCertPassword Link copied!

Type: string or (submodule)

SSL certificate password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.lidarr.config.hostConfig.sslPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

SSL port

Default: 9898

nixflix.lidarr.config.hostConfig.trustCgnatIpAddresses Link copied!

Type: boolean

Trust CGNAT IP addresses

Default: false

nixflix.lidarr.config.hostConfig.updateMechanism Link copied!

Type: one of "builtIn", "script", "external", "docker"

Update mechanism

Default: "builtIn"

nixflix.lidarr.config.hostConfig.urlBase Link copied!

Type: string

URL base path

Default: ""
Example: "/takeMeThere"

nixflix.lidarr.config.hostConfig.username Link copied!

Type: null or string or (submodule)

Username for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.lidarr.config.mediaManagement.autoUnmonitorPreviouslyDownloadedTracks Link copied!

Type: boolean

Automatically unmonitor tracks after they have been downloaded.

Default: false

nixflix.lidarr.config.mediaManagement.chmodFolder Link copied!

Type: string

Octal permissions to apply to media folders.

Default: "755"

nixflix.lidarr.config.mediaManagement.chownGroup Link copied!

Type: string

Group name or gid to apply to media folders.

Default: ""

nixflix.lidarr.config.mediaManagement.createEmptyArtistFolders Link copied!

Type: boolean

Create missing artist folders during disk scan.

Default: false

nixflix.lidarr.config.mediaManagement.deleteEmptyFolders Link copied!

Type: boolean

Delete empty folders during disk scan and when media files are deleted.

Default: true

nixflix.lidarr.config.mediaManagement.downloadPropersAndRepacks Link copied!

Type: one of "preferAndUpgrade", "doNotUpgrade", "doNotPrefer"

How to handle proper and repack releases.

Default: "preferAndUpgrade"

nixflix.lidarr.config.mediaManagement.enableMediaInfo Link copied!

Type: boolean

Scan video files for media info such as resolution, runtime, and codec.

Default: true

nixflix.lidarr.config.mediaManagement.extraFileExtensions Link copied!

Type: string

Comma-separated list of extra file extensions to import.

Default: "srt"

nixflix.lidarr.config.mediaManagement.fileDate Link copied!

Type: one of "none", "albumReleaseDate"

Set the file date on imported media files.

Default: "none"

nixflix.lidarr.config.mediaManagement.importExtraFiles Link copied!

Type: boolean

Import matching extra files alongside media files.

Default: false

nixflix.lidarr.config.mediaManagement.minimumFreeSpaceWhenImporting Link copied!

Type: signed integer

Minimum free space in MB to leave on the disk when importing.

Default: 100

nixflix.lidarr.config.mediaManagement.recycleBin Link copied!

Type: string

Path to the recycle bin directory.

Default: ""

nixflix.lidarr.config.mediaManagement.recycleBinCleanupDays Link copied!

Type: signed integer

Number of days before items in the recycle bin are permanently deleted.

Default: 7

nixflix.lidarr.config.mediaManagement.rescanAfterRefresh Link copied!

Type: one of "always", "afterManual", "never"

When to rescan the media folder after refreshing media information.

Default: "always"

nixflix.lidarr.config.mediaManagement.scriptImportPath Link copied!

Type: string

Path to the custom import script.

Default: ""

nixflix.lidarr.config.mediaManagement.setPermissionsLinux Link copied!

Type: boolean

Set chmod and chown on imported files and media folders.

Default: false

nixflix.lidarr.config.mediaManagement.skipFreeSpaceCheckWhenImporting Link copied!

Type: boolean

Skip the free space check when importing media files.

Default: false

nixflix.lidarr.config.mediaManagement.useScriptImport Link copied!

Type: boolean

Use a custom script for importing instead of the built-in import.

Default: false

nixflix.lidarr.config.rootFolders Link copied!

Type: list of (attribute set)

List of root folders to create via the API /rootfolder endpoint. Each folder is an attribute set that will be converted to JSON and sent to the API.

For Sonarr/Radarr, a simple path is sufficient: {path = "/path/to/folder";}

For Lidarr, additional fields are required like defaultQualityProfileId, etc.

Default: map (mediaDir: {path = mediaDir;}) nixflix.lidarr.mediaDirs

nixflix.lidarr.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.lidarr.dataDir Link copied!

Type: absolute path

Directory containing Seerr data and configuration

Default: "${config.nixflix.stateDir}/${serviceName}"

nixflix.lidarr.enable Link copied!

Type: boolean

Whether to enable Lidarr.

Default: false
Example: true

nixflix.lidarr.group Link copied!

Type: string

Group under which the service runs

Default: "lidarr"

nixflix.lidarr.mediaDirs Link copied!

Type: list of absolute path

List of media directories to create and manage

Default: [config.nixflix.mediaDir + "/<media-type>"]

nixflix.lidarr.openFirewall Link copied!

Type: boolean

Open ports in the firewall for the Radarr web interface.

Default: false

nixflix.lidarr.package Link copied!

Type: package

The lidarr package to use.

Default: pkgs.lidarr

nixflix.lidarr.reverseProxy.expose Link copied!

Type: boolean

Whether to expose this service via the reverse proxy.

Default: true

nixflix.lidarr.settings Link copied!

Type: open submodule of attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))

Attribute set of arbitrary config options. Please consult the documentation at the wiki.

!!! warning

This configuration is stored in the world-readable Nix store!
Don't put secrets here!
Default: { auth = { required = "Enabled"; method = "Forms"; }; server = { inherit (config.nixflix.lidarr.config.hostConfig) port urlBase; }; } // optionalAttrs config.nixflix.postgres.enable { log.dbEnabled = true; postgres = { user = config.nixflix.lidarr.user; host = "/run/postgresql"; port = config.services.postgresql.settings.port; mainDb = config.nixflix.lidarr.user; logDb = "${config.nixflix.lidarr.user}-logs"; }; }
Example:
{
  update.mechanism = "internal";
  server = {
    urlbase = "localhost";
    port = 8989;
    bindaddress = "*";
  };
}

nixflix.lidarr.settings.app.instanceName Link copied!

Type: string

Name of the instance

Default: "Lidarr"

nixflix.lidarr.settings.log.analyticsEnabled Link copied!

Type: boolean

Send Anonymous Usage Data

Default: false

nixflix.lidarr.settings.server.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port Number

nixflix.lidarr.settings.update.automatically Link copied!

Type: boolean

Automatically download and install updates.

Default: false

nixflix.lidarr.settings.update.mechanism Link copied!

Type: null or one of "external", "builtIn", "script"

which update mechanism to use

Default: "external"

nixflix.lidarr.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy. Service accessible at <subdomain>.<domain>.

Default: "lidarr"

nixflix.lidarr.user Link copied!

Type: string

User under which the service runs

Default: "lidarr"

nixflix.lidarr.vpn.enable Link copied!

Type: boolean

Whether to route Lidarr traffic through the VPN.

When false (default), Lidarr bypasses the VPN to prevent Cloudflare and image provider blocks. When true, Lidarr routes through the VPN (requires nixflix.vpn.enable = true).

TRaSH Guides recommend leaving this false.

Default: false

nixflix.mediaDir Link copied!

Type: absolute path

The location of the media directory for the services.

!!! warning

All parent directories must have execute permissions for everyone.

!!! warning

Setting this to any path, where the subpath is not owned by root, will fail! For example:

```nix
mediaDir = /home/user/data
```

Is not supported, because `/home/user` is owned by `user`.
Default: "/data/media"
Example: "/data/media"

nixflix.mediaUsers Link copied!

Type: list of string

Extra users to add to the media group.

Default: [ ]
Example:
[
  "user"
]

nixflix.nginx.addHostsEntries Link copied!

Type: boolean

Whether to add networking.hosts entries mapping service subdomains to 127.0.0.1.

Enable if you don't have a separate DNS setup.

Default: false

nixflix.nginx.domain Link copied!

Type: string

Base domain for subdomain-based reverse proxy routing. Each service is accessible at <subdomain>.<domain>.

Default: "nixflix"
Example: "internal"

nixflix.nginx.enable Link copied!

Type: boolean

Whether to enable nginx reverse proxy for all services

Default: false

nixflix.nginx.enableACME Link copied!

Type: boolean

Whether to enable useACMEHost in virtual hosts. Uses nixflix.nginx.domain as ACME host.

You have to configure security.acme.certs.$${nixflix.nginx.domain} in order to use this.

Default: false
Example: true

nixflix.nginx.forceSSL Link copied!

Type: boolean

Whether to force SSL.

Default: false
Example: true

nixflix.postgres.enable Link copied!

Type: boolean

Whether or not to enable postgresql for the entire stack.

Default: false
Example: true

nixflix.prowlarr.config.apiKey Link copied!

Type: string or (submodule)

API key for Prowlarr. Can be created by running:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.apiVersion Link copied!

Type: string

Current version of the API of the service

Default: "v3"

nixflix.prowlarr.config.applications Link copied!

Type: list of (open submodule of attribute set of anything)

List of applications to configure in Prowlarr. Any additional attributes beyond name, implementationName, and apiKey will be applied as field values to the application schema.

Default: # Automatically configured for enabled arr services (Sonarr, Radarr, Lidarr) # Each enabled service gets an application entry with computed baseUrl and prowlarrUrl # based on nginx configuration

nixflix.prowlarr.config.applications.*.apiKey Link copied!

Type: string or (submodule)

Path to file containing the API key for the application

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.applications.*.implementationName Link copied!

Type: one of "LazyLibrarian", "Lidarr", "Mylar", "Readarr", "Radarr", "Sonarr", "Whisparr"

Type of application to configure (matches schema implementationName)

nixflix.prowlarr.config.applications.*.name Link copied!

Type: string

User-defined name for the application instance

nixflix.prowlarr.config.hostConfig Link copied!

Type: submodule

Host configuration options that will be set via the API /config/host endpoint

Default: { }

nixflix.prowlarr.config.hostConfig.authenticationMethod Link copied!

Type: one of "none", "basic", "forms", "external"

Authentication method

Default: "forms"

nixflix.prowlarr.config.hostConfig.authenticationRequired Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Authentication requirement level

Default: "enabled"

nixflix.prowlarr.config.hostConfig.backupFolder Link copied!

Type: string

Backup folder name

Default: "Backups"

nixflix.prowlarr.config.hostConfig.backupInterval Link copied!

Type: signed integer

Backup interval in days

Default: 7

nixflix.prowlarr.config.hostConfig.backupRetention Link copied!

Type: signed integer

Backup retention in days

Default: 28

nixflix.prowlarr.config.hostConfig.bindAddress Link copied!

Type: string

Address to bind to

Default: "0.0.0.0"

nixflix.prowlarr.config.hostConfig.certificateValidation Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Certificate validation

Default: "enabled"

nixflix.prowlarr.config.hostConfig.instanceName Link copied!

Type: string

Instance name

Default: "Prowlarr"

nixflix.prowlarr.config.hostConfig.launchBrowser Link copied!

Type: boolean

Launch browser on start (not applicable for NixOS services)

Default: false

nixflix.prowlarr.config.hostConfig.logLevel Link copied!

Type: one of "info", "debug", "trace"

Log level

Default: "info"

nixflix.prowlarr.config.hostConfig.logSizeLimit Link copied!

Type: signed integer

Log size limit in MB

Default: 1

nixflix.prowlarr.config.hostConfig.password Link copied!

Type: null or string or (submodule)

Password for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.hostConfig.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port the service listens on

nixflix.prowlarr.config.hostConfig.proxyBypassLocalAddresses Link copied!

Type: boolean

Proxy bypass local addresses

Default: true

nixflix.prowlarr.config.hostConfig.proxyPassword Link copied!

Type: string or (submodule)

Proxy password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.hostConfig.proxyPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Proxy port

Default: 8080

nixflix.prowlarr.config.hostConfig.proxyType Link copied!

Type: one of "http", "socks4", "socks5"

Proxy type

Default: "http"

nixflix.prowlarr.config.hostConfig.proxyUsername Link copied!

Type: string or (submodule)

Proxy username

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.hostConfig.sslCertPassword Link copied!

Type: string or (submodule)

SSL certificate password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.hostConfig.sslPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

SSL port

Default: 9898

nixflix.prowlarr.config.hostConfig.trustCgnatIpAddresses Link copied!

Type: boolean

Trust CGNAT IP addresses

Default: false

nixflix.prowlarr.config.hostConfig.updateMechanism Link copied!

Type: one of "builtIn", "script", "external", "docker"

Update mechanism

Default: "builtIn"

nixflix.prowlarr.config.hostConfig.urlBase Link copied!

Type: string

URL base path

Default: ""
Example: "/takeMeThere"

nixflix.prowlarr.config.hostConfig.username Link copied!

Type: null or string or (submodule)

Username for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexerProxies Link copied!

Type: list of (open submodule of attribute set of anything)

List of indexer proxies to configure in Prowlarr.

Any additional attributes beyond name, username, and password will be applied as field values to the indexer schema.

FlareSolverr is automatically configured with a flaresolverr tag when nixflix.flaresolverr.enable is true;

You can run the following command to get the field names for a particular indexer:

curl -s -H "X-Api-Key: $(sudo cat </path/to/prowlarr/apiKey>)" "http://127.0.0.1:9696/prowlarr/api/v1/indexerProxy/schema" | jq '.[] | select(.name=="<indexerName>") | .fields'

Or if you have nginx disabled or config.nixflix.prowlarr.config.hostConfig.urlBase is not configured

curl -s -H "X-Api-Key: $(sudo cat </path/to/prowlarr/apiKey>)" "http://127.0.0.1:9696/api/v1/indexerProxy/schema" | jq '.[] | select(.name=="<indexerName>") | .fields'
Default: [ ]

nixflix.prowlarr.config.indexerProxies.*.password Link copied!

Type: null or string or (submodule)

Password for the indexer proxy.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexerProxies.*.tags Link copied!

Type: list of string

Applies to indexers with at least one matching tag

Default: [ ]

nixflix.prowlarr.config.indexerProxies.*.username Link copied!

Type: null or string or (submodule)

Username for the indexer proxy.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexers Link copied!

Type: list of (open submodule of attribute set of anything)

List of indexers to configure in Prowlarr. Prowlarr supports many indexers in addition to any indexer that uses the Newznab/Torznab standard using 'Generic Newznab' (for usenet) or 'Generic Torznab' (for torrents).

Any additional attributes beyond name, apiKey, apikey, username, password, passkey, and appProfileId will be applied as field values to the indexer schema.

The apiKey or apikey value is automatically applied to whichever field name the indexer schema uses — some schemas use apiKey (camelCase) and others use apikey (all-lowercase).

You can run the following command to get the field names for a particular indexer:

curl -s -H "X-Api-Key: $(sudo cat </path/to/prowlarr/apiKey>)" "http://127.0.0.1:9696/api/v1/indexer/schema" | jq '.[] | select(.name=="<indexerName>") | .fields'
Default: [ ]

nixflix.prowlarr.config.indexers.*.apiKey Link copied!

Type: null or string or (submodule)

API key for the indexer. Applied to schema fields named apikey or apiKey.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexers.*.apikey Link copied!

Type: null or string or (submodule)

API key for the indexer (lowercase variant). Applied to schema fields named apikey or apiKey.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexers.*.appProfileId Link copied!

Type: signed integer

Application profile ID for the indexer (default: 1).

Default: 1

nixflix.prowlarr.config.indexers.*.passkey Link copied!

Type: null or string or (submodule)

Passkey for the indexer.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexers.*.password Link copied!

Type: null or string or (submodule)

Password for the indexer.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.config.indexers.*.tags Link copied!

Type: list of string

Use tags to specify Indexer Proxies or which apps the indexer is synced to.

Tags should be used with caution, they can have unintended effects. An indexer with a tag will only sync to apps with the same tag.

Default: [ ]

nixflix.prowlarr.config.indexers.*.username Link copied!

Type: null or string or (submodule)

Username for the indexer.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.prowlarr.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.prowlarr.dataDir Link copied!

Type: absolute path

Directory containing Seerr data and configuration

Default: "${config.nixflix.stateDir}/${serviceName}"

nixflix.prowlarr.enable Link copied!

Type: boolean

Whether to enable Prowlarr.

Default: false
Example: true

nixflix.prowlarr.group Link copied!

Type: string

Group under which the service runs

Default: "prowlarr"

nixflix.prowlarr.openFirewall Link copied!

Type: boolean

Open ports in the firewall for the Radarr web interface.

Default: false

nixflix.prowlarr.package Link copied!

Type: package

The prowlarr package to use.

Default: pkgs.prowlarr

nixflix.prowlarr.reverseProxy.expose Link copied!

Type: boolean

Whether to expose this service via the reverse proxy.

Default: true

nixflix.prowlarr.settings Link copied!

Type: open submodule of attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))

Attribute set of arbitrary config options. Please consult the documentation at the wiki.

!!! warning

This configuration is stored in the world-readable Nix store!
Don't put secrets here!
Default: { auth = { required = "Enabled"; method = "Forms"; }; server = { inherit (config.nixflix.prowlarr.config.hostConfig) port urlBase; }; } // optionalAttrs config.nixflix.postgres.enable { log.dbEnabled = true; postgres = { user = config.nixflix.prowlarr.user; host = "/run/postgresql"; port = config.services.postgresql.settings.port; mainDb = config.nixflix.prowlarr.user; logDb = "${config.nixflix.prowlarr.user}-logs"; }; }
Example:
{
  update.mechanism = "internal";
  server = {
    urlbase = "localhost";
    port = 8989;
    bindaddress = "*";
  };
}

nixflix.prowlarr.settings.app.instanceName Link copied!

Type: string

Name of the instance

Default: "Prowlarr"

nixflix.prowlarr.settings.log.analyticsEnabled Link copied!

Type: boolean

Send Anonymous Usage Data

Default: false

nixflix.prowlarr.settings.server.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port Number

nixflix.prowlarr.settings.update.automatically Link copied!

