Hosting resources
This page documents the concrete request options each resource module
declares: the options a component sets to request a resource from a hosting
provider. For the generic request/policy pattern these build on, see the
data model page; for how a provider configures the matching
side, see how a hosting provider configures these
below, which ties these options to the data model's
environments.
The data model declares each resource's request as a deferred module, so the
concrete sub-options live in the resource configuration rather than in the
option type. This page surfaces them by building a submodule from each
resource's request module, giving the <name>.request.* options below.
The resources documented here are the ones wired into the data model under
core/resources:
authelia-- single sign-on (OIDC clients).garage-- S3-compatible object storage (buckets and access keys).network-- networking.nixos-module-- a raw NixOS module contribution.otel-- OpenTelemetry collection.secrets-- secret names a component needs provisioned.
Resource policies (how a hosting provider makes a resource available) are
provider-facing and carry computed defaults that reference options only defined
for a concrete deployment, so they are documented through the generic
resources.<name>.policy structure on the data model page
rather than here.
How a hosting provider configures these
The <name>.request.* options below are the component-facing half of a
resource. A hosting provider does not set them directly; they configure the
environment a component is deployed to. An environment is one entry of the
data model's environments option, and the environments
section of the example at examples/hosting-config.nix shows the shape: an
attrset keyed by environment name.
A provider points the HOSTING_CONFIG environment variable at such a file. The
file has two sections: environments (the provider resources described here) and
effect-defaults (operator-form leaf defaults, a map keyed by effect tag). The
environments attrset is
lib.recursiveUpdate-merged on top of the defaults (provider config wins). The
file may be a .nix, a .toml or a .json file -- the loader dispatches on the
extension. examples/hosting-config.toml shows the TOML form of the same
override. JSON is there for a generator rather than a hand: it is what
services.fediversity-api.hostingConfig renders the provider's curation to.
TOML is sufficient for the common case because the override surface is plain
data, but it cannot represent function values, derivations/packages, or null;
those only appear in resource policies (defaults), not the override. Reach for
the .nix form when you need any of them (or .json, for null alone). Two
TOML hand-authoring caveats:
- Override values are type-checked against the resource policy's option types after the merge, so encode each as the plain-data equivalent the option coerces from; mismatches surface as normal module eval errors.
- Use dotted-table headers (
[mastodon.resources.garage.external]), not array-of-tables (<a href="....html" class="obsidian-link">...</a>) -- the latter parses to a list and fails the merge. The example file demonstrates the correct form.
Each environment is more than its resources. Besides the resources sub-option
(where the policies matching the requests below are declared, keyed by resource
name), an environment also carries the functions that turn a configuration into
a deployment:
resources-- the per-resource policies the provider offers; this is the sub-option to which the request options below are relevant.implementation-- maps the components' required resources to this environment's resources.resource-mapping-- the function type ofimplementation.config-mapping-- maps an operator configuration to a deployment.deployment-- the end-to-end entry point applying the environment's policies to the components' resource mappings.
Those sibling options are config-dependent functions rather than concrete
values, so they are documented informally on the
data model page rather than shown with concrete
types here. The options on this page are specifically the request shape a
component declares and an environment's resources policies are matched
against.
Request options
dns
Authoritative-DNS coordinates for an application, fulfilled by either a self-hosted bind node or an external service, through the local dns contract.
Type: submodule
dns.request
Options a component sets to request this resource.
Type: submodule
dns.request.enable
Whether to enable authoritative-DNS coordinates on this application’s host.
Type: boolean
Default:
false
Example:
true
Declared by:
dns.request.consumerName
Unique consumer name for this app (analog of ldap’s/redis’s
consumerName), used as the contracts.dns.want.<consumerName>
key.
Type: string
Declared by:
dns.request.nixos-configuration
NixOS configuration module merged onto the application node, fed
the resolved contract result ({ provider; host; port; scheme; apiTokenFile; domain; }) so the application
can address the group’s authoritative-DNS.
Type: function that evaluates to a(n) unspecified value
Declared by:
firewall
Which sources reach a node, and which of the ports it serves are published beyond them.
Type: submodule
firewall.request
Options a component sets to request this resource.
Type: submodule
firewall.request.publicTCPPorts
TCP ports this application needs reachable from the whole internet rather than from the deployment’s own peers only.
Request this only for a port whose users are outside the
deployment by nature – an ingest, a federation endpoint, a
browser-facing listener. Everything else is reachable from
internalSources without asking.
The application still has to serve the port the ordinary way
(networking.firewall.allowedTCPPorts, or an upstream module’s
openFirewall); this says who may reach it, not that it exists.
Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)
Default:
[ ]
Example:
[
1935
]
Declared by:
firewall.request.publicUDPPorts
UDP counterpart of publicTCPPorts.
Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)
Default:
[ ]
Example:
[
53
]
Declared by:
garage
Garage storage configuration for an application.
Type: submodule
garage.request
Options a component sets to request this resource.
Type: submodule
garage.request.enable
Whether to enable Enable a Garage server on the machine.
Type: boolean
Default:
false
Example:
true
Declared by:
garage.request.ensureBuckets
S3 buckets to create on Garage for this application, keyed by bucket name. Each entry is provisioned (and configured for website serving, CORS, and aliases) when the deployment runs.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
garage.request.ensureBuckets.<name>.aliases
Additional global bucket aliases (alternative names) to register for this bucket in Garage.
Type: list of string
Default:
[ ]
Declared by:
garage.request.ensureBuckets.<name>.corsRules.enable
Whether to enable CORS rules on this bucket, allowing other origins (e.g. a frontend) to fetch its objects from the browser.
Type: boolean
Default:
false
Example:
true
Declared by:
garage.request.ensureBuckets.<name>.corsRules.allowedHeaders
Request headers permitted by the bucket’s CORS policy (the AllowedHeaders of the S3 CORS rule).
Type: list of string
Default:
[ ]
Declared by:
garage.request.ensureBuckets.<name>.corsRules.allowedMethods
HTTP methods (e.g. GET, PUT) permitted by the bucket’s CORS policy.
Type: list of string
Default:
[ ]
Declared by:
garage.request.ensureBuckets.<name>.corsRules.allowedOrigins
Origins (e.g. https://app.example.org) allowed to make cross-origin requests to the bucket.
Type: list of string
Default:
[ ]
Declared by:
garage.request.ensureBuckets.<name>.serveAsWebsite
Whether to serve this bucket’s contents as a static website over HTTP, so its objects are publicly reachable by URL.
Type: boolean
Default:
false
Declared by:
garage.request.ensureKeys
S3 access keys to provision on Garage for this application, keyed by key name. Each key is imported from the given credential files and granted the configured per-bucket access.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
garage.request.ensureKeys.<name>.ensureAccess
Per-bucket access this key is granted, keyed by bucket name. At least one of read/write/owner should be set per bucket.
Type: attribute set of (submodule)
Default:
[ ]
Declared by:
garage.request.ensureKeys.<name>.ensureAccess.<name>.owner
Grant this key owner permission on the bucket (manage the bucket itself, not just its objects).
Type: boolean
Default:
false
Declared by:
garage.request.ensureKeys.<name>.ensureAccess.<name>.read
Grant this key permission to read objects from the bucket.
Type: boolean
Default:
false
Declared by:
garage.request.ensureKeys.<name>.ensureAccess.<name>.write
Grant this key permission to write objects to the bucket.
Type: boolean
Default:
false
Declared by:
garage.request.ensureKeys.<name>.kvName
OpenBao KV instance stem the key’s credentials publish under (<kvName>-s3). Defaults to the key name; not tenant-prefixed.
Type: string
Default:
"‹name›"
Declared by:
garage.request.ensureKeys.<name>.s3AccessKeyFile
Path to a file holding the S3 access key id to import
for this key. The in-Nix (garageSide) provisioner
imports a pre-generated key from it; the tf
provisioner has garage create the key and captures the
secret from state, so it leaves this null. The path is
the rendered read-back location, not a generation
source.