Type: boolean

Automatically download and install updates.

Default: false

nixflix.prowlarr.settings.update.mechanism Link copied!

Type: null or one of "external", "builtIn", "script"

which update mechanism to use

Default: "external"

nixflix.prowlarr.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy. Service accessible at <subdomain>.<domain>.

Default: "prowlarr"

nixflix.prowlarr.user Link copied!

Type: string

User under which the service runs

Default: "prowlarr"

nixflix.prowlarr.vpn.enable Link copied!

Type: boolean

Whether to route Prowlarr traffic through the VPN.

When false (default), Prowlarr bypasses the VPN to prevent Cloudflare and image provider blocks. When true, Prowlarr routes through the VPN (requires nixflix.vpn.enable = true).

TRaSH Guides recommend leaving this false.

Default: false

nixflix.radarr.config.apiKey Link copied!

Type: string or (submodule)

API key for Radarr. Can be created by running:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.radarr.config.apiVersion Link copied!

Type: string

Current version of the API of the service

Default: "v3"

nixflix.radarr.config.delayProfiles Link copied!

Type: list of (submodule)

List of delay profiles to configure via the API /delayprofile endpoint.

Profiles are created/updated in id order. If no profile with id=1 is provided, a default profile will be added automatically.

Default: [ { enableUsenet = true; enableTorrent = true; preferredProtocol = "usenet"; usenetDelay = 0; torrentDelay = 0; bypassIfHighestQuality = true; bypassIfAboveCustomFormatScore = false; minimumCustomFormatScore = 0; order = 2147483647; tags = []; id = 1; }; ]

nixflix.radarr.config.delayProfiles.*.bypassIfAboveCustomFormatScore Link copied!

Type: boolean

Bypass delay if custom format score is above minimum

Default: false

nixflix.radarr.config.delayProfiles.*.bypassIfHighestQuality Link copied!

Type: boolean

Bypass delay if release is the highest quality available

Default: true

nixflix.radarr.config.delayProfiles.*.enableTorrent Link copied!

Type: boolean

Enable Torrent protocol for this profile

Default: true

nixflix.radarr.config.delayProfiles.*.enableUsenet Link copied!

Type: boolean

Enable Usenet protocol for this profile

Default: true

nixflix.radarr.config.delayProfiles.*.id Link copied!

Type: signed integer

Unique identifier for the delay profile

nixflix.radarr.config.delayProfiles.*.minimumCustomFormatScore Link copied!

Type: signed integer

Minimum custom format score to bypass delay

Default: 0

nixflix.radarr.config.delayProfiles.*.order Link copied!

Type: signed integer

Order/priority of this delay profile (lower values = higher priority)

Default: 50

nixflix.radarr.config.delayProfiles.*.preferredProtocol Link copied!

Type: one of "usenet", "torrent"

Preferred download protocol when both are available

Default: "usenet"

nixflix.radarr.config.delayProfiles.*.tags Link copied!

Type: list of signed integer

List of tag IDs this delay profile applies to (empty = applies to all)

Default: [ ]

nixflix.radarr.config.delayProfiles.*.torrentDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Torrent release

Default: 0

nixflix.radarr.config.delayProfiles.*.usenetDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Usenet release

Default: 0

nixflix.radarr.config.hostConfig Link copied!

Type: submodule

Host configuration options that will be set via the API /config/host endpoint

Default: { }

nixflix.radarr.config.hostConfig.authenticationMethod Link copied!

Type: one of "none", "basic", "forms", "external"

Authentication method

Default: "forms"

nixflix.radarr.config.hostConfig.authenticationRequired Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Authentication requirement level

Default: "enabled"

nixflix.radarr.config.hostConfig.backupFolder Link copied!

Type: string

Backup folder name

Default: "Backups"

nixflix.radarr.config.hostConfig.backupInterval Link copied!

Type: signed integer

Backup interval in days

Default: 7

nixflix.radarr.config.hostConfig.backupRetention Link copied!

Type: signed integer

Backup retention in days

Default: 28

nixflix.radarr.config.hostConfig.bindAddress Link copied!

Type: string

Address to bind to

Default: "0.0.0.0"

nixflix.radarr.config.hostConfig.certificateValidation Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Certificate validation

Default: "enabled"

nixflix.radarr.config.hostConfig.launchBrowser Link copied!

Type: boolean

Launch browser on start (not applicable for NixOS services)

Default: false

nixflix.radarr.config.hostConfig.logLevel Link copied!

Type: one of "info", "debug", "trace"

Log level

Default: "info"

nixflix.radarr.config.hostConfig.logSizeLimit Link copied!

Type: signed integer

Log size limit in MB

Default: 1

nixflix.radarr.config.hostConfig.password Link copied!

Type: null or string or (submodule)

Password for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.radarr.config.hostConfig.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port the service listens on

nixflix.radarr.config.hostConfig.proxyBypassLocalAddresses Link copied!

Type: boolean

Proxy bypass local addresses

Default: true

nixflix.radarr.config.hostConfig.proxyPassword Link copied!

Type: string or (submodule)

Proxy password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.radarr.config.hostConfig.proxyPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Proxy port

Default: 8080

nixflix.radarr.config.hostConfig.proxyType Link copied!

Type: one of "http", "socks4", "socks5"

Proxy type

Default: "http"

nixflix.radarr.config.hostConfig.proxyUsername Link copied!

Type: string or (submodule)

Proxy username

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.radarr.config.hostConfig.sslCertPassword Link copied!

Type: string or (submodule)

SSL certificate password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.radarr.config.hostConfig.sslPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

SSL port

Default: 9898

nixflix.radarr.config.hostConfig.trustCgnatIpAddresses Link copied!

Type: boolean

Trust CGNAT IP addresses

Default: false

nixflix.radarr.config.hostConfig.updateMechanism Link copied!

Type: one of "builtIn", "script", "external", "docker"

Update mechanism

Default: "builtIn"

nixflix.radarr.config.hostConfig.urlBase Link copied!

Type: string

URL base path

Default: ""
Example: "/takeMeThere"

nixflix.radarr.config.hostConfig.username Link copied!

Type: null or string or (submodule)

Username for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.radarr.config.mediaManagement.autoUnmonitorPreviouslyDownloadedMovies Link copied!

Type: boolean

Automatically unmonitor movies after they have been downloaded.

Default: false

nixflix.radarr.config.mediaManagement.chmodFolder Link copied!

Type: string

Octal permissions to apply to media folders.

Default: "755"

nixflix.radarr.config.mediaManagement.chownGroup Link copied!

Type: string

Group name or gid to apply to media folders.

Default: ""

nixflix.radarr.config.mediaManagement.createEmptyMovieFolders Link copied!

Type: boolean

Create missing movie folders during disk scan.

Default: false

nixflix.radarr.config.mediaManagement.deleteEmptyFolders Link copied!

Type: boolean

Delete empty folders during disk scan and when media files are deleted.

Default: true

nixflix.radarr.config.mediaManagement.downloadPropersAndRepacks Link copied!

Type: one of "preferAndUpgrade", "doNotUpgrade", "doNotPrefer"

How to handle proper and repack releases.

Default: "preferAndUpgrade"

nixflix.radarr.config.mediaManagement.enableMediaInfo Link copied!

Type: boolean

Scan video files for media info such as resolution, runtime, and codec.

Default: true

nixflix.radarr.config.mediaManagement.extraFileExtensions Link copied!

Type: string

Comma-separated list of extra file extensions to import.

Default: "srt"

nixflix.radarr.config.mediaManagement.fileDate Link copied!

Type: one of "none", "cinemas", "physical", "digital"

Set the file date on imported media files.

Default: "none"

nixflix.radarr.config.mediaManagement.importExtraFiles Link copied!

Type: boolean

Import matching extra files alongside media files.

Default: false

nixflix.radarr.config.mediaManagement.minimumFreeSpaceWhenImporting Link copied!

Type: signed integer

Minimum free space in MB to leave on the disk when importing.

Default: 100

nixflix.radarr.config.mediaManagement.recycleBin Link copied!

Type: string

Path to the recycle bin directory.

Default: ""

nixflix.radarr.config.mediaManagement.recycleBinCleanupDays Link copied!

Type: signed integer

Number of days before items in the recycle bin are permanently deleted.

Default: 7

nixflix.radarr.config.mediaManagement.rescanAfterRefresh Link copied!

Type: one of "always", "afterManual", "never"

When to rescan the media folder after refreshing media information.

Default: "always"

nixflix.radarr.config.mediaManagement.scriptImportPath Link copied!

Type: string

Path to the custom import script.

Default: ""

nixflix.radarr.config.mediaManagement.setPermissionsLinux Link copied!

Type: boolean

Set chmod and chown on imported files and media folders.

Default: false

nixflix.radarr.config.mediaManagement.skipFreeSpaceCheckWhenImporting Link copied!

Type: boolean

Skip the free space check when importing media files.

Default: false

nixflix.radarr.config.mediaManagement.useScriptImport Link copied!

Type: boolean

Use a custom script for importing instead of the built-in import.

Default: false

nixflix.radarr.config.rootFolders Link copied!

Type: list of (attribute set)

List of root folders to create via the API /rootfolder endpoint. Each folder is an attribute set that will be converted to JSON and sent to the API.

For Sonarr/Radarr, a simple path is sufficient: {path = "/path/to/folder";}

For Lidarr, additional fields are required like defaultQualityProfileId, etc.

Default: map (mediaDir: {path = mediaDir;}) nixflix.radarr.mediaDirs

nixflix.radarr.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.radarr.dataDir Link copied!

Type: absolute path

Directory containing Seerr data and configuration

Default: "${config.nixflix.stateDir}/${serviceName}"

nixflix.radarr.enable Link copied!

Type: boolean

Whether to enable Radarr.

Default: false
Example: true

nixflix.radarr.group Link copied!

Type: string

Group under which the service runs

Default: "radarr"

nixflix.radarr.mediaDirs Link copied!

Type: list of absolute path

List of media directories to create and manage

Default: [config.nixflix.mediaDir + "/<media-type>"]

nixflix.radarr.openFirewall Link copied!

Type: boolean

Open ports in the firewall for the Radarr web interface.

Default: false

nixflix.radarr.package Link copied!

Type: package

The radarr package to use.

Default: pkgs.radarr

nixflix.radarr.reverseProxy.expose Link copied!

Type: boolean

Whether to expose this service via the reverse proxy.

Default: true

nixflix.radarr.settings Link copied!

Type: open submodule of attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))

Attribute set of arbitrary config options. Please consult the documentation at the wiki.

!!! warning

This configuration is stored in the world-readable Nix store!
Don't put secrets here!
Default: { auth = { required = "Enabled"; method = "Forms"; }; server = { inherit (config.nixflix.radarr.config.hostConfig) port urlBase; }; } // optionalAttrs config.nixflix.postgres.enable { log.dbEnabled = true; postgres = { user = config.nixflix.radarr.user; host = "/run/postgresql"; port = config.services.postgresql.settings.port; mainDb = config.nixflix.radarr.user; logDb = "${config.nixflix.radarr.user}-logs"; }; }
Example:
{
  update.mechanism = "internal";
  server = {
    urlbase = "localhost";
    port = 8989;
    bindaddress = "*";
  };
}

nixflix.radarr.settings.app.instanceName Link copied!

Type: string

Name of the instance

Default: "Radarr"

nixflix.radarr.settings.log.analyticsEnabled Link copied!

Type: boolean

Send Anonymous Usage Data

Default: false

nixflix.radarr.settings.server.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port Number

nixflix.radarr.settings.update.automatically Link copied!

Type: boolean

Automatically download and install updates.

Default: false

nixflix.radarr.settings.update.mechanism Link copied!

Type: null or one of "external", "builtIn", "script"

which update mechanism to use

Default: "external"

nixflix.radarr.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy. Service accessible at <subdomain>.<domain>.

Default: "radarr"

nixflix.radarr.user Link copied!

Type: string

User under which the service runs

Default: "radarr"

nixflix.radarr.vpn.enable Link copied!

Type: boolean

Whether to route Radarr traffic through the VPN.

When false (default), Radarr bypasses the VPN to prevent Cloudflare and image provider blocks. When true, Radarr routes through the VPN (requires nixflix.vpn.enable = true).

TRaSH Guides recommend leaving this false.

Default: false

nixflix.recyclarr.cleanupUnmanagedProfiles.enable Link copied!

Type: boolean

Whether to automatically remove quality profiles from Sonarr and Radarr that are are unmanaged.

Default: false

nixflix.recyclarr.cleanupUnmanagedProfiles.managedProfiles Link copied!

Type: list of string

List of profiles to keep.

This list must be manually maintained if you change the default Recyclarr configuration.

Default: optional (cfg.radarrQuality == "4K") "[SQP] SQP-1 (2160p)" ++ optional (cfg.radarrQuality == "1080p") "[SQP] SQP-1 (1080p)" ++ optional (cfg.sonarrQuality == "4K") "WEB-2160p (Alternative)" ++ optional (cfg.sonarrQuality == "1080p") "WEB-1080p (Alternative)" ++ optional config.nixflix.sonarr-anime.enable "[Anime] Remux-1080p";
Example:
[
  "My Custom Profile"
]

nixflix.recyclarr.config Link copied!

Type: null or (submodule)

Recyclarr configuration as a structured Nix attribute set. When set, this completely replaces the auto-generated configuration, giving you full control over the Recyclarr setup.

The structure is: { service_type.instance_name = { ... }; }

  • service_type: sonarr or radarr (only these two keys are allowed)
  • instance_name: arbitrary name for the instance (e.g., sonarr_main, radarr_4k)

Defaults are sonarr.sonarr, sonarr.sonarr_anime, and radarr.radarr.

Each instance supports guide-backed quality profiles (via trash_id) or user-defined ones (via name), custom formats and custom format groups from TRaSH guides, media naming, media management (e.g. Propers and Repacks handling), and template/file includes.

Config Reference

Default: "Generated from `nixflix.sonarr`, `nixflix.sonarr-anime`, and `nixflix.radarr` settings"
Example:
{
  sonarr.sonarr_main = {
    base_url = "http://127.0.0.1:8989";
    api_key._secret = "/run/credentials/recyclarr.service/sonarr-api_key";
    quality_definition.type = "series";
    quality_profiles = [{
      trash_id = "dfa5eaae7894077ad6449169b6eb03e0"; # WEB-2160p (Alternative)
      reset_unmatched_scores.enabled = true;
    }];
    custom_format_groups.add = [{
      trash_id = "e3f37512790f00d0e89e54fe5e790d1c"; # [Required] Golden Rule UHD
      select = [ "9b64dff695c2115facf1b6ea59c9bd07" ]; # x265 (no HDR/DV)
    }];
  };
  radarr.radarr_main = {
    base_url = "http://127.0.0.1:7878";
    api_key._secret = "/run/credentials/recyclarr.service/radarr-api_key";
    quality_definition.type = "movie";
    media_management.propers_and_repacks = "do_not_prefer";
  };
}

nixflix.recyclarr.config.radarr Link copied!

Type: null or (attribute set of (submodule))

Radarr instance configurations

Default: null

nixflix.recyclarr.config.radarr.<name>.api_key Link copied!

Type: string or (submodule)

The API key that Recyclarr should use to synchronize settings to your instance.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.recyclarr.config.radarr.<name>.base_url Link copied!

Type: string

The base URL of your instance. Basically this is the URL you bookmark to get to the front page.

Example: "http://127.0.0.1:8989"

nixflix.recyclarr.config.radarr.<name>.custom_format_groups Link copied!

Type: null or (submodule)

Controls which custom format groups synchronize from the TRaSH Guides. Groups marked default: true in the guide are automatically synced when using guide-backed quality profiles. Use skip to opt out of defaults or add to opt in to non-default groups.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_format_groups.add Link copied!

Type: list of (submodule)

Groups to explicitly synchronize. Use this to customize default group behavior or opt in to non-default groups.

Default: [ ]

nixflix.recyclarr.config.radarr.<name>.custom_format_groups.add.*.assign_scores_to Link copied!

Type: null or (list of (submodule))

Quality profiles to receive scores from this group. If omitted, scores are assigned to all applicable guide-backed profiles.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_format_groups.add.*.exclude Link copied!

Type: null or (list of string)

Trash IDs of custom formats to remove from the synced set. Required CFs cannot be excluded.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_format_groups.add.*.select Link copied!

Type: null or (list of string)

Non-default custom formats to include alongside defaults. Mutually exclusive with select_all.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_format_groups.add.*.select_all Link copied!

Type: null or boolean

When true, all non-required custom formats in the group are included. Mutually exclusive with select.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_format_groups.skip Link copied!

Type: null or (list of string)

Trash IDs of groups to exclude from auto-sync.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_formats Link copied!

Type: list of (submodule)

Sets of custom formats with optional quality profile assignments for score application.

Default: [ ]

nixflix.recyclarr.config.radarr.<name>.custom_formats.*.assign_scores_to Link copied!

Type: list of (submodule)

Quality profiles to receive scores from these custom formats.

Default: [ ]

nixflix.recyclarr.config.radarr.<name>.custom_formats.*.assign_scores_to.*.name Link copied!

Type: null or string

The name of the quality profile. Works for both guide-backed and user-defined profiles.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_formats.*.assign_scores_to.*.score Link copied!

Type: null or signed integer

Score override applied to all custom formats in this list. Omit to use guide default scores.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_formats.*.assign_scores_to.*.trash_id Link copied!

Type: null or string

The trash ID of a guide-backed quality profile. Remains stable across guide updates.

Default: null

nixflix.recyclarr.config.radarr.<name>.custom_formats.*.trash_ids Link copied!

Type: list of string

Trash IDs of the custom formats to synchronize.

Default: [ ]
Example:
[
  "85c61753df5da1fb2aab6f2a47426b09"
]

nixflix.recyclarr.config.radarr.<name>.delete_old_custom_formats Link copied!