Type: null or absolute path
Default:
null
Declared by:
garage.request.ensureKeys.<name>.s3SecretKeyFile
Path to a file containing the S3 secret access key paired with s3AccessKeyFile. Null for the tf provisioner (see s3AccessKeyFile).
Type: null or absolute path
Default:
null
Declared by:
garage.request.nixos-configuration
The NixOS configuration module to include.
Type: function that evaluates to a(n) unspecified value
Declared by:
generateFiles
Declarative generation of an application’s secret files, via the generateFiles contract.
Type: submodule
generateFiles.request
Options a component sets to request this resource.
Type: submodule
generateFiles.request.instances
Generation instances this application needs run on its host, keyed
by name. Each mirrors a contracts.generateFiles request: a
script producing the named files under $out/. The vars
provider bridges each generated file into
contracts.fileSecrets.want.vars.<name>_<file>, read back via
config.contracts.fileSecrets.results.vars.<name>_<file>.path.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
generateFiles.request.instances.<name>.dependencies
Names of other instances whose outputs are made available under $in/<name>/.
Type: list of string
Default:
[ ]
Declared by:
generateFiles.request.instances.<name>.files
Files to generate; keys are file names the script must write under $out/.
Type: attribute set of (submodule)
Declared by:
generateFiles.request.instances.<name>.files.<name>.group
Unix group that must own the generated file.
Type: string
Default:
"root"
Declared by:
generateFiles.request.instances.<name>.files.<name>.mode
File permissions as an octal string.
Type: string
Default:
"0400"
Declared by:
generateFiles.request.instances.<name>.files.<name>.owner
Unix user that must own the generated file.
Type: string
Default:
"root"
Declared by:
generateFiles.request.instances.<name>.files.<name>.secret
Whether the file contains sensitive data.
Type: boolean
Default:
true
Declared by:
generateFiles.request.instances.<name>.independent
Whether the instance’s files stand on their own. An atomic instance (the default) refuses to run in a partial state; an independent one generates only what is missing, so it can grow a file without rotating its siblings.
Type: boolean
Default:
false
Declared by:
generateFiles.request.instances.<name>.runtimeInputs
Packages available in PATH during script execution.
Type: list of package
Default:
[ ]
Declared by:
generateFiles.request.instances.<name>.script
Shell script writing each declared file to $out/<name>.
Dependency outputs are available under $in/<dep>/.
Type: string
Declared by:
ldap
LDAP directory access for an application, fulfilled by an lldap-backed provider of the nixpkgs ldap contract.
Type: submodule
ldap.request
Options a component sets to request this resource.
Type: submodule
ldap.request.enable
Whether to enable LDAP directory access for the application.
Type: boolean
Default:
false
Example:
true
Declared by:
ldap.request.consumerName
Unique consumer name for this app (analog of oidc’s clientID),
used as the contracts.ldap.want.<consumerName> key.
Type: string
Declared by:
ldap.request.group
LDAP group the application requires. The provider creates this
group. Carried verbatim by the nixpkgs ldap contract request.
Type: string
Declared by:
ldap.request.nixos-configuration
NixOS configuration module merged onto the application node, fed the
cross-node-resolved contract result (host, port, baseDN, bindDN,
bindPasswordFile) so the application can configure its LDAP client.
Type: function that evaluates to a(n) unspecified value
Declared by:
netbox
NetBox IPAM coordinates for an application, fulfilled by either a self-hosted NetBox node or an external instance, through the local netbox contract.
Type: submodule
netbox.request
Options a component sets to request this resource.
Type: submodule
netbox.request.enable
Whether to enable NetBox IPAM coordinates on this application’s host.
Type: boolean
Default:
false
Example:
true
Declared by:
netbox.request.consumerName
Unique consumer name for this app (analog of ldap’s/redis’s
consumerName), used as the contracts.netbox.want.<consumerName>
key.
Type: string
Declared by:
netbox.request.nixos-configuration
NixOS configuration module merged onto the application node, fed
the resolved contract result ({ serverUrl; apiTokenFile; clusterName; tenant; prefixSelector; rangeSelector; }) so the application
can address the group’s NetBox IPAM.