Type: boolean

If enabled, custom formats that you remove from your configuration or that are removed from the guide will be deleted from the service. Only applies to formats Recyclarr synchronized; manually added formats are preserved.

Default: false

nixflix.recyclarr.config.radarr.<name>.include Link copied!

Type: list of (submodule)

A sequence of include directives to merge into this instance. Each entry must set exactly one of template or config.

Default: [ ]

nixflix.recyclarr.config.radarr.<name>.include.*.config Link copied!

Type: null or string

An absolute or relative path to the YAML file to include. Relative paths resolve from the includes directory in the Recyclarr app data folder.

Default: null

nixflix.recyclarr.config.radarr.<name>.include.*.template Link copied!

Type: null or string

The ID of an include template from a resource provider. As of Recyclarr v8 the official repository no longer ships any include templates, so this only works with a custom resource provider or user-supplied local includes.

Default: null

nixflix.recyclarr.config.radarr.<name>.media_management Link copied!

Type: null or (submodule)

Media management settings.

Default: null

nixflix.recyclarr.config.radarr.<name>.media_management.propers_and_repacks Link copied!

Type: null or one of "prefer_and_upgrade", "do_not_upgrade", "do_not_prefer"

Controls how Sonarr/Radarr handles Propers and Repacks. This corresponds to the 'Propers and Repacks' dropdown in the Media Management settings.

Default: null

nixflix.recyclarr.config.radarr.<name>.media_naming Link copied!

Type: null or (submodule)

Media naming configuration.

Use 'default' or 'standard' to apply TRaSH guide recommendations.

Default: null

nixflix.recyclarr.config.radarr.<name>.media_naming.folder Link copied!

Type: null or string

A naming format taken from the 'Key' column of the 'Movie Folder Format' table.

Default: null

nixflix.recyclarr.config.radarr.<name>.media_naming.movie Link copied!

Type: null or (submodule)

Movie file naming configuration.

Default: null

nixflix.recyclarr.config.radarr.<name>.media_naming.movie.rename Link copied!

Type: boolean

Enables the 'Rename Movies' checkbox when set to true.

Default: true

nixflix.recyclarr.config.radarr.<name>.media_naming.movie.standard Link copied!

Type: null or string

A naming format taken from the 'Key' column of the 'Standard Movie Format' table.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition Link copied!

Type: null or (submodule)

Control the minimum, maximum, and preferred file sizes for each quality level.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition.preferred_ratio Link copied!

Type: null or integer or floating point number between 0.0 and 1.0 (both inclusive)

A value 0.0 to 1.0 that represents the percentage (interpolated) position of the preferred quality slider between minimum and maximum. Values outside the range are clamped with a warning. Has no effect on Sonarr v3.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition.qualities Link copied!

Type: null or (list of (submodule))

Override size limits for specific qualities while retaining guide defaults for others. Constraint: min ≤ preferred ≤ max.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition.qualities.*.max Link copied!

Type: null or nonnegative integer or floating point number, meaning >=0, or value "unlimited" (singular enum)

Maximum size in MB per minute of runtime, or "unlimited".

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition.qualities.*.min Link copied!

Type: null or (nonnegative integer or floating point number, meaning >=0)

Minimum size in MB per minute of runtime.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition.qualities.*.name Link copied!

Type: string

The name of a quality to override. Must exist in the guide (case-insensitive).

Example: "Bluray-1080p"

nixflix.recyclarr.config.radarr.<name>.quality_definition.qualities.*.preferred Link copied!

Type: null or nonnegative integer or floating point number, meaning >=0, or value "unlimited" (singular enum)

Preferred size in MB per minute of runtime, or "unlimited".

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_definition.type Link copied!

Type: one of "movie", "anime", "sqp-streaming", "sqp-uhd"

Identifies which quality size settings to parse and upload.

nixflix.recyclarr.config.radarr.<name>.quality_profiles Link copied!

Type: list of (submodule)

An array of quality profiles that Recyclarr should create or modify.

Prefer setting trash_id to use a guide-backed profile — qualities, custom formats, scores, and language will be configured automatically from the TRaSH Guides. For user-defined profiles, set name along with qualities and other fields.

Default: [ ]

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.min_format_score Link copied!

Type: null or signed integer

Correlates directly to the 'Minimum Custom Format Score' field in the Quality Profile edit dialog in Radarr/Sonarr.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.min_upgrade_format_score Link copied!

Type: null or signed integer

Correlates directly to the 'Minimum Custom Format Score For Upgrades' field in the Quality Profile edit dialog in Radarr/Sonarr.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.name Link copied!

Type: null or string

The name of the quality profile. For guide-backed profiles (with trash_id), this defaults to the guide's recommended name and may be overridden. For user-defined profiles, this is the profile identity. Either trash_id or name is required.

Default: null
Example: "WEB-2160p"

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.qualities Link copied!

Type: null or (list of (submodule))

Ordered list of qualities in the profile (from highest to lowest priority).

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.qualities.*.enabled Link copied!

Type: boolean

If true, this quality will be allowed. If false, this quality will be disallowed.

Default: true

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.qualities.*.name Link copied!

Type: string

The name of an existing quality. If this is a quality group, this name identifies either an existing quality group or will be used as the name for a newly created group.

Example: "WEB 2160p"

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.qualities.*.qualities Link copied!

Type: null or (list of string)

A list of one or more existing qualities to bundle into a group. By specifying this list, you implicitly make this item a quality group.

Default: null
Example:
[
  "WEBDL-2160p"
  "WEBRip-2160p"
]

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.quality_sort Link copied!

Type: null or one of "top", "bottom"

Controls which direction specified qualities are sorted. top sorts them to the top of the list; bottom sorts them to the bottom.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.reset_unmatched_scores Link copied!

Type: null or (submodule)

Configuration for resetting unmatched custom format scores.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.reset_unmatched_scores.enabled Link copied!

Type: boolean

If true, custom format scores not managed by Recyclarr are set to 0. If false, scores are only altered when listed in trash_ids with a valid score.

Default: true

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.reset_unmatched_scores.except Link copied!

Type: null or (list of string)

A list of one or more custom format names to exclude from score resets. Names must match exactly (case-sensitive).

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.reset_unmatched_scores.except_patterns Link copied!

Type: null or (list of string)

A list of one or more regular expression patterns used to exclude custom formats from score resets. Matching is case-insensitive.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.score_set Link copied!

Type: null or string

A string (name) that determines the guide-provided, preset scores to use across all custom formats assigned to a quality profile.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.trash_id Link copied!

Type: null or string

The trash ID of a TRaSH Guide quality profile definition.

Default: null
Example: "0896c29d74de619df168d23b98104b22"

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.upgrade Link copied!

Type: null or (submodule)

Upgrade configuration for the quality profile.

Default: null

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.upgrade.allowed Link copied!

Type: boolean

Directly correlates to the 'Upgrades Allowed' checkbox in the Quality Profile edit dialog in Radarr/Sonarr.

Default: true

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.upgrade.until_quality Link copied!

Type: null or string

The quality name mentioned here must exist in the qualities list or be a valid quality in your profile.

Default: null
Example: "WEB 2160p"

nixflix.recyclarr.config.radarr.<name>.quality_profiles.*.upgrade.until_score Link copied!

Type: null or signed integer

Correlates directly to the 'Upgrade Until Custom Format Score' field in the Quality Profile edit dialog.

Default: null

nixflix.recyclarr.config.sonarr Link copied!

Type: null or (attribute set of (submodule))

Sonarr instance configurations

Default: null

nixflix.recyclarr.config.sonarr.<name>.api_key Link copied!

Type: string or (submodule)

The API key that Recyclarr should use to synchronize settings to your instance.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.recyclarr.config.sonarr.<name>.base_url Link copied!

Type: string

The base URL of your instance. Basically this is the URL you bookmark to get to the front page.

Example: "http://127.0.0.1:8989"

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups Link copied!

Type: null or (submodule)

Controls which custom format groups synchronize from the TRaSH Guides. Groups marked default: true in the guide are automatically synced when using guide-backed quality profiles. Use skip to opt out of defaults or add to opt in to non-default groups.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups.add Link copied!

Type: list of (submodule)

Groups to explicitly synchronize. Use this to customize default group behavior or opt in to non-default groups.

Default: [ ]

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups.add.*.assign_scores_to Link copied!

Type: null or (list of (submodule))

Quality profiles to receive scores from this group. If omitted, scores are assigned to all applicable guide-backed profiles.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups.add.*.exclude Link copied!

Type: null or (list of string)

Trash IDs of custom formats to remove from the synced set. Required CFs cannot be excluded.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups.add.*.select Link copied!

Type: null or (list of string)

Non-default custom formats to include alongside defaults. Mutually exclusive with select_all.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups.add.*.select_all Link copied!

Type: null or boolean

When true, all non-required custom formats in the group are included. Mutually exclusive with select.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_format_groups.skip Link copied!

Type: null or (list of string)

Trash IDs of groups to exclude from auto-sync.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_formats Link copied!

Type: list of (submodule)

Sets of custom formats with optional quality profile assignments for score application.

Default: [ ]

nixflix.recyclarr.config.sonarr.<name>.custom_formats.*.assign_scores_to Link copied!

Type: list of (submodule)

Quality profiles to receive scores from these custom formats.

Default: [ ]

nixflix.recyclarr.config.sonarr.<name>.custom_formats.*.assign_scores_to.*.name Link copied!

Type: null or string

The name of the quality profile. Works for both guide-backed and user-defined profiles.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_formats.*.assign_scores_to.*.score Link copied!

Type: null or signed integer

Score override applied to all custom formats in this list. Omit to use guide default scores.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_formats.*.assign_scores_to.*.trash_id Link copied!

Type: null or string

The trash ID of a guide-backed quality profile. Remains stable across guide updates.

Default: null

nixflix.recyclarr.config.sonarr.<name>.custom_formats.*.trash_ids Link copied!

Type: list of string

Trash IDs of the custom formats to synchronize.

Default: [ ]
Example:
[
  "85c61753df5da1fb2aab6f2a47426b09"
]

nixflix.recyclarr.config.sonarr.<name>.delete_old_custom_formats Link copied!

Type: boolean

If enabled, custom formats that you remove from your configuration or that are removed from the guide will be deleted from the service. Only applies to formats Recyclarr synchronized; manually added formats are preserved.

Default: false

nixflix.recyclarr.config.sonarr.<name>.include Link copied!

Type: list of (submodule)

A sequence of include directives to merge into this instance. Each entry must set exactly one of template or config.

Default: [ ]

nixflix.recyclarr.config.sonarr.<name>.include.*.config Link copied!

Type: null or string

An absolute or relative path to the YAML file to include. Relative paths resolve from the includes directory in the Recyclarr app data folder.

Default: null

nixflix.recyclarr.config.sonarr.<name>.include.*.template Link copied!

Type: null or string

The ID of an include template from a resource provider. As of Recyclarr v8 the official repository no longer ships any include templates, so this only works with a custom resource provider or user-supplied local includes.

Default: null

nixflix.recyclarr.config.sonarr.<name>.media_management Link copied!

Type: null or (submodule)

Media management settings.

Default: null

nixflix.recyclarr.config.sonarr.<name>.media_management.propers_and_repacks Link copied!

Type: null or one of "prefer_and_upgrade", "do_not_upgrade", "do_not_prefer"

Controls how Sonarr/Radarr handles Propers and Repacks. This corresponds to the 'Propers and Repacks' dropdown in the Media Management settings.

Default: null

nixflix.recyclarr.config.sonarr.<name>.media_naming Link copied!

Type: null or (submodule)

Media naming configuration.

Use 'default' or 'standard' to apply TRaSH guide recommendations.

Default: null

nixflix.recyclarr.config.sonarr.<name>.media_naming.episodes Link copied!

Type: null or (submodule)

Episode file naming configuration.

Default: null

nixflix.recyclarr.config.sonarr.<name>.media_naming.episodes.rename Link copied!

Type: boolean

Enables the 'Rename Episodes' checkbox when set to true.

Default: true

nixflix.recyclarr.config.sonarr.<name>.media_naming.season Link copied!

Type: null or string

A naming format taken from the 'Key' column of the 'Season Folder Format' table.

Default: null

nixflix.recyclarr.config.sonarr.<name>.media_naming.series Link copied!

Type: null or string

A naming format taken from the 'Key' column of the 'Series Folder Format' table.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition Link copied!

Type: null or (submodule)

Control the minimum, maximum, and preferred file sizes for each quality level.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition.preferred_ratio Link copied!

Type: null or integer or floating point number between 0.0 and 1.0 (both inclusive)

A value 0.0 to 1.0 that represents the percentage (interpolated) position of the preferred quality slider between minimum and maximum. Values outside the range are clamped with a warning. Has no effect on Sonarr v3.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition.qualities Link copied!

Type: null or (list of (submodule))

Override size limits for specific qualities while retaining guide defaults for others. Constraint: min ≤ preferred ≤ max.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition.qualities.*.max Link copied!

Type: null or nonnegative integer or floating point number, meaning >=0, or value "unlimited" (singular enum)

Maximum size in MB per minute of runtime, or "unlimited".

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition.qualities.*.min Link copied!

Type: null or (nonnegative integer or floating point number, meaning >=0)

Minimum size in MB per minute of runtime.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition.qualities.*.name Link copied!

Type: string

The name of a quality to override. Must exist in the guide (case-insensitive).

Example: "Bluray-1080p"

nixflix.recyclarr.config.sonarr.<name>.quality_definition.qualities.*.preferred Link copied!

Type: null or nonnegative integer or floating point number, meaning >=0, or value "unlimited" (singular enum)

Preferred size in MB per minute of runtime, or "unlimited".

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_definition.type Link copied!

Type: one of "series", "anime"

Identifies which quality size settings to parse and upload.

nixflix.recyclarr.config.sonarr.<name>.quality_profiles Link copied!

Type: list of (submodule)

An array of quality profiles that Recyclarr should create or modify.

Prefer setting trash_id to use a guide-backed profile — qualities, custom formats, scores, and language will be configured automatically from the TRaSH Guides. For user-defined profiles, set name along with qualities and other fields.

Default: [ ]

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.min_format_score Link copied!

Type: null or signed integer

Correlates directly to the 'Minimum Custom Format Score' field in the Quality Profile edit dialog in Radarr/Sonarr.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.min_upgrade_format_score Link copied!

Type: null or signed integer

Correlates directly to the 'Minimum Custom Format Score For Upgrades' field in the Quality Profile edit dialog in Radarr/Sonarr.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.name Link copied!

Type: null or string

The name of the quality profile. For guide-backed profiles (with trash_id), this defaults to the guide's recommended name and may be overridden. For user-defined profiles, this is the profile identity. Either trash_id or name is required.

Default: null
Example: "WEB-2160p"

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.qualities Link copied!

Type: null or (list of (submodule))

Ordered list of qualities in the profile (from highest to lowest priority).

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.qualities.*.enabled Link copied!

Type: boolean

If true, this quality will be allowed. If false, this quality will be disallowed.

Default: true

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.qualities.*.name Link copied!

Type: string

The name of an existing quality. If this is a quality group, this name identifies either an existing quality group or will be used as the name for a newly created group.

Example: "WEB 2160p"

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.qualities.*.qualities Link copied!

Type: null or (list of string)

A list of one or more existing qualities to bundle into a group. By specifying this list, you implicitly make this item a quality group.

Default: null
Example:
[
  "WEBDL-2160p"
  "WEBRip-2160p"
]

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.quality_sort Link copied!

Type: null or one of "top", "bottom"

Controls which direction specified qualities are sorted. top sorts them to the top of the list; bottom sorts them to the bottom.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.reset_unmatched_scores Link copied!

Type: null or (submodule)

Configuration for resetting unmatched custom format scores.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.reset_unmatched_scores.enabled Link copied!

Type: boolean

If true, custom format scores not managed by Recyclarr are set to 0. If false, scores are only altered when listed in trash_ids with a valid score.

Default: true

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.reset_unmatched_scores.except Link copied!

Type: null or (list of string)

A list of one or more custom format names to exclude from score resets. Names must match exactly (case-sensitive).

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.reset_unmatched_scores.except_patterns Link copied!

Type: null or (list of string)

A list of one or more regular expression patterns used to exclude custom formats from score resets. Matching is case-insensitive.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.score_set Link copied!

Type: null or string

A string (name) that determines the guide-provided, preset scores to use across all custom formats assigned to a quality profile.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.trash_id Link copied!

Type: null or string

The trash ID of a TRaSH Guide quality profile definition.

Default: null
Example: "0896c29d74de619df168d23b98104b22"

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.upgrade Link copied!

Type: null or (submodule)

Upgrade configuration for the quality profile.

Default: null

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.upgrade.allowed Link copied!

Type: boolean

Directly correlates to the 'Upgrades Allowed' checkbox in the Quality Profile edit dialog in Radarr/Sonarr.

Default: true

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.upgrade.until_quality Link copied!

Type: null or string

The quality name mentioned here must exist in the qualities list or be a valid quality in your profile.

Default: null
Example: "WEB 2160p"

nixflix.recyclarr.config.sonarr.<name>.quality_profiles.*.upgrade.until_score Link copied!

Type: null or signed integer

Correlates directly to the 'Upgrade Until Custom Format Score' field in the Quality Profile edit dialog.

Default: null

nixflix.recyclarr.enable Link copied!

Type: boolean

Whether to enable Recyclarr for automated TRaSH guide syncing.

Default configurations select profiles that prioritize acquisition over quality. Lower quality hits that meet TRaSH standards will be accepted and grabbed.

Default: false

nixflix.recyclarr.group Link copied!

Type: string

Group under which Recyclarr runs.

Default: "recyclarr"

nixflix.recyclarr.radarrQuality Link copied!

Type: one of "4K", "1080p"

Allows for easy recyclarr quality profile configuration for the radarr instance.

This option selects profiles that prioritize acquisition over quality. Lower quality hits that meet TRaSH standards will be accepted and grabbed.

  • 4k creates a profile named "[SQP] SQP-1 (2160p)"
  • 1080p creates a profile named "[SQP] SQP-1 (1080p)"

If you want Seerr to use these, you'll have to configure them manually.

Complex configurations can be manually applied using nixflix.recyclarr.config.radarr.radarr. If you do, you need to set nixflix.recyclarr.config.radarr.radarr.quality_profiles = mkForce [];.

Default: "1080p"
Example: "4K"

nixflix.recyclarr.sonarrQuality Link copied!

Type: one of "4K", "1080p"

Allows for easy recyclarr quality profile configuration for the sonarr instance. Does not effect Sonarr Anime.

This option selects profiles that prioritize acquisition over quality. Lower quality hits that meet TRaSH standards will be accepted and grabbed.

  • 4k creates a quality profile named "WEB-2160p (Alternative)"
  • 1080p creates a quality profile named "WEB-1080p (Alternative)"

If you want Seerr to use these, you'll have to configure them manually.

Complex configurations can be manually applied using nixflix.recyclarr.config.sonarr.sonarr. If you do, you need to set nixflix.recyclarr.config.sonarr.sonarr.quality_profiles = mkForce [];.

Default: "1080p"
Example: "4K"

nixflix.recyclarr.user Link copied!

Type: string

User under which Recyclarr runs.

Default: "recyclarr"

nixflix.seerr.apiKey Link copied!

Type: string or (submodule)

API key for Seerr. Can be created with:

uuidgen | base64

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.seerr.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.seerr.dataDir Link copied!

Type: absolute path

Directory containing Seerr data and configuration

Default: "${nixflix.stateDir}/seerr"

nixflix.seerr.enable Link copied!

Type: boolean

Whether to enable Seerr media request manager.

Default: false
Example: true

nixflix.seerr.externalUrlScheme Link copied!

Type: string

Scheme to use for external linking to other services from within Seerr.

Default: "http"
Example: "https"

nixflix.seerr.group Link copied!

Type: string

Group under which the service runs

Default: "seerr"

nixflix.seerr.jellyfin.adminPassword Link copied!

Type: string or (submodule)

Jellyfin admin password for Seerr authentication.

Auto-derived from nixflix.jellyfin.users when Jellyfin is enabled locally. Must be set explicitly when using a remote Jellyfin instance.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: password of first admin from nixflix.jellyfin.users, or null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.seerr.jellyfin.adminUsername Link copied!

Type: null or string

Jellyfin admin username for Seerr authentication.

Auto-derived from nixflix.jellyfin.users when Jellyfin is enabled locally. Must be set explicitly when using a remote Jellyfin instance.

Default: first admin username from nixflix.jellyfin.users, or null

nixflix.seerr.jellyfin.enableAllLibraries Link copied!

Type: boolean

Enable all Jellyfin libraries (fetched from API). Set to false to use libraryFilter.

Default: true

nixflix.seerr.jellyfin.externalHostname Link copied!

Type: string

This option has no description.

Default: if config.nixflix.reverseProxy.enable != "" then "$${config.nixflix.seerr.externalUrlScheme}://$${config.nixflix.jellyfin.subdomain}.$${config.nixflix.reverseProxy.domain}" else "";

nixflix.seerr.jellyfin.hostname Link copied!

Type: string

Jellyfin server hostname

Default: config.nixflix.jellyfin.connectionAddress

nixflix.seerr.jellyfin.libraryFilter Link copied!

Type: submodule

Filter which libraries to enable (only used when enableAllLibraries = false)

Default: { }

nixflix.seerr.jellyfin.libraryFilter.names Link copied!

Type: list of string

Only enable libraries matching these names (empty = all names)

Default: [ ]
Example:
[
  "Movies"
  "TV Shows"
]

nixflix.seerr.jellyfin.libraryFilter.types Link copied!

Type: list of (one of "movie", "show")

Only enable libraries of these types (empty = all types)

Default: [ ]
Example:
[
  "movie"
  "show"
]

nixflix.seerr.jellyfin.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Jellyfin server port

Default: config.nixflix.jellyfin.network.internalHttpPort

nixflix.seerr.jellyfin.serverType Link copied!

Type: signed integer

Server type (2 = Jellyfin)

Default: 2

nixflix.seerr.jellyfin.useSsl Link copied!

Type: boolean

Use SSL to connect to Jellyfin

Default: false

nixflix.seerr.openFirewall Link copied!

Type: boolean

Open port in firewall for Seerr

Default: false

nixflix.seerr.package Link copied!

Type: package

The seerr package to use.

Default: pkgs.seerr

nixflix.seerr.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port on which Seerr listens

Default: 5055

nixflix.seerr.radarr Link copied!

Type: attribute set of (submodule)

Radarr instances to configure. Automatically configured from config.nixflix.radarr when enabled, otherwise {}.

Default instances can be overridden with lib.mkForce {}.

Default: { }
Example:
{
  Radarr = {
    activeDirectory = "/movies";
    activeProfileName = "HD-1080p";
    apiKey = {
      _secret = "/run/secrets/radarr-apikey";
    };
  };
  "Radarr 4K" = {
    activeDirectory = "/movies-4k";
    activeProfileName = "UHD-2160p";
    apiKey = {
      _secret = "/run/secrets/radarr-4k-apikey";
    };
    is4k = true;
  };
}

nixflix.seerr.radarr.<name>.activeDirectory Link copied!

Type: string

Root folder for movies

Default: head (config.nixflix.radarr.mediaDirs or ["/movies"])

nixflix.seerr.radarr.<name>.activeProfileName Link copied!

Type: null or string

Quality profile name. Defaults to first available quality profile in Seerr.

Default: null

nixflix.seerr.radarr.<name>.apiKey Link copied!

Type: string or (submodule)

Radarr API key.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.seerr.radarr.<name>.baseUrl Link copied!

Type: string

Radarr URL base

Default: ""
Example: "/radarr"

nixflix.seerr.radarr.<name>.is4k Link copied!

Type: boolean

Is this a 4K Radarr instance

Default: false

nixflix.seerr.radarr.<name>.isDefault Link copied!

Type: boolean

Is this the default Radarr instance

Default: false

nixflix.seerr.radarr.<name>.minimumAvailability Link copied!

Type: one of "announced", "inCinemas", "released"

Minimum availability for movies

Default: "released"

nixflix.seerr.radarr.<name>.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Radarr port

Default: 7878

nixflix.seerr.radarr.<name>.preventSearch Link copied!

Type: boolean

Prevent Seerr from triggering searches

Default: false

nixflix.seerr.radarr.<name>.syncEnabled Link copied!

Type: boolean

Enable automatic sync with Radarr

Default: false

nixflix.seerr.radarr.<name>.useSsl Link copied!

Type: boolean

Use SSL to connect to Radarr

Default: false

nixflix.seerr.reverseProxy.expose Link copied!

Type: boolean

Whether to expose Seerr via the reverse proxy.

Default: true

nixflix.seerr.settings.users Link copied!

Type: submodule

Default user settings for Seerr (authentication, permissions, and quotas)

Default: { localLogin = true; mediaServerLogin = true; newPlexLogin = true; defaultPermissions = 32; defaultQuotas = { movie = { quotaLimit = 0; quotaDays = 7; }; tv = { quotaLimit = 0; quotaDays = 7; }; }; }

nixflix.seerr.settings.users.defaultPermissions Link copied!

Type: signed integer

Default permission flags for newly created users. Common values: 0 (none), 32 (REQUEST - default), 1024 (ADMIN), 160 (Auto-approve non-4k)

Default: 32

nixflix.seerr.settings.users.defaultQuotas Link copied!

Type: submodule

Default request quotas for new users

Default: { }

nixflix.seerr.settings.users.defaultQuotas.movie Link copied!

Type: submodule

This option has no description.

Default: { }

nixflix.seerr.settings.users.defaultQuotas.movie.quotaDays Link copied!

Type: positive integer, meaning >0

Quota period in days

Default: 7

nixflix.seerr.settings.users.defaultQuotas.movie.quotaLimit Link copied!

Type: unsigned integer, meaning >=0

Max movie requests per period (0 = unlimited)

Default: 0

nixflix.seerr.settings.users.defaultQuotas.tv Link copied!

Type: submodule

This option has no description.

Default: { }

nixflix.seerr.settings.users.defaultQuotas.tv.quotaDays Link copied!

Type: positive integer, meaning >0

Quota period in days

Default: 7

nixflix.seerr.settings.users.defaultQuotas.tv.quotaLimit Link copied!

Type: unsigned integer, meaning >=0

Max TV requests per period (0 = unlimited)

Default: 0

nixflix.seerr.settings.users.localLogin Link copied!

Type: boolean

Enable local account authentication independent of Jellyfin/Plex

Default: true

nixflix.seerr.settings.users.mediaServerLogin Link copied!

Type: boolean

Enable authentication via connected media server (Jellyfin/Plex)

Default: true

nixflix.seerr.settings.users.newPlexLogin Link copied!

Type: boolean

Allow new Plex users to authenticate and create accounts

Default: true

nixflix.seerr.sonarr Link copied!

Type: attribute set of (submodule)

Sonarr instances to configure. Automatically configured from config.nixflix.sonarr and config.nixflix.sonarr-anime when enabled, otherwise {}.

Default instances can be overridden with lib.mkForce {}.

Default: { }
Example:
{
  Sonarr = {
    activeDirectory = "/tv";
    activeProfileName = "WEB-1080p";
    port = 8989;
  };
  "Sonarr Anime" = {
    activeDirectory = "/anime";
    activeProfileName = "Remux-1080p - Anime";
    port = 8990;
  };
}

nixflix.seerr.sonarr.<name>.activeAnimeProfileName Link copied!

Type: null or string

Anime quality profile name.

Default: null

nixflix.seerr.sonarr.<name>.activeDirectory Link copied!

Type: string

Root folder for TV shows

Default: head (config.nixflix.sonarr.mediaDirs or ["/tv"])

nixflix.seerr.sonarr.<name>.activeProfileName Link copied!

Type: null or string

Quality profile name. Defaults to first available quality profile in Seerr.

Default: null

nixflix.seerr.sonarr.<name>.animeSeriesType Link copied!

Type: one of "standard", "anime"

Series type for anime content

Default: "standard"

nixflix.seerr.sonarr.<name>.apiKey Link copied!

Type: string or (submodule)

Sonarr API key.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.seerr.sonarr.<name>.baseUrl Link copied!

Type: string

Sonarr URL base

Default: ""
Example: "/sonarr"

nixflix.seerr.sonarr.<name>.is4k Link copied!

Type: boolean

Is this a 4K Sonarr instance

Default: false

nixflix.seerr.sonarr.<name>.isDefault Link copied!

Type: boolean

Is this the default Sonarr instance

Default: false

nixflix.seerr.sonarr.<name>.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Sonarr port

Default: 8989

nixflix.seerr.sonarr.<name>.preventSearch Link copied!

Type: boolean

Prevent Seerr from triggering searches

Default: false

nixflix.seerr.sonarr.<name>.seriesType Link copied!

Type: one of "standard", "daily"

Series type for regular content

Default: "standard"

nixflix.seerr.sonarr.<name>.syncEnabled Link copied!

Type: boolean

Enable automatic sync with Sonarr

Default: false

nixflix.seerr.sonarr.<name>.useSsl Link copied!

Type: boolean

Use SSL to connect to Sonarr

Default: false

nixflix.seerr.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy.

Default: "seerr"

nixflix.seerr.user Link copied!

Type: string

User under which the service runs

Default: "seerr"

nixflix.seerr.vpn.enable Link copied!

Type: boolean

Whether to route Seerr traffic through the VPN.

When false, Seerr bypasses the VPN. When true, Seerr is confined to the WireGuard network namespace (requires nixflix.vpn.enable = true).

Default: config.nixflix.vpn.enable

nixflix.serviceDependencies Link copied!

Type: list of string

List of systemd services that nixflix services should wait for before starting. Useful for mounting encrypted drives, starting VPNs, or other prerequisites.

Default: [ ]
Example:
[
  "unlock-raid.service"
  "tailscale.service"
]

nixflix.sonarr-anime.config.apiKey Link copied!

Type: string or (submodule)

API key for Sonarr-anime. Can be created by running:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr-anime.config.apiVersion Link copied!

Type: string

Current version of the API of the service

Default: "v3"

nixflix.sonarr-anime.config.delayProfiles Link copied!

Type: list of (submodule)

List of delay profiles to configure via the API /delayprofile endpoint.

Profiles are created/updated in id order. If no profile with id=1 is provided, a default profile will be added automatically.

Default: [ { enableUsenet = true; enableTorrent = true; preferredProtocol = "usenet"; usenetDelay = 0; torrentDelay = 0; bypassIfHighestQuality = true; bypassIfAboveCustomFormatScore = false; minimumCustomFormatScore = 0; order = 2147483647; tags = []; id = 1; }; ]

nixflix.sonarr-anime.config.delayProfiles.*.bypassIfAboveCustomFormatScore Link copied!

Type: boolean

Bypass delay if custom format score is above minimum

Default: false

nixflix.sonarr-anime.config.delayProfiles.*.bypassIfHighestQuality Link copied!

Type: boolean

Bypass delay if release is the highest quality available

Default: true

nixflix.sonarr-anime.config.delayProfiles.*.enableTorrent Link copied!

Type: boolean

Enable Torrent protocol for this profile

Default: true

nixflix.sonarr-anime.config.delayProfiles.*.enableUsenet Link copied!

Type: boolean

Enable Usenet protocol for this profile

Default: true

nixflix.sonarr-anime.config.delayProfiles.*.id Link copied!

Type: signed integer

Unique identifier for the delay profile

nixflix.sonarr-anime.config.delayProfiles.*.minimumCustomFormatScore Link copied!

Type: signed integer

Minimum custom format score to bypass delay

Default: 0

nixflix.sonarr-anime.config.delayProfiles.*.order Link copied!

Type: signed integer

Order/priority of this delay profile (lower values = higher priority)

Default: 50

nixflix.sonarr-anime.config.delayProfiles.*.preferredProtocol Link copied!

Type: one of "usenet", "torrent"

Preferred download protocol when both are available

Default: "usenet"

nixflix.sonarr-anime.config.delayProfiles.*.tags Link copied!

Type: list of signed integer

List of tag IDs this delay profile applies to (empty = applies to all)

Default: [ ]

nixflix.sonarr-anime.config.delayProfiles.*.torrentDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Torrent release

Default: 0

nixflix.sonarr-anime.config.delayProfiles.*.usenetDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Usenet release

Default: 0

nixflix.sonarr-anime.config.hostConfig Link copied!

Type: submodule

Host configuration options that will be set via the API /config/host endpoint

Default: { }

nixflix.sonarr-anime.config.hostConfig.authenticationMethod Link copied!

Type: one of "none", "basic", "forms", "external"

Authentication method

Default: "forms"

nixflix.sonarr-anime.config.hostConfig.authenticationRequired Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Authentication requirement level

Default: "enabled"

nixflix.sonarr-anime.config.hostConfig.backupRetention Link copied!

Type: signed integer

Backup retention in days

Default: 28

nixflix.sonarr-anime.config.hostConfig.certificateValidation Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Certificate validation

Default: "enabled"

nixflix.sonarr-anime.config.hostConfig.launchBrowser Link copied!

Type: boolean

Launch browser on start (not applicable for NixOS services)

Default: false

nixflix.sonarr-anime.config.hostConfig.logLevel Link copied!

Type: one of "info", "debug", "trace"

Log level

Default: "info"

nixflix.sonarr-anime.config.hostConfig.password Link copied!

Type: null or string or (submodule)

Password for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr-anime.config.hostConfig.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port the service listens on

nixflix.sonarr-anime.config.hostConfig.proxyPassword Link copied!

Type: string or (submodule)

Proxy password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr-anime.config.hostConfig.proxyPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Proxy port

Default: 8080

nixflix.sonarr-anime.config.hostConfig.proxyType Link copied!

Type: one of "http", "socks4", "socks5"

Proxy type

Default: "http"

nixflix.sonarr-anime.config.hostConfig.proxyUsername Link copied!

Type: string or (submodule)

Proxy username

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr-anime.config.hostConfig.sslCertPassword Link copied!

Type: string or (submodule)

SSL certificate password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr-anime.config.hostConfig.sslPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

SSL port

Default: 9898

nixflix.sonarr-anime.config.hostConfig.updateMechanism Link copied!

Type: one of "builtIn", "script", "external", "docker"

Update mechanism

Default: "builtIn"

nixflix.sonarr-anime.config.hostConfig.urlBase Link copied!

Type: string

URL base path

Default: ""
Example: "/takeMeThere"

nixflix.sonarr-anime.config.hostConfig.username Link copied!

Type: null or string or (submodule)

Username for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr-anime.config.mediaManagement.autoUnmonitorPreviouslyDownloadedEpisodes Link copied!

Type: boolean

Automatically unmonitor episodes after they have been downloaded.

Default: false

nixflix.sonarr-anime.config.mediaManagement.chmodFolder Link copied!

Type: string

Octal permissions to apply to media folders.

Default: "755"

nixflix.sonarr-anime.config.mediaManagement.chownGroup Link copied!

Type: string

Group name or gid to apply to media folders.

Default: ""

nixflix.sonarr-anime.config.mediaManagement.createEmptySeriesFolders Link copied!

Type: boolean

Create missing series folders during disk scan.

Default: false

nixflix.sonarr-anime.config.mediaManagement.deleteEmptyFolders Link copied!

Type: boolean

Delete empty folders during disk scan and when media files are deleted.

Default: true

nixflix.sonarr-anime.config.mediaManagement.downloadPropersAndRepacks Link copied!

Type: one of "preferAndUpgrade", "doNotUpgrade", "doNotPrefer"

How to handle proper and repack releases.

Default: "preferAndUpgrade"

nixflix.sonarr-anime.config.mediaManagement.enableMediaInfo Link copied!