Type: function that evaluates to a(n) unspecified value
Declared by:
network
Networking info.
Type: submodule
network.request
Options a component sets to request this resource.
Type: submodule
nixos-module
A NixOS configuration module to include as-is.
Type: submodule
nixos-module.request
Options a component sets to request this resource.
Type: submodule
nixos-module.request.module
The NixOS configuration module to include.
Type: unspecified value
Declared by:
oidc
Single sign-on (OIDC) for an application, fulfilled by an authelia-backed provider of the nixpkgs oidc contract.
Type: submodule
oidc.request
Options a component sets to request this resource.
Type: submodule
oidc.request.enable
Whether to enable an OIDC single-sign-on client for the application.
Type: boolean
Default:
false
Example:
true
Declared by:
oidc.request.authorizationPolicy
Authelia authorization policy applied to the client
(one_factor, two_factor, or a named policy).
Type: string
Default:
"two_factor"
Declared by:
oidc.request.clientID
Client ID to register with the OIDC provider. Null for a
forwardAuth request (which registers no OIDC client – authelia
protects the vhost through nginx auth_request, not a redirect
flow).
Type: null or string
Default:
null
Declared by:
oidc.request.forwardAuth
Forward-auth protection for a plain (non-OIDC) admin UI vhost,
instead of an OIDC client. A request is EITHER an OIDC client
(clientID/redirectURI set) OR a forward-auth protection
(forwardAuth.enable). When set, nginx fronts upstream with an
auth_request to authelia’s /api/authz/auth-request endpoint, so
only authenticated sessions reach the UI – used for services with
no native OIDC (garage-webui, pgweb, redis-commander, windmill).
Type: null or (submodule)
Default:
null
Declared by:
oidc.request.forwardAuth.enable
Whether to enable forward-auth protection for this UI vhost.
Type: boolean
Default:
false
Example:
true
Declared by:
oidc.request.forwardAuth.adminUI
Whether this vhost belongs to the hosting provider’s
admin-UI category, which deployAdminUIs gates as a whole.
True for a prod convenience fronting a backend with no native OIDC (garage-webui, pgweb, redis-commander). Set false for a UI that is part of the service it fronts and that every group running that service needs – lldap’s own web UI, which is the directory’s self-service surface.
Type: boolean
Default:
true
Declared by:
oidc.request.forwardAuth.allowedGroups
Restrict access to members of these authelia groups. Empty
(the default) allows any authenticated user (subject to
authorizationPolicy).
Type: list of string
Default:
[ ]
Declared by:
oidc.request.forwardAuth.authorizationPolicy
Authelia authorization policy for this domain (one_factor
suffices for any authenticated user; two_factor for MFA).
Type: string
Default:
"one_factor"
Declared by:
oidc.request.forwardAuth.domain
Public domain the protected UI is served under, stated in
full (e.g. garage-webui.example.org). For a UI published
in a zone this deployment does not own; subdomain below
is what names one under the deployment’s own domain.
Exactly one of the two is set – see
./forward-auth-domain.nix, which resolves them.
Type: null or string
Default:
null
Declared by:
oidc.request.forwardAuth.nixos-configuration
NixOS configuration module merged onto the node serving the
protected UI (e.g. the systemd service running the UI). A
function of the resource policy config.
Type: function that evaluates to a(n) unspecified value
Declared by:
oidc.request.forwardAuth.proxyWebsockets
Pass websocket upgrades through to the protected UI. Needed by a UI that streams over a websocket – the windmill UI’s job logs – and off by default, since the plain admin UIs (garage-webui, pgweb, redis-commander, lldap) do not.
Type: boolean
Default:
false
Declared by:
oidc.request.forwardAuth.subdomain
The label the protected UI is served under, hung off the
deployment’s own deploymentDomain.
What a component SHARED between groups states: a tenant
deployment’s domain is the tenant’s own name, and a shared
component that instead reaches for the static apex
(core/apex.nix) names the hosting provider’s node from
inside the tenant’s deployment – a name the tenant may
neither publish nor hold a certificate for.