Type: boolean

Scan video files for media info such as resolution, runtime, and codec.

Default: true

nixflix.sonarr-anime.config.mediaManagement.episodeTitleRequired Link copied!

Type: one of "always", "bulkSeasonReleases", "never"

Prevent importing for a limited time if the episode title is TBA.

Default: "always"

nixflix.sonarr-anime.config.mediaManagement.extraFileExtensions Link copied!

Type: string

Comma-separated list of extra file extensions to import.

Default: "srt"

nixflix.sonarr-anime.config.mediaManagement.fileDate Link copied!

Type: one of "none", "localAirDate", "utcAirDate"

Set the file date on imported media files.

Default: "none"

nixflix.sonarr-anime.config.mediaManagement.importExtraFiles Link copied!

Type: boolean

Import matching extra files alongside media files.

Default: false

nixflix.sonarr-anime.config.mediaManagement.minimumFreeSpaceWhenImporting Link copied!

Type: signed integer

Minimum free space in MB to leave on the disk when importing.

Default: 100

nixflix.sonarr-anime.config.mediaManagement.recycleBin Link copied!

Type: string

Path to the recycle bin directory.

Default: ""

nixflix.sonarr-anime.config.mediaManagement.recycleBinCleanupDays Link copied!

Type: signed integer

Number of days before items in the recycle bin are permanently deleted.

Default: 7

nixflix.sonarr-anime.config.mediaManagement.rescanAfterRefresh Link copied!

Type: one of "always", "afterManual", "never"

When to rescan the media folder after refreshing media information.

Default: "always"

nixflix.sonarr-anime.config.mediaManagement.setPermissionsLinux Link copied!

Type: boolean

Set chmod and chown on imported files and media folders.

Default: false

nixflix.sonarr-anime.config.mediaManagement.skipFreeSpaceCheckWhenImporting Link copied!

Type: boolean

Skip the free space check when importing media files.

Default: false

nixflix.sonarr-anime.config.mediaManagement.useScriptImport Link copied!

Type: boolean

Use a custom script for importing instead of the built-in import.

Default: false

nixflix.sonarr-anime.config.rootFolders Link copied!

Type: list of (attribute set)

List of root folders to create via the API /rootfolder endpoint. Each folder is an attribute set that will be converted to JSON and sent to the API.

For Sonarr/Radarr, a simple path is sufficient: {path = "/path/to/folder";}

For Lidarr, additional fields are required like defaultQualityProfileId, etc.

Default: map (mediaDir: {path = mediaDir;}) nixflix.sonarr-anime.mediaDirs

nixflix.sonarr-anime.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.sonarr-anime.dataDir Link copied!

Type: absolute path

Directory containing Seerr data and configuration

Default: "${config.nixflix.stateDir}/${serviceName}"

nixflix.sonarr-anime.enable Link copied!

Type: boolean

Whether to enable Sonarr-anime.

Default: false
Example: true

nixflix.sonarr-anime.group Link copied!

Type: string

Group under which the service runs

Default: "sonarr-anime"

nixflix.sonarr-anime.mediaDirs Link copied!

Type: list of absolute path

List of media directories to create and manage

Default: [config.nixflix.mediaDir + "/<media-type>"]

nixflix.sonarr-anime.openFirewall Link copied!

Type: boolean

Open ports in the firewall for the Radarr web interface.

Default: false

nixflix.sonarr-anime.package Link copied!

Type: package

The sonarr package to use.

Default: pkgs.sonarr

nixflix.sonarr-anime.reverseProxy.expose Link copied!

Type: boolean

Whether to expose this service via the reverse proxy.

Default: true

nixflix.sonarr-anime.settings Link copied!

Type: open submodule of attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))

Attribute set of arbitrary config options. Please consult the documentation at the wiki.

!!! warning

This configuration is stored in the world-readable Nix store!
Don't put secrets here!
Default: { auth = { required = "Enabled"; method = "Forms"; }; server = { inherit (config.nixflix.sonarr-anime.config.hostConfig) port urlBase; }; } // optionalAttrs config.nixflix.postgres.enable { log.dbEnabled = true; postgres = { user = config.nixflix.sonarr-anime.user; host = "/run/postgresql"; port = config.services.postgresql.settings.port; mainDb = config.nixflix.sonarr-anime.user; logDb = "${config.nixflix.sonarr-anime.user}-logs"; }; }
Example:
{
  update.mechanism = "internal";
  server = {
    urlbase = "localhost";
    port = 8989;
    bindaddress = "*";
  };
}

nixflix.sonarr-anime.settings.app.instanceName Link copied!

Type: string

Name of the instance

Default: "Sonarr-anime"

nixflix.sonarr-anime.settings.log.analyticsEnabled Link copied!

Type: boolean

Send Anonymous Usage Data

Default: false

nixflix.sonarr-anime.settings.server.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port Number

nixflix.sonarr-anime.settings.update.automatically Link copied!

Type: boolean

Automatically download and install updates.

Default: false

nixflix.sonarr-anime.settings.update.mechanism Link copied!

Type: null or one of "external", "builtIn", "script"

which update mechanism to use

Default: "external"

nixflix.sonarr-anime.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy. Service accessible at <subdomain>.<domain>.

Default: "sonarr-anime"

nixflix.sonarr-anime.user Link copied!

Type: string

User under which the service runs

Default: "sonarr-anime"

nixflix.sonarr-anime.vpn.enable Link copied!

Type: boolean

Whether to route Sonarr-anime traffic through the VPN.

When false (default), Sonarr-anime bypasses the VPN to prevent Cloudflare and image provider blocks. When true, Sonarr-anime routes through the VPN (requires nixflix.vpn.enable = true).

TRaSH Guides recommend leaving this false.

Default: false

nixflix.sonarr.config.apiKey Link copied!

Type: string or (submodule)

API key for Sonarr. Can be created by running:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr.config.apiVersion Link copied!

Type: string

Current version of the API of the service

Default: "v3"

nixflix.sonarr.config.delayProfiles Link copied!

Type: list of (submodule)

List of delay profiles to configure via the API /delayprofile endpoint.

Profiles are created/updated in id order. If no profile with id=1 is provided, a default profile will be added automatically.

Default: [ { enableUsenet = true; enableTorrent = true; preferredProtocol = "usenet"; usenetDelay = 0; torrentDelay = 0; bypassIfHighestQuality = true; bypassIfAboveCustomFormatScore = false; minimumCustomFormatScore = 0; order = 2147483647; tags = []; id = 1; }; ]

nixflix.sonarr.config.delayProfiles.*.bypassIfAboveCustomFormatScore Link copied!

Type: boolean

Bypass delay if custom format score is above minimum

Default: false

nixflix.sonarr.config.delayProfiles.*.bypassIfHighestQuality Link copied!

Type: boolean

Bypass delay if release is the highest quality available

Default: true

nixflix.sonarr.config.delayProfiles.*.enableTorrent Link copied!

Type: boolean

Enable Torrent protocol for this profile

Default: true

nixflix.sonarr.config.delayProfiles.*.enableUsenet Link copied!

Type: boolean

Enable Usenet protocol for this profile

Default: true

nixflix.sonarr.config.delayProfiles.*.id Link copied!

Type: signed integer

Unique identifier for the delay profile

nixflix.sonarr.config.delayProfiles.*.minimumCustomFormatScore Link copied!

Type: signed integer

Minimum custom format score to bypass delay

Default: 0

nixflix.sonarr.config.delayProfiles.*.order Link copied!

Type: signed integer

Order/priority of this delay profile (lower values = higher priority)

Default: 50

nixflix.sonarr.config.delayProfiles.*.preferredProtocol Link copied!

Type: one of "usenet", "torrent"

Preferred download protocol when both are available

Default: "usenet"

nixflix.sonarr.config.delayProfiles.*.tags Link copied!

Type: list of signed integer

List of tag IDs this delay profile applies to (empty = applies to all)

Default: [ ]

nixflix.sonarr.config.delayProfiles.*.torrentDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Torrent release

Default: 0

nixflix.sonarr.config.delayProfiles.*.usenetDelay Link copied!

Type: signed integer

Delay in minutes before grabbing a Usenet release

Default: 0

nixflix.sonarr.config.hostConfig Link copied!

Type: submodule

Host configuration options that will be set via the API /config/host endpoint

Default: { }

nixflix.sonarr.config.hostConfig.authenticationMethod Link copied!

Type: one of "none", "basic", "forms", "external"

Authentication method

Default: "forms"

nixflix.sonarr.config.hostConfig.authenticationRequired Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Authentication requirement level

Default: "enabled"

nixflix.sonarr.config.hostConfig.backupFolder Link copied!

Type: string

Backup folder name

Default: "Backups"

nixflix.sonarr.config.hostConfig.backupInterval Link copied!

Type: signed integer

Backup interval in days

Default: 7

nixflix.sonarr.config.hostConfig.backupRetention Link copied!

Type: signed integer

Backup retention in days

Default: 28

nixflix.sonarr.config.hostConfig.bindAddress Link copied!

Type: string

Address to bind to

Default: "0.0.0.0"

nixflix.sonarr.config.hostConfig.certificateValidation Link copied!

Type: one of "enabled", "disabled", "disabledForLocalAddresses"

Certificate validation

Default: "enabled"

nixflix.sonarr.config.hostConfig.launchBrowser Link copied!

Type: boolean

Launch browser on start (not applicable for NixOS services)

Default: false

nixflix.sonarr.config.hostConfig.logLevel Link copied!

Type: one of "info", "debug", "trace"

Log level

Default: "info"

nixflix.sonarr.config.hostConfig.logSizeLimit Link copied!

Type: signed integer

Log size limit in MB

Default: 1

nixflix.sonarr.config.hostConfig.password Link copied!

Type: null or string or (submodule)

Password for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr.config.hostConfig.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port the service listens on

nixflix.sonarr.config.hostConfig.proxyBypassLocalAddresses Link copied!

Type: boolean

Proxy bypass local addresses

Default: true

nixflix.sonarr.config.hostConfig.proxyPassword Link copied!

Type: string or (submodule)

Proxy password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr.config.hostConfig.proxyPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Proxy port

Default: 8080

nixflix.sonarr.config.hostConfig.proxyType Link copied!

Type: one of "http", "socks4", "socks5"

Proxy type

Default: "http"

nixflix.sonarr.config.hostConfig.proxyUsername Link copied!

Type: string or (submodule)

Proxy username

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr.config.hostConfig.sslCertPassword Link copied!

Type: string or (submodule)

SSL certificate password

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr.config.hostConfig.sslPort Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

SSL port

Default: 9898

nixflix.sonarr.config.hostConfig.trustCgnatIpAddresses Link copied!

Type: boolean

Trust CGNAT IP addresses

Default: false

nixflix.sonarr.config.hostConfig.updateMechanism Link copied!

Type: one of "builtIn", "script", "external", "docker"

Update mechanism

Default: "builtIn"

nixflix.sonarr.config.hostConfig.urlBase Link copied!

Type: string

URL base path

Default: ""
Example: "/takeMeThere"

nixflix.sonarr.config.hostConfig.username Link copied!

Type: null or string or (submodule)

Username for web interface authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.sonarr.config.mediaManagement.autoUnmonitorPreviouslyDownloadedEpisodes Link copied!

Type: boolean

Automatically unmonitor episodes after they have been downloaded.

Default: false

nixflix.sonarr.config.mediaManagement.chmodFolder Link copied!

Type: string

Octal permissions to apply to media folders.

Default: "755"

nixflix.sonarr.config.mediaManagement.chownGroup Link copied!

Type: string

Group name or gid to apply to media folders.

Default: ""

nixflix.sonarr.config.mediaManagement.createEmptySeriesFolders Link copied!

Type: boolean

Create missing series folders during disk scan.

Default: false

nixflix.sonarr.config.mediaManagement.deleteEmptyFolders Link copied!

Type: boolean

Delete empty folders during disk scan and when media files are deleted.

Default: true

nixflix.sonarr.config.mediaManagement.downloadPropersAndRepacks Link copied!

Type: one of "preferAndUpgrade", "doNotUpgrade", "doNotPrefer"

How to handle proper and repack releases.

Default: "preferAndUpgrade"

nixflix.sonarr.config.mediaManagement.enableMediaInfo Link copied!

Type: boolean

Scan video files for media info such as resolution, runtime, and codec.

Default: true

nixflix.sonarr.config.mediaManagement.episodeTitleRequired Link copied!

Type: one of "always", "bulkSeasonReleases", "never"

Prevent importing for a limited time if the episode title is TBA.

Default: "always"

nixflix.sonarr.config.mediaManagement.extraFileExtensions Link copied!

Type: string

Comma-separated list of extra file extensions to import.

Default: "srt"

nixflix.sonarr.config.mediaManagement.fileDate Link copied!

Type: one of "none", "localAirDate", "utcAirDate"

Set the file date on imported media files.

Default: "none"

nixflix.sonarr.config.mediaManagement.importExtraFiles Link copied!

Type: boolean

Import matching extra files alongside media files.

Default: false

nixflix.sonarr.config.mediaManagement.minimumFreeSpaceWhenImporting Link copied!

Type: signed integer

Minimum free space in MB to leave on the disk when importing.

Default: 100

nixflix.sonarr.config.mediaManagement.recycleBin Link copied!

Type: string

Path to the recycle bin directory.

Default: ""

nixflix.sonarr.config.mediaManagement.recycleBinCleanupDays Link copied!

Type: signed integer

Number of days before items in the recycle bin are permanently deleted.

Default: 7

nixflix.sonarr.config.mediaManagement.rescanAfterRefresh Link copied!

Type: one of "always", "afterManual", "never"

When to rescan the media folder after refreshing media information.

Default: "always"

nixflix.sonarr.config.mediaManagement.scriptImportPath Link copied!

Type: string

Path to the custom import script.

Default: ""

nixflix.sonarr.config.mediaManagement.setPermissionsLinux Link copied!

Type: boolean

Set chmod and chown on imported files and media folders.

Default: false

nixflix.sonarr.config.mediaManagement.skipFreeSpaceCheckWhenImporting Link copied!

Type: boolean

Skip the free space check when importing media files.

Default: false

nixflix.sonarr.config.mediaManagement.useScriptImport Link copied!

Type: boolean

Use a custom script for importing instead of the built-in import.

Default: false

nixflix.sonarr.config.rootFolders Link copied!

Type: list of (attribute set)

List of root folders to create via the API /rootfolder endpoint. Each folder is an attribute set that will be converted to JSON and sent to the API.

For Sonarr/Radarr, a simple path is sufficient: {path = "/path/to/folder";}

For Lidarr, additional fields are required like defaultQualityProfileId, etc.

Default: map (mediaDir: {path = mediaDir;}) nixflix.sonarr.mediaDirs

nixflix.sonarr.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.sonarr.dataDir Link copied!

Type: absolute path

Directory containing Seerr data and configuration

Default: "${config.nixflix.stateDir}/${serviceName}"

nixflix.sonarr.enable Link copied!

Type: boolean

Whether to enable Sonarr.

Default: false
Example: true

nixflix.sonarr.group Link copied!

Type: string

Group under which the service runs

Default: "sonarr"

nixflix.sonarr.mediaDirs Link copied!

Type: list of absolute path

List of media directories to create and manage

Default: [config.nixflix.mediaDir + "/<media-type>"]

nixflix.sonarr.openFirewall Link copied!

Type: boolean

Open ports in the firewall for the Radarr web interface.

Default: false

nixflix.sonarr.package Link copied!

Type: package

The sonarr package to use.

Default: pkgs.sonarr

nixflix.sonarr.reverseProxy.expose Link copied!

Type: boolean

Whether to expose this service via the reverse proxy.

Default: true

nixflix.sonarr.settings Link copied!

Type: open submodule of attribute set of section of an INI file (attrs of INI atom (null, bool, int, float or string))

Attribute set of arbitrary config options. Please consult the documentation at the wiki.

!!! warning

This configuration is stored in the world-readable Nix store!
Don't put secrets here!
Default: { auth = { required = "Enabled"; method = "Forms"; }; server = { inherit (config.nixflix.sonarr.config.hostConfig) port urlBase; }; } // optionalAttrs config.nixflix.postgres.enable { log.dbEnabled = true; postgres = { user = config.nixflix.sonarr.user; host = "/run/postgresql"; port = config.services.postgresql.settings.port; mainDb = config.nixflix.sonarr.user; logDb = "${config.nixflix.sonarr.user}-logs"; }; }
Example:
{
  update.mechanism = "internal";
  server = {
    urlbase = "localhost";
    port = 8989;
    bindaddress = "*";
  };
}

nixflix.sonarr.settings.app.instanceName Link copied!

Type: string

Name of the instance

Default: "Sonarr"

nixflix.sonarr.settings.log.analyticsEnabled Link copied!

Type: boolean

Send Anonymous Usage Data

Default: false

nixflix.sonarr.settings.server.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port Number

nixflix.sonarr.settings.update.automatically Link copied!

Type: boolean

Automatically download and install updates.

Default: false

nixflix.sonarr.settings.update.mechanism Link copied!

Type: null or one of "external", "builtIn", "script"

which update mechanism to use

Default: "external"

nixflix.sonarr.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy. Service accessible at <subdomain>.<domain>.

Default: "sonarr"

nixflix.sonarr.user Link copied!

Type: string

User under which the service runs

Default: "sonarr"

nixflix.sonarr.vpn.enable Link copied!

Type: boolean

Whether to route Sonarr traffic through the VPN.

When false (default), Sonarr bypasses the VPN to prevent Cloudflare and image provider blocks. When true, Sonarr routes through the VPN (requires nixflix.vpn.enable = true).

TRaSH Guides recommend leaving this false.

Default: false

nixflix.stateDir Link copied!

Type: absolute path

The location of the state directory for the services.

!!! warning

All parent directories must have execute permissions for everyone.

!!! warning

Setting this to any path, where the subpath is not owned by root, will fail! For example:

```nix
mediaDir = /home/user/data
```

Is not supported, because `/home/user` is owned by `user`.
Default: "/var/lib"
Example: "/data/.state"

nixflix.theme.enable Link copied!

Type: boolean

Enables themeing via theme.park. Requires a reverse proxy (nixflix.nginx.enable or nixflix.caddy.enable) for all services except Jellyfin.

Default: false
Example: true

nixflix.theme.name Link copied!

Type: string

The name of any official theme or community theme supported by theme.park.

Default: "overseerr"

nixflix.torrentClients.qbittorrent Link copied!

Type: open submodule of attribute set of anything

This option has no description.

Default: { }

nixflix.torrentClients.qbittorrent.categories Link copied!

Type: attribute set of string

Map of category names to their save paths (relative or absolute).

Default: { radarr = lib.optionalString (config.nixflix.radarr.enable or false) "/data/downloads/torrent/radarr"; sonarr = lib.optionalString (config.nixflix.radarr.enable or false) "/data/downloads/torrent/sonarr"; sonarr-anime = lib.optionalString (config.nixflix.radarr.enable or false) "/data/downloads/torrent/sonarr-anime"; lidarr = lib.optionalString (config.nixflix.radarr.enable or false) "/data/downloads/torrent/lidarr"; prowlarr = lib.optionalString (config.nixflix.radarr.enable or false) "/data/downloads/torrent/prowlarr"; }
Example:
{
  prowlarr = "games";
  sonarr = "/mnt/share/movies";
}

nixflix.torrentClients.qbittorrent.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.torrentClients.qbittorrent.downloadsDir Link copied!

Type: string

Base directory for qBittorrent downloads

Default: "$${config.nixflix.downloadsDir}/torrent"

nixflix.torrentClients.qbittorrent.enable Link copied!

Type: boolean

Whether to enable qBittorrent usenet downloader.

Uses all of the same options as nixpkgs qBittorent.

Default: false

nixflix.torrentClients.qbittorrent.group Link copied!

Type: string

Group under which qbittorrent runs.

Default: "media"

nixflix.torrentClients.qbittorrent.password Link copied!

Type: null or string or (submodule)

The password for qbittorrent. This is for the other services to integrate with qBittorrent. Not for setting the password in qBittorrent

In order to set the password for qBittorrent itself, you will need to configure nixflix.torrentClients.qbittorrent.serverConfig.Preferences.WebUI.Password_PBKDF2. Look at the serverConfig documentation to see how to configure it.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.torrentClients.qbittorrent.reverseProxy.expose Link copied!

Type: boolean

Whether to expose qBittorrent via the reverse proxy.

Default: true

nixflix.torrentClients.qbittorrent.serverConfig.BitTorrent.Session.DefaultSavePath Link copied!

Type: string

Default save path for downloads without a category.

Default: "${config.nixflix.torrentClients.qbittorrent.downloadsDir}/default"

nixflix.torrentClients.qbittorrent.serverConfig.BitTorrent.Session.DisableAutoTMMByDefault Link copied!

Type: boolean

Default Torrent Management Mode. Set to false to enable category save paths.

true = Manual, false = Automatic

Default: false

nixflix.torrentClients.qbittorrent.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy.

Default: "qbittorrent"

nixflix.torrentClients.qbittorrent.user Link copied!

Type: string

User account under which qbittorrent runs.

Default: "qbittorrent"

nixflix.torrentClients.qbittorrent.vpn.enable Link copied!

Type: boolean

Whether to route qBittorrent traffic through the VPN.

When false, qBittorrent bypasses the VPN. When true, qBittorrent is confined to the WireGuard network namespace (requires nixflix.vpn.enable = true).

Default: config.nixflix.vpn.enable

nixflix.torrentClients.qbittorrent.webuiPort Link copied!

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

the port passed to qbittorrent via --webui-port

Default: 8282

nixflix.usenetClients.sabnzbd.connectionAddress Link copied!

Type: string

Address for connecting to this service.

Default: "127.0.0.1"

nixflix.usenetClients.sabnzbd.downloadsDir Link copied!

Type: string

Base directory for SABnzbd downloads

Default: "$${config.nixflix.downloadsDir}/usenet"

nixflix.usenetClients.sabnzbd.enable Link copied!

Type: boolean

Whether to enable SABnzbd usenet downloader

Default: false

nixflix.usenetClients.sabnzbd.group Link copied!

Type: string

Group under which the service runs

Default: config.nixflix.globals.libraryOwner.group

nixflix.usenetClients.sabnzbd.openFirewall Link copied!

Type: boolean

Open ports in the firewall for the SABnzbd web interface.

Default: false

nixflix.usenetClients.sabnzbd.package Link copied!

Type: package

The sabnzbd package to use.

Default: pkgs.sabnzbd

nixflix.usenetClients.sabnzbd.reverseProxy.expose Link copied!

Type: boolean

Whether to expose SABnzbd via the reverse proxy.

Default: true

nixflix.usenetClients.sabnzbd.settings Link copied!

Type: open submodule of anything

SABnzbd settings

Default: { }

nixflix.usenetClients.sabnzbd.settings.categories Link copied!

Type: list of (open submodule of anything)

Download categories. By default, categories are automatically created based on enabled services, using the service name as the category name (radarr, sonarr, sonarr-anime, lidarr, prowlarr).

A catch-all "*" category is always included.

Default: lib.optional (config.nixflix.radarr.enable or false) { name = "radarr"; dir = "radarr"; priority = 0; pp = 3; script = "None"; } ++ lib.optional (config.nixflix.sonarr.enable or false) { name = "sonarr"; dir = "sonarr"; priority = 0; pp = 3; script = "None"; } ++ lib.optional (config.nixflix.sonarr-anime.enable or false) { name = "sonarr-anime"; dir = "sonarr-anime"; priority = 0; pp = 3; script = "None"; } ++ lib.optional (config.nixflix.lidarr.enable or false) { name = "lidarr"; dir = "lidarr"; priority = 0; pp = 3; script = "None"; } ++ lib.optional (config.nixflix.prowlarr.enable or false) { name = "prowlarr"; dir = "prowlarr"; priority = 0; pp = 3; script = "None"; } ++ [ { name = "*"; priority = 0; pp = 3; script = "None"; } ]
Example:
[
  {
    name = "radarr";
    dir = "radarr";
    priority = 0;
    pp = 3;
    script = "None";
  }
  {
    name = "sonarr";
    dir = "sonarr";
    priority = 0;
    pp = 3;
    script = "None";
  }
]

nixflix.usenetClients.sabnzbd.settings.categories.*.pp Link copied!

Type: (one of "", 0, 1, 2, 3) or (one of "Default", "Download", "Repair", "Repair+Unpack", "Repair+Unpack+Delete") convertible to it

Post-processing level

Default: 3

nixflix.usenetClients.sabnzbd.settings.misc Link copied!

Type: open submodule of anything

SABnzbd [misc] section settings

Default: { }

nixflix.usenetClients.sabnzbd.settings.misc.action_on_unwanted_extensions Link copied!

Type: signed integer

Action on unwanted extensions (0=None, 1=Abort, 2=Delete)

Default: 1

nixflix.usenetClients.sabnzbd.settings.misc.admin_dir Link copied!

Type: string

Admin directory

Default: config.nixflix.usenetClients.sabnzbd.downloadsDir + "/admin"

nixflix.usenetClients.sabnzbd.settings.misc.allow_incomplete_nzb Link copied!

Type: boolean

Sometimes you get an incomplete NZB file (partial content, incorrect syntax etc.) You can enable this option to allow SABnzbd to salvage as much as possible from the NZB. The job will enter the queue in paused mode.

Default: false

nixflix.usenetClients.sabnzbd.settings.misc.api_key Link copied!

Type: string or (submodule)

API key for SABnzbd. Can be created with the following:

openssl rand -hex 16

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.usenetClients.sabnzbd.settings.misc.article_tries Link copied!

Type: signed integer

Number of attempts per article

Default: 3

nixflix.usenetClients.sabnzbd.settings.misc.bandwidth_max Link copied!

Type: string

Maximum bandwidth in bytes/sec (supports prefixes). Use in conjunction with bandwidth_perc.

Default: ""
Example: "50MB/s"

nixflix.usenetClients.sabnzbd.settings.misc.bandwidth_perc Link copied!

Type: signed integer

Percentage of bandwidth_max that SABnzbd is allowed to use. 0 means no limit.

Default: 0
Example: 50

nixflix.usenetClients.sabnzbd.settings.misc.cache_limit Link copied!

Type: string

Size of the RAM cache, in bytes (prefixes supported). SABnzbd recommends 25% of available RAM.

Default: "512M"
Example: "500M"

nixflix.usenetClients.sabnzbd.settings.misc.complete_dir Link copied!

Type: string

Complete downloads directory

Default: config.nixflix.usenetClients.sabnzbd.downloadsDir + "/complete"

nixflix.usenetClients.sabnzbd.settings.misc.dirscan_dir Link copied!

Type: string

Directory to watch for NZB files

Default: config.nixflix.usenetClients.sabnzbd.downloadsDir + "/watch"

nixflix.usenetClients.sabnzbd.settings.misc.dirscan_speed Link copied!

Type: signed integer

Directory scan speed in seconds

Default: 5

nixflix.usenetClients.sabnzbd.settings.misc.download_dir Link copied!

Type: string

Incomplete downloads directory

Default: config.nixflix.usenetClients.sabnzbd.downloadsDir + "/incomplete"

nixflix.usenetClients.sabnzbd.settings.misc.email_endjob Link copied!

Type: (one of 1, 0, 2) or (one of "always", "never", "on error") convertible to it

Whether to send emails on job completion.

Default: 0

nixflix.usenetClients.sabnzbd.settings.misc.email_from Link copied!

Type: string

'From:' field for emails (needs to be an address).

Default: ""

nixflix.usenetClients.sabnzbd.settings.misc.email_full Link copied!

Type: boolean

Whether to send alerts for full disks.

Default: false

nixflix.usenetClients.sabnzbd.settings.misc.email_pwd Link copied!

Type: string or (submodule)

Password for SMTP authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.usenetClients.sabnzbd.settings.misc.email_rss Link copied!

Type: boolean

Whether to send alerts for jobs added by RSS feeds.

Default: false

nixflix.usenetClients.sabnzbd.settings.misc.email_server Link copied!

Type: string

SMTP server for email alerts (server:port format).

Default: ""

nixflix.usenetClients.sabnzbd.settings.misc.email_to Link copied!

Type: string

Receiving address for email alerts.

Default: ""

nixflix.usenetClients.sabnzbd.settings.misc.enable_https Link copied!

Type: boolean

Whether to enable HTTPS for the web UI.

Default: false

nixflix.usenetClients.sabnzbd.settings.misc.enable_par_cleanup Link copied!

Type: boolean

Normally SABnzbd will clean up par2 files after verify/repair. You can disable this by using 0. Disabling this will also force all par2 files to be downloaded.

Default: true

nixflix.usenetClients.sabnzbd.settings.misc.flat_unpack Link copied!

Type: boolean

Ignore any folders inside archives

Default: true

nixflix.usenetClients.sabnzbd.settings.misc.host Link copied!

Type: string

Address for the Web UI to listen on for incoming connections.

Default: if config.nixflix.vpn.enable && config.nixflix.usenetClients.sabnzbd.vpn.enable then config.vpnNamespaces.wg.namespaceAddress else if config.nixflix.reverseProxy.enable then "127.0.0.1" else "0.0.0.0"
Example: "0.0.0.0"

nixflix.usenetClients.sabnzbd.settings.misc.host_whitelist Link copied!

Type: string

Hostname verification whitelist. SABnzbd refuses connections from hostnames not in this list. Automatically includes the service hostname when a reverse proxy is enabled.

Default: if config.nixflix.reverseProxy.enable then "${cfg.subdomain}.${config.nixflix.reverseProxy.domain}" else ""

nixflix.usenetClients.sabnzbd.settings.misc.html_login Link copied!

Type: boolean

HTML based login form, uncheck for basic authentication. Both offer similar security but password managers might not be able to fill basic authentication automatically.

Default: true

nixflix.usenetClients.sabnzbd.settings.misc.https_cert Link copied!

Type: string

Path to the TLS certificate for the web UI. If not set and HTTPS is enabled, a self-signed certificate is generated.

Default: ""
Example: config.security.acme.certs."example.com".directory + "/fullchain.pem"

nixflix.usenetClients.sabnzbd.settings.misc.https_key Link copied!

Type: string

Path to the TLS key for the web UI. If not set and HTTPS is enabled, a self-signed key is generated.

Default: ""
Example: config.security.acme.certs."example.com".directory + "/key.pem"

nixflix.usenetClients.sabnzbd.settings.misc.https_port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

HTTPS port for the Web UI (0 to disable HTTPS).

Default: 0

nixflix.usenetClients.sabnzbd.settings.misc.inet_exposure Link copied!

Type: (one of 1, 3, 2, 4, 5, 0) or (one of "api (add nzbs)", "api (full)", "api (no config)", "api+web (auth needed)", "api+web (locally no auth)", "none") convertible to it

Controls access restrictions from non-local IP addresses. Defaults to api+web (auth needed) when a reverse proxy is enabled, because nginx forwards the real client IP via X-Forwarded-For and SABnzbd only considers RFC 1918 ranges local — clients on Tailscale (100.64.0.0/10) or similar networks would otherwise be refused.

Default: if config.nixflix.reverseProxy.enable then 4 else 0

nixflix.usenetClients.sabnzbd.settings.misc.keep_awake Link copied!

Type: boolean

Disable to stop SABnzbd's attempts to keep the system awake while the queue isn't empty.

Default: false

nixflix.usenetClients.sabnzbd.settings.misc.log_dir Link copied!

Type: string

Log directory

Default: config.nixflix.usenetClients.sabnzbd.downloadsDir + "/logs"

nixflix.usenetClients.sabnzbd.settings.misc.log_level Link copied!

Type: signed integer

Log level (0=None, 1=Info, 2=Debug)

Default: 1

nixflix.usenetClients.sabnzbd.settings.misc.nzb_backup_dir Link copied!

Type: string

NZB backup directory

Default: config.nixflix.usenetClients.sabnzbd.downloadsDir + "/nzb-backup"

nixflix.usenetClients.sabnzbd.settings.misc.nzb_key Link copied!

Type: string or (submodule)

NZB key for adding downloads via URL.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.usenetClients.sabnzbd.settings.misc.pause_on_post_processing Link copied!

Type: boolean

Pause download during post-processing

Default: false

nixflix.usenetClients.sabnzbd.settings.misc.pause_on_pwrar Link copied!

Type: signed integer

Action when encrypted RAR is downloaded

Default: 1

nixflix.usenetClients.sabnzbd.settings.misc.permissions Link copied!

Type: string

File permissions for downloaded files

Default: "775"

nixflix.usenetClients.sabnzbd.settings.misc.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port for the Web UI to listen on for incoming connections.

Default: 8080
Example: 12345

nixflix.usenetClients.sabnzbd.settings.misc.propagation_delay Link copied!

Type: signed integer

Posts will be pause until they are at least this age. Setting job priority to Force will skip the delay.

Default: 0

nixflix.usenetClients.sabnzbd.settings.misc.reorder_files Link copied!

Type: boolean

Reorder files for optimal unpacking

Default: true

nixflix.usenetClients.sabnzbd.settings.misc.top_only Link copied!

Type: boolean

Only get articles from top of queue

Default: true

nixflix.usenetClients.sabnzbd.settings.misc.unwanted_extensions_mode Link copied!

Type: signed integer

Unwanted extension mode (0=Blacklist, 1=Whitelist

Default: 0

nixflix.usenetClients.sabnzbd.settings.misc.url_base Link copied!

Type: string

When using a reverse proxy (or just if you feel like it), you can change the base-URL of SABnzbd that is used during redirects. Trailing slash is not allowed. Leading slash is required unless the base URL is an empty string. SABnzbd will forcefully restart after changing this setting, you will need to reload the page after the restart completes.

Default: ""
Example: "/sabnzbd"

nixflix.usenetClients.sabnzbd.settings.servers Link copied!

Type: list of (open submodule of anything)

List of usenet servers

Default: [ ]

nixflix.usenetClients.sabnzbd.settings.servers.*.backup Link copied!

Type: boolean

Use this server as a backup/fill server.

Default: false

nixflix.usenetClients.sabnzbd.settings.servers.*.connections Link copied!

Type: signed integer

Number of parallel connections permitted by the server.

Default: 10
Example: 50

nixflix.usenetClients.sabnzbd.settings.servers.*.displayname Link copied!

Type: string

Human-friendly description of the server.

Default: ""
Example: "Example News Provider"

nixflix.usenetClients.sabnzbd.settings.servers.*.expire_date Link copied!

Type: string

If notifications are enabled and an expiry date is set, warn 5 days before expiry.

Default: ""

nixflix.usenetClients.sabnzbd.settings.servers.*.host Link copied!

Type: string

Hostname of the server.

Example: "news.example.com"

nixflix.usenetClients.sabnzbd.settings.servers.*.name Link copied!

Type: string

The name of the server.

Example: "Example News Provider"

nixflix.usenetClients.sabnzbd.settings.servers.*.optional Link copied!

Type: boolean

In case of connection failures, temporarily disable this server.

Default: false

nixflix.usenetClients.sabnzbd.settings.servers.*.password Link copied!

Type: string or (submodule)

Password for server authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.usenetClients.sabnzbd.settings.servers.*.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port of the server.

Default: 563
Example: 443

nixflix.usenetClients.sabnzbd.settings.servers.*.priority Link copied!

Type: signed integer

Priority of this server. Servers are queried in order of priority, from highest (0) to lowest (100).

Default: 0

nixflix.usenetClients.sabnzbd.settings.servers.*.required Link copied!

Type: boolean

In case of connection failures, wait for the server to come back online instead of skipping it.