Type: null or string
Default:
null
Declared by:
oidc.request.forwardAuth.upstream
Proxy target nginx forwards to once authenticated (e.g. 127.0.0.1:3909).
Type: string
Declared by:
oidc.request.forwardAuth.upstreamAuthorizationInclude
nginx include pattern pulled into location /, for a
protected UI that cannot log a user in itself: one who has
just cleared the portal would otherwise be met by a second,
unrelated login form. A unit on the node drops a
proxy_set_header Authorization ...; line matching this
pattern once it holds a token to present, and the gate then
presents it on that user’s behalf.
A glob rather than a fixed path, because nginx has to start
before that unit has ever run: an include of a missing
file refuses to load, while one whose mask matches nothing
is not an error.
Null (the default) leaves the gate a plain proxy, which is
what a UI that authenticates the forwarded Remote-User
itself wants.
Type: null or string
Default:
null
Declared by:
oidc.request.jwtAccessTokens
Issue RFC 9068 JWT-profile access tokens to this client
(access_token_signed_response_alg: RS256) instead of
authelia’s default opaque tokens. For consumers that verify
the bearer access token locally as a JWT against the issuer’s
JWKS, e.g. the incus daemon, which parses every bearer token
and rejects an opaque one with “token contains an invalid
number of segments”.
Type: boolean
Default:
false
Declared by:
oidc.request.nixos-configuration
NixOS configuration module merged onto the application node, so the
application can read back its fulfilled contract result via
config.contracts.oidc.results.<app>.<instance>.
Type: function that evaluates to a(n) unspecified value
Declared by:
oidc.request.public
Register the client as a public OIDC client (no client
secret; token_endpoint_auth_method: none, PKCE enforced).
For consumers that cannot hold a secret, e.g. the incus UI,
whose token exchange sends no client authentication.
Type: boolean
Default:
false
Declared by:
oidc.request.redirectURI
Primary callback URI the provider should redirect to after
authentication. This is the value carried by the nixpkgs oidc
contract request; additional URIs go in redirectURIs. Null for a
forwardAuth request (no redirect flow).
Type: null or string
Default:
null
Declared by:
oidc.request.redirectURIs
Extra callback URIs to register on the OIDC client, beyond
redirectURI. Authelia registers the union of redirectURI and
these. These ride alongside the contract (which only models a
single redirectURI) and are applied by the authelia provider.
Type: list of string
Default:
[ ]
Declared by:
oidc.request.scopes
OIDC scopes the client may request. Defaults to the standard OpenID Connect profile scopes.
Type: list of string
Default:
[
"openid"
"profile"
"email"
]
Declared by:
otel
OpenTelemetry collector endpoint for emitting telemetry signals from an
application. The policy carries the collector’s OTLP endpoint; each
application that opts in contributes a nixos-configuration function
that, given the endpoint, returns its per-service OTel wiring as a
NixOS module. The resource emits those modules onto the application’s
host.
Type: submodule
otel.request
Options a component sets to request this resource.
Type: submodule
otel.request.enable
Whether to enable emitting OpenTelemetry signals from this application to the configured collector.
Type: boolean
Default:
false
Example:
true
Declared by:
otel.request.nixos-configuration
Function endpoint -> nixos-module returning the per-service
OTel wiring for this application.
Type: function that evaluates to a(n) unspecified value
Declared by:
postgresql
PostgreSQL database access for an application, fulfilled by a postgres-backed provider of the postgresql contract on a dedicated database node.
Type: submodule
postgresql.request
Options a component sets to request this resource.
Type: submodule
postgresql.request.enable
Whether to enable PostgreSQL database access for the application.
Type: boolean
Default:
false
Example:
true
Declared by:
postgresql.request.bootstrapSQL
Application-specific SQL run as the postgres superuser against this
app’s database, after it is created and before any consumer
connects. Some upstream service modules ship migrations assuming
roles or objects their NixOS module creates only under a
createLocally = true path a remote consumer disables. Has to be
idempotent, being re-applied every deploy. @username@ and
@database@ are replaced by the request’s username and
database as created, namespacePrefix included; quote them as
identifiers, since a prefixed name carries a hyphen.