Default: false

nixflix.usenetClients.sabnzbd.settings.servers.*.retention Link copied!

Type: signed integer

Server retention in days (0 = unknown).

Default: 0

nixflix.usenetClients.sabnzbd.settings.servers.*.ssl Link copied!

Type: boolean

Whether the server supports TLS.

Default: true

nixflix.usenetClients.sabnzbd.settings.servers.*.ssl_verify Link copied!

Type: (one of 2, 0, 3) or (one of "allow injection", "none", "strict") convertible to it

Certificate verification level.

Default: 2

nixflix.usenetClients.sabnzbd.settings.servers.*.timeout Link copied!

Type: signed integer

Time, in seconds, to wait for a response before attempting error recovery.

Default: 60

nixflix.usenetClients.sabnzbd.settings.servers.*.username Link copied!

Type: string or (submodule)

Username for server authentication.

!!! warning Can be a plain string (visible in Nix store) or { _secret = /path/to/file; } for file-based secrets.

Plain-text secrets will be visible in the Nix store. Use `{ _secret = path; }` for sensitive data.
Default: null
Example: { _secret = "/run/secrets/secret-file"; }

nixflix.usenetClients.sabnzbd.subdomain Link copied!

Type: string

Subdomain prefix for reverse proxy.

Default: "sabnzbd"

nixflix.usenetClients.sabnzbd.user Link copied!

Type: string

User under which the service runs

Default: "sabnzbd"

nixflix.usenetClients.sabnzbd.vpn.enable Link copied!

Type: boolean

Whether to route SABnzbd traffic through the VPN.

When false, SABnzbd bypasses the VPN. When true, SABnzbd is confined to the WireGuard network namespace (requires nixflix.vpn.enable = true).

Default: config.nixflix.vpn.enable

nixflix.vpn.accessibleFrom Link copied!

Type: list of string

List of subnets or addresses in the default network namespace that should be able to reach services confined in the VPN namespace.

Required to access VPN-confined services (e.g. Radarr, Sonarr) from your local network. Example: ["192.168.1.0/24"].

Default: [ "192.168.1.0/24" ]
Example:
[
  "192.168.1.0/24"
]

nixflix.vpn.enable Link copied!

Type: boolean

Whether to enable WireGuard VPN.

Default: false
Example: true

nixflix.vpn.openVPNPorts Link copied!

Type: list of (submodule)

Ports to open through the VPN interface, e.g. for port forwarding provided by the VPN provider (AirVPN, IVPN, etc.).

Default: [ ]
Example:
[
  {
    port = 60729;
    protocol = "both";
  }
]

nixflix.vpn.openVPNPorts.*.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port number to open through the VPN interface.

nixflix.vpn.openVPNPorts.*.protocol Link copied!

Type: one of "tcp", "udp", "both"

Protocol for the port.

Default: "tcp"

nixflix.vpn.wgConfFile Link copied!

Type: absolute path

Path to a wg-quick compatible WireGuard configuration file.

The file must contain at least [Interface] with Address, PrivateKey, and DNS fields, and one or more [Peer] sections with PublicKey, Endpoint, and AllowedIPs.

This file is read at service startup. Use a path to a file managed by your secrets solution (e.g. agenix, sops-nix) to keep the private key out of the Nix store.

Example: "/etc/wireguard/airvpn.conf"

programs.anime-game-launcher.enable Link copied!

Type: boolean

Whether to enable anime-game-launcher.

Default: false

programs.anime-game-launcher.package Link copied!

Type: package

anime-game-launcher package to use.

Default: <derivation anime-game-launcher-3.19.6>

programs.anime-games-launcher.enable Link copied!

Type: boolean

Whether to enable anime-games-launcher.

Default: false

programs.anime-games-launcher.package Link copied!

Type: package

anime-games-launcher package to use.

Default: <derivation anime-games-launcher-2.1.0>

programs.honkers-launcher.enable Link copied!

Type: boolean

Whether to enable honkers-launcher.

Default: false

programs.honkers-launcher.package Link copied!

Type: package

honkers-launcher package to use.

Default: <derivation honkers-launcher-1.13.0>

programs.honkers-railway-launcher.enable Link copied!

Type: boolean

Whether to enable honkers-railway-launcher.

Default: false

programs.honkers-railway-launcher.package Link copied!

Type: package

honkers-railway-launcher package to use.

Default: <derivation honkers-railway-launcher-1.15.1>

programs.sleepy-launcher.enable Link copied!

Type: boolean

Whether to enable sleepy-launcher.

Default: false

programs.sleepy-launcher.package Link copied!

Type: package

sleepy-launcher package to use.

Default: <derivation sleepy-launcher-1.6.6>

programs.wavey-launcher.enable Link copied!

Type: boolean

Whether to enable wavey-launcher.

Default: false

programs.wavey-launcher.package Link copied!

Type: package

wavey-launcher package to use.

Default: <derivation wavey-launcher-1.0.1>

services.copyparty.accounts Link copied!

Type: attribute set of (submodule)

A set of copyparty accounts to create.

Default: { }
Example:
{
  ed.passwordFile = "/run/keys/copyparty/ed";
};

services.copyparty.accounts.<name>.passwordFile Link copied!

Type: string

Runtime file path to a file containing the user password. Must be readable by the copyparty user.

Example: "/run/keys/copyparty/ed"

services.copyparty.enable Link copied!

Type: boolean

Whether to enable web-based file manager.

Default: false
Example: true

services.copyparty.globalExtraConfig Link copied!

Type: string

Appended to the end of the [global] section verbatim. This is useful for flags which are used in a repeating manner (e.g. ipu: 255.255.255.1=user) which can't be repeated in the settings = {} attribute set.

Default: ""

services.copyparty.group Link copied!

Type: string

The group that copyparty will run under.

If changed from default, you are responsible for making sure the user exists.

Default: "copyparty"

services.copyparty.groups Link copied!

Type: attribute set of list of string

A set of copyparty groups to create and the users that should be part of each group.

Default: { }
Example:
{
  group_name = [ "user1" "user2" ];
};

services.copyparty.mkHashWrapper Link copied!

Type: boolean

Make a shell script wrapper called copyparty-hash with all options set here, that launches the hashing cli.

Default: true

services.copyparty.openFilesLimit Link copied!

Type: signed integer or string

Number of files to allow copyparty to open.

Default: 4096

services.copyparty.package Link copied!

Type: package

The copyparty package to use. Package of the application to run, exposed for overriding purposes.

Default: pkgs.copyparty

services.copyparty.settings Link copied!

Type: attribute set

Global settings to apply. Directly maps to values in the [global] section of the copyparty config. Cannot set "c" or "hist", those are set by this module. See copyparty --help for more details.

Default: { hist = "/var/cache/copyparty"; i = "127.0.0.1"; no-reload = true; }
Example:
{
  i = "0.0.0.0";
  no-reload = true;
  hist = /var/cache/copyparty;
}

services.copyparty.user Link copied!

Type: string

The user that copyparty will run under.

If changed from default, you are responsible for making sure the user exists.

Default: "copyparty"

services.copyparty.volumes Link copied!

Type: attribute set of (submodule)

A set of copyparty volumes to create

Default: { "/" = { access = { r = "*"; }; path = "/var/lib/copyparty/data"; }; }
Example:
{
  "/" = {
    path = /var/lib/copyparty/data;
    access = {
      # wG = write-upget = see your own uploads only
      wG = "*";
      # read-write-modify-delete for users "ed" and "k"
      rwmd = ["ed" "k"];
    };
  };
};

services.copyparty.volumes.<name>.access Link copied!

Type: attribute set

Attribute list of permissions and the users to apply them to.

The key must be a string containing any combination of allowed permission:

  • "r" (read): list folder contents, download files
  • "w" (write): upload files; need "r" to see the uploads
  • "m" (move): move files and folders; need "w" at destination
  • "d" (delete): permanently delete files and folders
  • "g" (get): download files, but cannot see folder contents
  • "G" (upget): "get", but can see filekeys of their own uploads
  • "h" (html): "get", but folders return their index.html
  • "a" (admin): can see uploader IPs, config-reload

For example: "rwmd"

The value must be one of:

  • an account name, defined in accounts
  • a list of account names
  • "*", which means "any account"
Default: { }
Example:
{
  # wG = write-upget = see your own uploads only
  wG = "*";
  # read-write-modify-delete for users "ed" and "k"
  rwmd = ["ed" "k"];
};

services.copyparty.volumes.<name>.flags Link copied!

Type: attribute set

Attribute list of volume flags to apply. See copyparty --help-flags for more details.

Default: { }
Example:
{
  # "fk" enables filekeys (necessary for upget permission) (4 chars long)
  fk = 4;
  # scan for new files every 60sec
  scan = 60;
  # volflag "e2d" enables the uploads database
  e2d = true;
  # "d2t" disables multimedia parsers (in case the uploads are malicious)
  d2t = true;
  # skips hashing file contents if path matches *.iso
  nohash = "\.iso$";
};

services.minecraft-servers.dataDir Link copied!

Type: absolute path

Directory to store the Minecraft servers. Each server will be under a subdirectory named after the server name in this directory, such as <literal>/srv/minecraft/servername</literal>.

Default: "/srv/minecraft"

services.minecraft-servers.enable Link copied!

Type: boolean

If enabled, the servers in <option>services.minecraft-servers.servers</option> will be created and started as applicable. The data for the servers will be loaded from and saved to <option>services.minecraft-servers.dataDir</option>

Default: false
Example: true

services.minecraft-servers.environmentFile Link copied!

Type: null or absolute path

File consisting of lines in the form varname=value to define environment variables for the minecraft servers.

Secrets (database passwords, secret keys, etc.) can be provided to server files without adding them to the Nix store by defining them in the environment file and referring to them in option <option>services.minecraft-servers.servers.<name>.files</option> with the syntax @varname@.

Default: null

services.minecraft-servers.eula Link copied!

Type: boolean

Whether you agree to <link xlink:href="https://account.mojang.com/documents/minecraft_eula"> Mojang's EULA</link>. This option must be set to <literal>true</literal> to run Minecraft server.

Default: false
Example: true

services.minecraft-servers.group Link copied!

Type: string

Name of the group to create and run servers under. In order to modify the server files your user must be a part of this group. If you are using the tmux management system (the default), you also need to be a part of this group to attach to the tmux socket. It is recommended to leave this as the default, as it is the same group as <option>services.minecraft-server</option>.

Default: "minecraft"

services.minecraft-servers.managementSystem Link copied!

Type: submodule

The default management system for all servers.

Default: { tmux = { enable = true; }; }
Example:
''
  {
    tmux.enable = false;
    systemd-socket.enable = true;
  }
''

services.minecraft-servers.managementSystem.systemd-socket.enable Link copied!

Type: boolean

management through the systemd journal & a command socket

Default: false
Example: true

services.minecraft-servers.managementSystem.systemd-socket.stdinSocket.mode Link copied!

Type: string matching the pattern [0-7]{4}

Access mode of the socket file in octal notation

Default: "0660"

services.minecraft-servers.managementSystem.systemd-socket.stdinSocket.path Link copied!

Type: function that evaluates to a(n) absolute path

Function from a server name to the path at which the server's stdin socket is placed. You can send the server commands by writing to this socket, for example with shell redirection: echo 'list' > <path to socket>.

Note that while currently the default respects <option>services.minecraft-servers.runDir</option>, that option is deprecated and will be removed. The default will then change to name: "/run/minecraft/${name}.stdin.

Default: name: "${cfg.runDir}/${name}.stdin"

services.minecraft-servers.managementSystem.tmux.enable Link copied!

Type: boolean

Whether to enable management via a TMUX socket.

Default: false
Example: true

services.minecraft-servers.managementSystem.tmux.socketPath Link copied!

Type: function that evaluates to a(n) absolute path

Function from a server name to the path at which the server's tmux socket is placed. To connect to the console, run tmux -S <path to socket> attach, press Ctrl + b then d to detach.

Note that while currently the default respects <option>services.minecraft-servers.runDir</option>, that option is deprecated and will be removed. The default will then change to name: "/run/minecraft/${name}.sock.

Default: name: "${cfg.runDir}/${name}.sock"

services.minecraft-servers.openFirewall Link copied!

Type: boolean

Whether to open ports in the firewall for each server. Sets the default for <option>services.minecraft-servers.servers.<name>.openFirewall</option>.

Default: false
Example: true

services.minecraft-servers.runDir Link copied!

Type: absolute path

Deprecated: Directory to place the runtime tmux sockets into. Each server's console will be a tmux socket file in the form of <literal>servername.sock</literal>. To connect to the console, run tmux -S /run/minecraft/servername.sock attach, press Ctrl + b then d to detach.

Plase use <option>services.minecraft-servers.managementSystem.tmux.socketPath</option>` instead.

Default: "/run/minecraft"

services.minecraft-servers.servers Link copied!

Type: attribute set of (submodule)

Servers to create and manage using this module. Each server can be stopped with <literal>systemctl stop minecraft-server-servername</literal>.

Warning

If the server is not stopped using systemctl, the service will automatically restart the server. See <option>services.minecraft-servers.servers.<name>.restart</option>.

Default: { }

services.minecraft-servers.servers.<name>.autoStart Link copied!

Type: boolean

Whether to start this server on boot. If set to <literal>false</literal>, can still be started with <literal>systemctl start minecraft-server-servername</literal>. Requires the server to be enabled.

Default: true
Example: true

services.minecraft-servers.servers.<name>.bannedPlayers Link copied!

Type: attribute set of ((submodule) or Minecraft UUID convertible to it)

Banned players. See <link xlink:href="https://docs.papermc.io/paper/reference/vanilla-data-files/"/>.

To use a non-declarative banned player list, don't fill in this value. As long as it is empty, no banned players file is generated.

Default: { }
Example:
{
  username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
  username2 = {
    uuid = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
    created = "2025-12-01 09:00:00 -0500";
    source = "(Unknown)";
    expires = "forever";
    reason = "Banned by an operator.";
  };
}

services.minecraft-servers.servers.<name>.bannedPlayers.<name>.created Link copied!

Type: null or string

The date of the ban

Default: null
Example: "2025-12-01 09:00:00 -0500"

services.minecraft-servers.servers.<name>.bannedPlayers.<name>.expires Link copied!

Type: null or string

When the ban expires, if ever

Default: null
Example: "forever"

services.minecraft-servers.servers.<name>.bannedPlayers.<name>.reason Link copied!

Type: null or string

The reason for the ban, if any.

Default: null
Example: "Banned by an operator."

services.minecraft-servers.servers.<name>.bannedPlayers.<name>.source Link copied!

Type: null or string

The source of the ban

Default: null
Example: "Server"

services.minecraft-servers.servers.<name>.bannedPlayers.<name>.uuid Link copied!

Type: Minecraft UUID

The banned player's UUID

Example: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

services.minecraft-servers.servers.<name>.enable Link copied!

Type: boolean

Whether to enable this server. If set to <literal>false</literal>, does NOT delete any data in the data directory, just does not generate the service file.

Default: false
Example: true

services.minecraft-servers.servers.<name>.enableReload Link copied!

Type: boolean

Reload server when configuration changes (instead of restart).

This action re-links/copies the declared symlinks/files. You can include additional actions (even in-game commands) by setting <option>services.minecraft-servers.<name>.extraReload</option>.

Default: false

services.minecraft-servers.servers.<name>.environment Link copied!

Type: attribute set of (null or string or absolute path or package)

Environment variables added to the Minecraft server's processes. Works as <option>systemd.services.<name>.environment</option>.

Default: { }

services.minecraft-servers.servers.<name>.extraReload Link copied!

Type: strings concatenated with "\n"

Extra commands to run when reloading the service. Only has an effect if <option>services.minecraft-servers.<name>.enableReload</option> is true.

Default: ""

services.minecraft-servers.servers.<name>.extraStartPost Link copied!

Type: strings concatenated with "\n"

Extra commands to run after starting the service.

Default: ""

services.minecraft-servers.servers.<name>.extraStartPre Link copied!

Type: strings concatenated with "\n"

Extra commands to run before starting the service.

Default: ""

services.minecraft-servers.servers.<name>.extraStopPost Link copied!

Type: strings concatenated with "\n"

Extra commands to run after stopping the service.

Default: ""

services.minecraft-servers.servers.<name>.extraStopPre Link copied!

Type: strings concatenated with "\n"

Extra commands to run before stopping the service.

Default: ""

services.minecraft-servers.servers.<name>.files Link copied!

Type: attribute set of (absolute path or (submodule))

Things to copy into this server's data directory. Similar to symlinks, but these are actual, writable, files. Useful for configuration files that don't behave well when read-only. Directories are copied recursively and dereferenced. They will be deleted after the server stops, so any modification is discarded.

These files may include placeholders to substitute with values from <option>services.minecraft-servers.environmentFile</option> (i.e. @variable_name@).

Default: { }

services.minecraft-servers.servers.<name>.jvmOpts Link copied!

Type: strings concatenated with " " or (list of string) convertible to it

JVM options for this server.

Default: "-Xmx2G -Xms1G"

services.minecraft-servers.servers.<name>.managementSystem Link copied!

Type: submodule

Configuration for the system used to manage this server. Overrides the global configuration on an option-by-option basis.

Default: { }
Example:
''
  {
    tmux.enable = false;
    systemd-socket.enable = true;
  }
''

services.minecraft-servers.servers.<name>.managementSystem.systemd-socket.enable Link copied!

Type: boolean

management through the systemd journal & a command socket

Default: false
Example: true

services.minecraft-servers.servers.<name>.managementSystem.systemd-socket.stdinSocket.mode Link copied!

Type: string matching the pattern [0-7]{4}

Access mode of the socket file in octal notation

Default: "0660"

services.minecraft-servers.servers.<name>.managementSystem.systemd-socket.stdinSocket.path Link copied!

Type: function that evaluates to a(n) absolute path

Function from a server name to the path at which the server's stdin socket is placed. You can send the server commands by writing to this socket, for example with shell redirection: echo 'list' > <path to socket>.