Type: strings concatenated with “\n”
Default:
""
Declared by:
postgresql.request.consumerName
Unique consumer name for this app (analog of oidc’s clientID),
used as the contracts.postgresql.want.<consumerName> key.
Type: string
Declared by:
postgresql.request.credentialMode
How the central OpenBao database engine issues this consumer’s credential:
-
rotating(default): a fixed-namedatabase/static-roles/<role>whose password the engine rotates onrotation_period; the consumer readsdatabase/static-creds/<role>and the login name never changes. Required wherever a consumer pins a fixed database user. -
dynamic: adatabase/roles/<role>minting a short-lived role with a random per-lease username on each read ofdatabase/creds/<role>. Usable by a consumer that takes the full DSN (result.urlFile) and pins no user, buying per-lease revocation at the cost of a stable username.
TODO: extend dynamic coverage. A fixed-user consumer needs an
indirection such as a connection pooler holding the leased DSN
behind a stable local socket, so those stay on rotating, with
shorter rotation_periods as the interim containment knob.
Type: one of “rotating”, “dynamic”
Default:
"rotating"
Declared by:
postgresql.request.database
PostgreSQL database the application requires; the provider creates
it. Carried verbatim by the postgresql contract request.
Type: string
Declared by:
postgresql.request.dynamicOwnerRole
Persistent NOLOGIN role owning every object this app creates
under dynamic credentials. Each lease role is granted membership
in it and gets ALTER ROLE ... SET role = '<owner>', so objects
land on the persistent role rather than the random per-lease role,
whose objects become unreachable once revoked. The provider node
creates the role and re-owns stranded objects to it. Empty derives
<username>_owner. Ignored for rotating consumers.
Type: string
Default:
""
Declared by:
postgresql.request.dynamicRoleGrants
Existing roles each freshly-minted dynamic lease role is granted
membership in, folded into the engine’s dynamic
creation_statements as GRANT <role> TO "{{name}}". A dynamic
consumer connects as a random per-lease role, so any group role it
expects to SET ROLE to has to be granted per lease rather than
once to a fixed user. Pair with bootstrapSQL, which creates
those roles: they have to exist when a lease is minted, or role
creation fails. Ignored for rotating consumers.
Type: list of string
Default:
[ ]
Declared by:
postgresql.request.nixos-configuration
NixOS configuration module merged onto the application node, fed the
cross-node-resolved contract result so the application can
configure its database client.
Type: function that evaluates to a(n) unspecified value
Declared by:
postgresql.request.passwordFileMode
Mode of the rendered passwordFile/urlFile. Defaults to 0640,
root-owned and group-readable, which suits consumers reading it
via systemd LoadCredential. Set 0400 with a non-root
passwordFileOwner for an app reading the file as its own service
user.
Type: string
Default:
"0640"
Declared by:
postgresql.request.passwordFileOwner
Owner of the rendered passwordFile/urlFile. Defaults to root;
set to the app’s service user when that user cats the file
directly. The agent gives the file to this owner on every render,
and again before it starts, so a change to this value reaches a
file the render leaves alone.
Type: string
Default:
"root"
Declared by:
postgresql.request.reloadUnits
Systemd units the openbao agent restarts after it re-renders this
consumer’s credential. Every consumer reads the credential once at
process start, so one holding the previous credential starts
failing with password authentication failed.
List the app service plus any unit baking the credential into a
derived file the app reads; they are restarted in one systemd
transaction, which honors their own After=. Empty means the
consumer does not converge on rotation, correct only where it reads
the credential afresh on each use.
Type: list of string
Default:
[ ]
Declared by:
postgresql.request.username
PostgreSQL role the application connects as. Defaults to the
consumerName. Carried by the postgresql contract request.
Type: string
Default:
config.consumerName
Declared by:
redis
Redis-compatible cache access for an application, fulfilled by an external provider (shared valkey node, OpenBao-brokered per-namespace credentials) of the nixpkgs redis contract.