Note that while currently the default respects <option>services.minecraft-servers.runDir</option>, that option is deprecated and will be removed. The default will then change to name: "/run/minecraft/${name}.stdin.

Default: name: "${cfg.runDir}/${name}.stdin"

services.minecraft-servers.servers.<name>.managementSystem.tmux.enable Link copied!

Type: boolean

Whether to enable management via a TMUX socket.

Default: false
Example: true

services.minecraft-servers.servers.<name>.managementSystem.tmux.socketPath Link copied!

Type: function that evaluates to a(n) absolute path

Function from a server name to the path at which the server's tmux socket is placed. To connect to the console, run tmux -S <path to socket> attach, press Ctrl + b then d to detach.

Note that while currently the default respects <option>services.minecraft-servers.runDir</option>, that option is deprecated and will be removed. The default will then change to name: "/run/minecraft/${name}.sock.

Default: name: "${cfg.runDir}/${name}.sock"

services.minecraft-servers.servers.<name>.openFirewall Link copied!

Type: boolean

Whether to open ports in the firewall for this server.

Default: "The value of <literal>services.minecraft-servers.openFirewall</literal>"

services.minecraft-servers.servers.<name>.operators Link copied!

Type: attribute set of ((submodule) or Minecraft UUID convertible to it)

Server operators. See <link xlink:href="https://minecraft.wiki/w/Ops.json_format"/>.

To use a non-declarative operator list, don't fill in this value. As long as it is empty, no operators file is generated.

Default: { }
Example:
{
  username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
  username2 = {
    uuid = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
    level = 3;
    bypassesPlayerLimit = true;
  };
}

services.minecraft-servers.servers.<name>.operators.<name>.bypassesPlayerLimit Link copied!

Type: boolean

If true, the operator can join the server even if the player limit has been reached

Default: false

services.minecraft-servers.servers.<name>.operators.<name>.level Link copied!

Type: integer between 0 and 4 (both inclusive)

The operator's permission level

Default: 4

services.minecraft-servers.servers.<name>.operators.<name>.uuid Link copied!

Type: Minecraft UUID

The operator's UUID

Example: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

services.minecraft-servers.servers.<name>.package Link copied!

Type: package

The Minecraft server package to use.

Default: pkgs.minecraft-server
Example: "pkgs.minecraftServers.vanilla-1_18_2"

services.minecraft-servers.servers.<name>.path Link copied!

Type: list of (absolute path or string)

Packages added to the Minecraft server's <literal>PATH</literal> environment variable. Works as <option>systemd.services.<name>.path</option>.

Default: [ ]

services.minecraft-servers.servers.<name>.restart Link copied!

Type: string

Value of systemd's <literal>Restart=</literal> service configuration option. If you are using the tmux management system (the default), values other than <literal>"no"</literal> and <literal>"always"</literal> may not work properly. As a consequence of the <literal>"always"</literal> option, stopping the server in-game with the <literal>stop</literal> command will cause the server to automatically restart.

Default: "always"

services.minecraft-servers.servers.<name>.serverProperties Link copied!

Type: attribute set of (boolean or signed integer or string)

Minecraft server properties for the server.properties file of this server. See <link xlink:href="https://minecraft.gamepedia.com/Server.properties#Java_Edition_3"/> for documentation on these values.

To use a non-declarative server.properties, don't fill in this value. As long as it is empty, no server.properties file is generated.

Default: { }
Example:
{
  server-port = 43000;
  difficulty = 3;
  gamemode = 1;
  max-players = 5;
  motd = "NixOS Minecraft server!";
  white-list = true;
  enable-rcon = true;
  "rcon.password" = "hunter2";
}

services.minecraft-servers.servers.<name>.stopCommand Link copied!

Type: null or string

Console command to run when cleanly stopping the server (ExecStop). Defaults to <literal>stop</literal>, which works for most servers. For proxies (bungeecord, velocity), you should set <literal>end</literal>.

If set to <literal>null</literal>, the server will be stopped by systemd without issuing any command.

Default: "stop"

services.minecraft-servers.servers.<name>.whitelist Link copied!

Type: attribute set of Minecraft UUID

Whitelisted players, only has an effect when enabled via <option>services.minecraft-servers.<name>.serverProperties</option> by setting <literal>white-list</literal> to <literal>true</literal.

To use a non-declarative whitelist, enable the whitelist and don't fill in this value. As long as it is empty, no whitelist file is generated.

Default: { }
Example:
{
  username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
  username2 = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
}

services.takina.config.botName Link copied!

Type: string

The name of the bot used throughout the bot's commands.

Default: "Takina"

services.takina.config.embedColor Link copied!

Type: string

The colour of embed responses.

Default: "#2B2D31"

services.takina.config.libretranslateApiUrl Link copied!

Type: string

The API URL of the LibeTranslate instance to use for the translation cog.

Default: null

services.takina.config.prefix Link copied!

Type: string

The command prefix for Takina to listen for.

Default: "."

services.takina.database.createLocally Link copied!

Type: boolean

Create the database and database user locally.

Default: true

services.takina.database.hostname Link copied!

Type: string

Database hostname

Default: "localhost"

services.takina.database.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Database port

Default: 27017

services.takina.enable Link copied!

Type: boolean

Whether to enable Takina Discord bot.

Default: false
Example: true

services.takina.environmentFile Link copied!

Type: null or absolute path

Path to a environment file, usually used for passing sensitive environment variables to Takina such as the Discord bot token.

Default: null

services.takina.group Link copied!

Type: string

Group under which Takina runs.

Default: "takina"

services.takina.package Link copied!

Type: package

The Takina package to use.

Default: <derivation takina-1.20.4>

services.takina.user Link copied!

Type: string

User account under which Takina runs.

Default: "takina"

sops.age.generateKey Link copied!

Type: boolean

Whether or not to generate the age key. If this option is set to false, the key must already be present at the specified location.

Default: false

sops.age.keyFile Link copied!

Type: null or path not in the Nix store

Path to age key file used for sops decryption.

Default: null
Example: "/var/lib/sops-nix/key.txt"

sops.age.plugins Link copied!

Type: list of package

List of plugins to use for sops decryption.

Default: [ ]

sops.age.sshKeyPaths Link copied!

Type: list of absolute path

Paths to ssh keys added as age keys during sops description.

Default: The ed25519 keys from {option}`config.services.openssh.hostKeys`

sops.defaultSopsFile Link copied!

Type: absolute path

Default sops file used for all secrets.

sops.defaultSopsFormat Link copied!

Type: string

Default sops format used for all secrets.

Default: "yaml"

sops.defaultSopsKey Link copied!

Type: null or string

Default key used to lookup in all secrets. This option is ignored if format is binary. "" means whole file.

Default: null

sops.environment Link copied!

Type: attribute set of (string or absolute path)

Environment variables to set before calling sops-install-secrets.

The values are placed in single quotes and not escaped any further to allow usage of command substitutions for more flexibility. To properly quote strings with quotes use lib.escapeShellArg.

This will be evaluated twice when using secrets that use neededForUsers but in a subshell each time so the environment variables don't collide.

Default: { }

sops.gnupg.home Link copied!

Type: null or string

Path to gnupg database directory containing the key for decrypting the sops file.

Default: null
Example: "/root/.gnupg"

sops.gnupg.package Link copied!

Type: package

The gnupg package to use for sops operations.

Default: pkgs.gnupg

sops.gnupg.sshKeyPaths Link copied!

Type: list of absolute path

Path to ssh keys added as GPG keys during sops description. This option must be explicitly unset if <literal>config.sops.gnupg.home</literal> is set.

Default: The rsa keys from {option}`config.services.openssh.hostKeys`

sops.keepGenerations Link copied!

Type: unsigned integer, meaning >=0

Number of secrets generations to keep. Setting this to 0 disables pruning.

Default: 1

sops.log Link copied!

Type: list of (one of "keyImport", "secretChanges")

What to log

Default: [ "keyImport" "secretChanges" ]

sops.package Link copied!

Type: package

sops-install-secrets package to use.

Default: (pkgs.callPackage ../.. {}).sops-install-secrets

sops.secrets Link copied!

Type: attribute set of (submodule)

Path where the latest secrets are mounted to.

Default: { }

sops.secrets.<name>.format Link copied!

Type: one of "yaml", "json", "binary", "dotenv", "ini"

File format used to decrypt the sops secret. Binary files are written to the target file as is.

Default: "yaml"

sops.secrets.<name>.gid Link copied!

Type: null or signed integer

GID of the file, only applied when group is null. The GID will be applied even if the corresponding group doesn't exist.

Default: 0

sops.secrets.<name>.group Link copied!

Type: null or string

Group of the file. Can only be set if gid is 0.

Default: {option}`config.users.users.${owner}.group`

sops.secrets.<name>.key Link copied!

Type: string

Key used to lookup in the sops file. No tested data structures are supported right now. This option is ignored if format is binary. "" means whole file.

Default: "‹name›"

sops.secrets.<name>.mode Link copied!

Type: string

Permissions mode of the in octal.

Default: "0400"

sops.secrets.<name>.name Link copied!

Type: string

Name of the file used in /run/secrets

Default: "‹name›"

sops.secrets.<name>.neededForUsers Link copied!

Type: boolean

Enabling this option causes the secret to be decrypted before users and groups are created. This can be used to retrieve user's passwords from sops-nix. Setting this option moves the secret to /run/secrets-for-users and disallows setting owner and group to anything else than root.

Default: false

sops.secrets.<name>.owner Link copied!

Type: null or string

User of the file. Can only be set if uid is 0.

Default: null

sops.secrets.<name>.path Link copied!

Type: string

Path where secrets are symlinked to. If the default is kept no symlink is created.

Default: "/run/secrets-for-users/$name when neededForUsers is set, /run/secrets/$name when otherwise."

sops.secrets.<name>.reloadUnits Link copied!

Type: list of string

Names of units that should be reloaded when this secret changes. This works the same way as <xref linkend="opt-systemd.services.name.reloadTriggers" />.

Default: [ ]
Example:
[
  "sshd.service"
]

sops.secrets.<name>.restartUnits Link copied!

Type: list of string

Names of units that should be restarted when this secret changes. This works the same way as <xref linkend="opt-systemd.services.name.restartTriggers" />.

Default: [ ]
Example:
[
  "sshd.service"
]

sops.secrets.<name>.sopsFile Link copied!

Type: absolute path

Sops file the secret is loaded from.

Default: ${config.sops.defaultSopsFile}

sops.secrets.<name>.sopsFileHash Link copied!

Type: string

Hash of the sops file, useful in <xref linkend="opt-systemd.services.name.restartTriggers" />.

sops.secrets.<name>.uid Link copied!

Type: null or signed integer

UID of the file, only applied when owner is null. The UID will be applied even if the corresponding user doesn't exist.

Default: 0

sops.templates Link copied!

Type: attribute set of (submodule)

Templates for secret files

Default: { }

sops.templates.<name>.content Link copied!

Type: strings concatenated with "\n"

Content of the file

Default: ""

sops.templates.<name>.file Link copied!

Type: absolute path

File used as the template. When this value is specified, sops.templates.<name>.content is ignored.

Default: pkgs.writeText config.name config.content
Example: "./configuration-template.conf"

sops.templates.<name>.gid Link copied!

Type: null or signed integer

GID of the template, only applied when group is null. The GID will be applied even if the corresponding group doesn't exist.

Default: 0

sops.templates.<name>.group Link copied!

Type: null or (optionally newline-terminated) single-line string

Group of the file. Can only be set if gid is 0.

Default: config.users.users.${cfg.owner}.group

sops.templates.<name>.mode Link copied!

Type: (optionally newline-terminated) single-line string

Permissions mode of the rendered secret file in octal.

Default: "0400"

sops.templates.<name>.name Link copied!

Type: (optionally newline-terminated) single-line string

Name of the file used in /run/secrets/rendered

Default: "‹name›"

sops.templates.<name>.owner Link copied!

Type: null or (optionally newline-terminated) single-line string

User of the file. Can only be set if uid is 0;

Default: null

sops.templates.<name>.path Link copied!

Type: (optionally newline-terminated) single-line string

Path where the rendered file will be placed

Default: "/run/secrets/rendered/‹name›"

sops.templates.<name>.reloadUnits Link copied!

Type: list of string

Names of units that should be reloaded when the rendered template changes. This works the same way as <xref linkend="opt-systemd.services.name.reloadTriggers" />.

Default: [ ]
Example:
[
  "sshd.service"
]

sops.templates.<name>.restartUnits Link copied!

Type: list of string

Names of units that should be restarted when the rendered template changes. This works the same way as <xref linkend="opt-systemd.services.name.restartTriggers" />.

Default: [ ]
Example:
[
  "sshd.service"
]

sops.templates.<name>.uid Link copied!

Type: null or signed integer

UID of the template, only applied with owner is null. the UID will be applied even if the corresponding user doesn't exist.

Default: 0

sops.useSystemdActivation Link copied!

Type: boolean

Use a systemd unit to install secrets, instead of deploying them using an activation script.

This option is automatically enabled when systemd-sysusers or userborn are used to manage users and groups. It can also be useful to specify additional dependencies to be satisfied before secrets are installed, such as required mountpoints for SOPS key files.

Default: (options.systemd ? sysusers && config.systemd.sysusers.enable) || (options.services ? userborn && config.services.userborn.enable)

sops.useTmpfs Link copied!

Type: boolean

Use tmpfs in place of ramfs for secrets storage.

WARNING On Linux kernels earlier than 6.4, enabling this option has the potential to write secrets to disk unencrypted if the tmpfs volume is written to swap. Do not use unless absolutely necessary.

When using a swap file or device, consider enabling swap encryption by setting the randomEncryption.enable option

swapDevices = [{
  device = "/dev/sdXY";
  randomEncryption.enable = true;
}];
Default: false

sops.validateSopsFiles Link copied!

Type: boolean

Check all sops files at evaluation time. This requires sops files to be added to the nix store.

Default: true

sops.validationPackage Link copied!

Type: package

sops-install-secrets package to use when validating configuration.

Defaults to sops.package if building natively, and a native version of sops-install-secrets if cross compiling.

Default: config.sops.package

systemd.services Link copied!

Type: attribute set of (submodule)

This option has no description.

systemd.services.<name>.vpnConfinement.enable Link copied!

Type: boolean

Whether to confine the systemd service in a networking namespace which routes traffic through a VPN tunnel and forces a specified DNS.

Default: false

systemd.services.<name>.vpnConfinement.vpnNamespace Link copied!

Type: string

Name of the VPN networking namespace to use for the systemd service.

Default: null
Example: "wg"

vpnNamespaces Link copied!

Type: attribute set of (submodule)

This option has no description.

Default: { }

vpnNamespaces.<name>.accessibleFrom Link copied!

Type: list of (valid ipv4 or ipv6 address with optional mask)

Subnets, ranges, and specific addresses that the namespace should be accessible to.

Default: [ ]
Example:
[
  "10.0.2.0/24"
  "192.168.1.27"
  "fd25:9ab6:6133::/64"
  "fd25:9ab6:6133::203"
]

vpnNamespaces.<name>.bridgeAddress Link copied!

Type: valid ipv4 address with optional mask

The address of the linux bridge on the default namespace.

The linux bridge sits on the default namespace and needs an address to make communication between connected namespaces possible, including the default namespace.

Default: "192.168.15.5"

vpnNamespaces.<name>.bridgeAddressIPv6 Link copied!

Type: valid ipv6 address with optional mask

The address of the linux bridge on the default namespace.

The linux bridge sits on the default namespace and needs an address to make communication between connected namespaces possible, including the default namespace.

Default: "fd93:9701:1d00::1"

vpnNamespaces.<name>.enable Link copied!

Type: boolean

Whether to enable the VPN namespace.

To access the networking namespace(netns) a veth pair is created to connect it and the default namespace through a linux bridge. One end of the pair is connected to the linux bridge on the default netns. The other end is connected to the vpn netns.

Default: false
Example: true

vpnNamespaces.<name>.namespaceAddress Link copied!

Type: valid ipv4 address with optional mask

The address of the veth interface connected to the vpn namespace.

This is the address used to reach the vpn namespace from other namespaces connected to the linux bridge.

Default: "192.168.15.1"

vpnNamespaces.<name>.namespaceAddressIPv6 Link copied!

Type: valid ipv6 address with optional mask

The address of the veth interface connected to the vpn namespace.

This is the address used to reach the vpn namespace from other namespaces connected to the linux bridge.

Default: "fd93:9701:1d00::2"

vpnNamespaces.<name>.openVPNPorts Link copied!

Type: list of (submodule)

Ports that should be accessible through the VPN interface.

Default: [ ]

vpnNamespaces.<name>.openVPNPorts.*.port Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

The port to open.

vpnNamespaces.<name>.openVPNPorts.*.protocol Link copied!

Type: one of "tcp", "udp", "both"

The transport layer protocol to use.

Default: "tcp"
Example: "both"

vpnNamespaces.<name>.portMappings Link copied!

Type: list of (submodule)

A list of port mappings from the host to ports in the namespace. Neither the 'to' or 'from' ports should be open on the default netns as they are routed to the VPN netns. The 'to' ports are automatically opened in the VPN netns.

Default: [ ]
Example:
[
  {
    from = 80;
    protocol = "tcp";
    to = 80;
  }
]

vpnNamespaces.<name>.portMappings.*.from Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port on the default netns.

Example: 80

vpnNamespaces.<name>.portMappings.*.protocol Link copied!

Type: one of "tcp", "udp", "both"

The transport layer protocol to use.

Default: "tcp"
Example: "both"

vpnNamespaces.<name>.portMappings.*.to Link copied!

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Port on the VPN netns.

Example: 443

vpnNamespaces.<name>.wireguardConfigFile Link copied!

Type: absolute path

Path to a wg-quick config file.

Default: null
Example: "/secret/wg0.conf"