Type: submodule
redis.request
Options a component sets to request this resource.
Type: submodule
redis.request.consumerName
Unique consumer name for this app (analog of ldap’s consumerName),
used as the contracts.redis.want.<consumerName> key.
Type: string
Declared by:
redis.request.gateUnits
Units that must not start until this namespace’s valkey listener
completes a TLS handshake the consumer node can verify, and answers.
Each named unit gets an ExecStartPre probe
(./wait-reachable.sh), which spends a short budget inside that
unit’s own start timeout.
For a database migration runner. A Laravel migration can change the schema and then dispatch a queued job, and MySQL does not roll back DDL, so a dispatch that fails on a TLS error leaves the schema changed and the ledger row unwritten. Each later run then stops on a duplicate column, a state no configuration repairs. The gate makes the unit fail before its first statement instead.
Type: list of string
Default:
[ ]
Declared by:
redis.request.namespace
The application’s logical cache identity. Selects the application’s
own valkey@<namespace> instance – its own process and port on the
group’s valkey node – so namespaces are isolated by process, not by
an ACL key-scope. Also the OpenBao static-role name that rotates the
instance’s password. The multi-operator case folds the operator id in
via namespacePrefix.
Type: string
Declared by:
redis.request.nixos-configuration
NixOS configuration module merged onto the application node, fed the
cross-node-resolved contract result (host, port, passwordFile) so
the application can configure its redis client and wire the
openbao-agent to render the rotated password.
Type: function that evaluates to a(n) unspecified value
Declared by:
secrets
Secrets provisioning for an application, via the fileSecrets contract.
Type: submodule
secrets.request
Options a component sets to request this resource.
Type: submodule
secrets.request.secrets
Secrets this application needs provisioned on its host, keyed by
name. Each becomes a contracts.fileSecrets.want.<app>.<name>
request, read back from
config.contracts.fileSecrets.results.<app>.<name>.path.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
secrets.request.secrets.<name>.file
Encrypted .age source. Defaults to ./<name>.age for the agenix provider.
Type: null or absolute path
Default:
null
Declared by:
secrets.request.secrets.<name>.group
Linux group that must own the secret file. Defaults to the owner’s primary group, as agenix does.
Type: string
Default:
owner
Declared by:
secrets.request.secrets.<name>.mode
Mode the secret file must have.
Type: string
Default:
"0400"
Declared by:
secrets.request.secrets.<name>.owner
Linux user that must own the secret file.
Type: string
Declared by:
smtp
Outbound SMTP mail submission for an application, fulfilled by a maddy-backed (or external) provider of the nixpkgs smtp contract.
Type: submodule
smtp.request
Options a component sets to request this resource.
Type: submodule
smtp.request.enable
Whether to enable outbound SMTP mail submission for the application.
Type: boolean
Default:
false
Example:
true
Declared by:
smtp.request.nixos-configuration
NixOS configuration module merged onto the application node, which
reads its fulfilled result back from
config.contracts.smtp.results.<app>.default.
Type: function that evaluates to a(n) unspecified value
Declared by:
smtp.request.sender
Email address used as the sender (From header), carried verbatim
by the nixpkgs smtp contract request.
Type: string
Example:
"noreply@example.com"
Declared by:
spiffe
SPIFFE workload identity (spire-agent) provisioning for an application’s host.
Type: submodule
spiffe.request
Options a component sets to request this resource.
Type: submodule
spiffe.request.enable
Whether to enable a spire-agent on this host for SPIFFE workload identity.
Type: boolean
Default:
false
Example:
true
Declared by:
ssl
TLS certificate provisioning for an application’s vhosts.
Type: submodule
ssl.request
Options a component sets to request this resource.
Type: submodule
ssl.request.domains
Domains this application terminates TLS for (its own vhosts).
Type: list of string
Default:
[ ]
Declared by:
ssl.request.trustDomains
Domains served by another node this node must trust as a client (e.g. the garage bucket endpoints). Drives cross-node trust baking.
Type: list of string
Default:
[ ]
Declared by: