Operator configuration schema

This page documents the operator-facing configuration schema: what an operator sets when configuring a deployment through the hosting provider's panel.

This is the tf-incus-hosts setup's frontendConfiguration module type. The same tree is converted to a JSON schema (see core/lib/schema-for-source.nix) that drives the frontend form, so these options and the form fields stay in sync by construction.

Unlike the data model's abstract configuration option, this view has the concrete applications wired in, so the per-application options (mastodon/peertube/pixelfed) appear with their descriptions and types. The infrastructure components those applications need -- databases, object storage, the mail relay, single sign-on -- are absent by construction: the view is built from the components marked operatorFacing, and an operator does not pick them.

Its top-level options are:

enable -- whether the configuration is active.
domain -- the apex domain under which services are deployed.
email -- recovery email of the seeded directory administrator. The central LDAP directory is seeded with a single administrator user, named after the deployment group (operator in an operator deployment), added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively -- the operator establishes it with "Forgot password?" on the authelia portal, https://auth.<domain>, which mails a single-use link to this address and takes the new password over published HTTPS. Two preconditions the address alone does not establish: the group must contain an smtp relay node (with no relay, authelia falls back to its filesystem notifier and nothing is sent), and that relay's submission listener must carry a publicly trusted certificate, which it takes from acme only where it can answer an HTTP-01 challenge (neither authelia's nor lldap's SMTP client is taught the internal CA). Where authelia itself is unavailable, lldap runs a reset of its own as a break-glass fallback, reachable only on TCP port 17170 of the lldap node -- its link points at lldap's direct HTTP listener rather than the authenticated https://users.<domain> vhost, so the token travels in clear.
applications -- the per-application configuration (mastodon, peertube, pixelfed), each with its own enable, domain, and application-specific options.

These option paths (for example email) correspond directly to the fields the frontend form generates.

Which application settings are operator-facing

Beside options our own modules declare, an application's fields are the upstream NixOS module's own options, wrapped by core/components/nixosService.nix -- and which of them appear is the application's own call, stated where it is defined as an expose selection over the upstream option set (core/lib/option-selection.nix): an allow-list or a deny-list of names at each layer, nesting into each other. Today mastodon offers mediaAutoRemove, pixelfed maxUploadSize, and peertube its settings, narrowed again in turn.

An allow-list is why a nixpkgs bump that adds an option does not put it in the form: nobody has decided to offer it yet. The reverse -- a selection naming an option a bump renamed away -- throws rather than quietly stop offering it.

core/components/operator/operator-facing-options.csv is where those calls come from. It records, for every configuration setting the three applications have, whose it is, with the reasoning per row; it is the audit the selections were written from and the place to revisit them, not something the build reads.

The file has one row per setting, with these columns:

application -- mastodon, peertube or pixelfed.
surface -- nixos-module for a services.<app>.* option of the upstream NixOS module, upstream for a key of the application's own configuration (mastodon's .env, peertube's YAML, pixelfed's .env).
option -- the option path or key in its native spelling. A trailing * marks a collapsed group: the row covers every setting whose name starts with the prefix, and those members are not listed separately. Where the judgement differs inside a group, the members that differ are spelled out instead, so every setting is covered by exactly one row.
audience -- operator for something that could reach the operator's form; hosting-provider for a knob the hosting provider sets or caps for the whole platform, typically because it spends the node's CPU, storage or bandwidth; fediversity for something our own modules and contracts determine (database and cache coordinates, secrets, TLS, nginx, SSO, object storage), so it is nobody's dial.
partial -- yes where only part of the value space is the operator's, for instance a quota they distribute inside a total the hosting provider allocates. notes then says which part.
notes -- the reasoning, where it is not obvious.

The two surfaces are judged separately, and both are reached. Where an option is a .settings submodule as per Nix RFC 42 -- e.g. services.peertube.settings, what is exposed to the operator is narrowed by a second selection to the upstream keys that are theirs, against the configuration schema PeerTube publishes (core/lib/json-schema.nix). Mastodon's and pixelfed's upstream rows judge their .env keys, which no NixOS module option reaches one by one; those are recorded but not yet offered.

The judgements were taken against versions:

mastodon: 4.6.4
peertube: 8.2.3
pixelfed: 0.12.7

The settings themselves were enumerated from the applications' NixOS module options plus, per application:

mastodon: keys from .env.production.sample together with the ENV[...] and ENV.fetch(...) references in its source
peertube: from the leaf paths of config/production.yaml.example together with the keys the pinned configuration schema (peertube-config-schema, taken from develop) carries beyond that release
pixelfed: from the env('...') references across config/*.php -- the last being much wider than the 62 keys .env.example documents.

enable

Whether to enable your Fediversity configuration.

Type: boolean

Default:

false

Example:

true

deployment-method

What to run: a deployment method (ssh-hosts / tf-hosts / tf-incus-hosts) or a non-deploy operator effect (tf-incus-image / octodns-zone). Pick one, then fill in its settings. The tag key is the method/effect; its value is that entry’s settings. A method deploys the enabled applications; an effect runs a standalone action. Always set – there is no “no selection” state (issue #723).

Type: attribute-tagged union with choices: octodns-zone, ssh-hosts, tf-hosts, tf-incus-hosts, tf-incus-image, tf-incus-operator-hosts

Default:

{
  tf-incus-operator-hosts = { };
}

deployment-method.octodns-zone

Manage DNS records for a zone via OctoDNS.

Type: submodule

deployment-method.octodns-zone.apiTokenFile

Path, on the deployer, to the file holding the service’s API token. A PATH and never a value, so no credential reaches the Nix store: the effect reads it at run time. Empty means the provider needs no token (the self-hosted bind path authenticates with a TSIG key instead).

Type: string

Default:

""

Example:

"/run/secrets/dns-api-token"

deployment-method.octodns-zone.domain

The DNS domain (zone) to manage.

Type: string

Example:

"example.tld"

deployment-method.octodns-zone.provider

The OctoDNS provider to use, see https://octodns.readthedocs.io/en/latest/#providers.

Type: string

Example:

"powerdns"

deployment-method.octodns-zone.secretFiles

The files from which to read the secrets to use with the provider.

Type: attribute set of string

Default:

{ }

Example:

{
  token = "/path/to/token";
}

deployment-method.octodns-zone.serverUrl

URL of the authoritative-DNS service’s API, scheme and port included. Empty means the domain is served by the deployment’s own bind node.

Type: string

Default:

""

Example:

"https://pdns.example.org"

deployment-method.ssh-hosts

Deploy over SSH to existing hosts: a shared SSH identity plus, per node, where to reach it and any identity override.

Type: submodule

deployment-method.ssh-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.applications.mastodon

Your self-hosted, globally interconnected microblogging community

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.domain

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"mastodon.fediversity.net"

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.peertube

ActivityPub-federated video streaming platform using P2P directly in your web browser

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.peertube.enable

Whether to enable Enable a Peertube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.ssh-hosts.applications.peertube.domain

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"peertube.fediversity.net"

Declared by:

components/operator/peertube

deployment-method.ssh-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.ssh-hosts.applications.pixelfed

Photo Sharing. For Everyone.

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.applications.pixelfed.domain

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"pixelfed.fediversity.net"

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: string

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.defaults

Shared SSH identity applied to every node, unless a node overrides it.

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.defaults.keyFile

Path to the SSH private key the deployer reads (a reference, not key material). Null uses an agent / the deployer default.

Type: null or string

Default:

null

deployment-method.ssh-hosts.defaults.sshOpts

Extra SSH options (-o) applied to every node.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.defaults.username

SSH user to connect as. Null uses the deployer default.

Type: null or string

Default:

null

deployment-method.ssh-hosts.domain

Apex domain under which the services will be deployed.

Type: string

Default:

"fediversity.net"

deployment-method.ssh-hosts.email

Recovery email of the seeded directory administrator.

The central LDAP directory is seeded with a single administrator user at deploy time, named after the deployment group (operator in an operator deployment) and added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively – the operator establishes it with “Forgot password?” on the authelia portal, which mails a single-use link here, so this address must be deliverable.

Type: string

deployment-method.ssh-hosts.nodes

Per-node SSH connection info, one optional entry per node in the operator group’s roster. Each set node’s host is required; identity fields fall back to defaults.

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.nodes.authelia

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.authelia.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.authelia.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.authelia.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.authelia.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.lldap

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.lldap.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.lldap.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.lldap.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.lldap.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.mastodon

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.mastodon.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.mastodon.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.peertube

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.peertube.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.peertube.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.peertube.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.peertube.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.pixelfed.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.pixelfed.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.smtp

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.smtp.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.smtp.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.smtp.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.smtp.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.valkey

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.valkey.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.ssh-hosts.nodes.valkey.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.valkey.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.ssh-hosts.nodes.valkey.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts

Deploy via OpenTofu to existing hosts over SSH, with an HTTP state backend.

Type: submodule

deployment-method.tf-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.applications.mastodon

Your self-hosted, globally interconnected microblogging community

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.domain

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"mastodon.fediversity.net"

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.peertube

ActivityPub-federated video streaming platform using P2P directly in your web browser

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.peertube.enable

Whether to enable Enable a Peertube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.tf-hosts.applications.peertube.domain

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"peertube.fediversity.net"

Declared by:

components/operator/peertube

deployment-method.tf-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.tf-hosts.applications.pixelfed

Photo Sharing. For Everyone.

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.applications.pixelfed.domain

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"pixelfed.fediversity.net"

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: string

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.defaults

Shared SSH identity applied to every node, unless a node overrides it.

Type: submodule

Default:

{ }

deployment-method.tf-hosts.defaults.keyFile

Path to the SSH private key the deployer reads (a reference, not key material). Null uses an agent / the deployer default.

Type: null or string

Default:

null

deployment-method.tf-hosts.defaults.sshOpts

Extra SSH options (-o) applied to every node.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.defaults.username

SSH user to connect as. Null uses the deployer default.

Type: null or string

Default:

null

deployment-method.tf-hosts.domain

Apex domain under which the services will be deployed.

Type: string

Default:

"fediversity.net"

deployment-method.tf-hosts.email

Recovery email of the seeded directory administrator.

Type: string

deployment-method.tf-hosts.httpBackendAddress

Address of the OpenTofu HTTP state backend REST endpoint (TF_HTTP_ADDRESS).

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes

Per-node SSH connection info, one optional entry per node in the operator group’s roster. Each set node’s host is required; identity fields fall back to defaults.

Type: submodule

Default:

{ }

deployment-method.tf-hosts.nodes.authelia

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.authelia.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.authelia.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.authelia.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.authelia.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.lldap

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.lldap.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.lldap.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.lldap.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.lldap.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.mastodon

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.mastodon.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.mastodon.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.mastodon.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.mastodon.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.peertube

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.peertube.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.peertube.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.peertube.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.peertube.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.pixelfed

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.pixelfed.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.pixelfed.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.smtp

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.smtp.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.smtp.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.smtp.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.smtp.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.valkey

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.valkey.host

Host (address) to reach this node over SSH.

Type: string

deployment-method.tf-hosts.nodes.valkey.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.valkey.sshOpts

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

Type: list of string

Default:

[ ]

deployment-method.tf-hosts.nodes.valkey.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts

Deploy via OpenTofu to Incus-provisioned hosts: Incus connection and instance settings.

Type: submodule

deployment-method.tf-incus-hosts.enableTpm

Attach a software-TPM 2.0 device to each container, enabling SPIRE TPM node attestation. Only emitted for container instances.

Type: boolean

Default:

true

deployment-method.tf-incus-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.tf-incus-hosts.applications.mastodon

Your self-hosted, globally interconnected microblogging community

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.domain

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"mastodon.fediversity.net"

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.peertube

ActivityPub-federated video streaming platform using P2P directly in your web browser

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.peertube.enable

Whether to enable Enable a Peertube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.tf-incus-hosts.applications.peertube.domain

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"peertube.fediversity.net"

Declared by:

components/operator/peertube

deployment-method.tf-incus-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.tf-incus-hosts.applications.pixelfed

Photo Sharing. For Everyone.

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.applications.pixelfed.domain

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"pixelfed.fediversity.net"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: string

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.domain

Apex domain under which the services will be deployed.

Type: string

Default:

"fediversity.net"

deployment-method.tf-incus-hosts.email

Recovery email of the seeded directory administrator.

Type: string

deployment-method.tf-incus-hosts.host

Address of the Incus server.

Type: string

Default:

"localhost"

deployment-method.tf-incus-hosts.hostSsh

SSH identity for the Incus host’s own store, used by nodes that share it.

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.hostSsh.address

Address of the Incus host’s SSH service. Null (the default) reuses host, the address its Incus API is reached at.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.hostSsh.keyFile

Deployer-side path to the private half of the scoped store-serve identity, which the Incus host minted and published to KV. Null offers whatever the deployer’s ssh is otherwise configured with.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.hostSsh.signingKeyFile

Deployer-side path to the Nix secret signing key the Incus host’s trusted-public-keys lists the public half of. The scoped identity is not one of that host’s trusted-users, so its daemon checks the signature on every path it is handed; unsigned, a shared-store copy is refused. Null signs nothing.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.hostSsh.sshOpts

Extra SSH options (-o) used to reach the Incus host.

Type: list of string

Default:

[ ]

deployment-method.tf-incus-hosts.hostSsh.user

SSH user on the Incus host. The default suits a hosting provider’s own deploy, which reaches its hypervisor by the identity it deployed it with. incus-store is the scoped alternative that host can mint (core/components/hosting-provider/incus-store-serve.nix), whose whole vocabulary is the closure copy and the two profile verbs a shared-store deploy needs, and which is what a deployer that is not the machine’s administrator gets. core/setups/tf-incus-operator-hosts.nix defaults its own lane to it, an operator’s deployer being one of those by definition.

Type: string

Default:

"root"

deployment-method.tf-incus-hosts.imageAlias

Alias resolved to a fingerprint on the target daemon when imageFingerprint is null. tf-incus-image uploads under this name.

Type: string

Default:

"nixos-fediversity"

deployment-method.tf-incus-hosts.imageFingerprint

Fingerprint of the Incus image to use. Null (the default) resolves imageAlias on the target daemon; set one only to pin an exact image.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.instanceType

Incus instance type: container or virtual-machine.

Type: one of “container”, “virtual-machine”

Default:

"container"

deployment-method.tf-incus-hosts.network

Name of the Incus network bridge to attach to.

Type: string

Default:

"incusbr0"

deployment-method.tf-incus-hosts.port

Port of the Incus HTTPS API.

Type: signed integer

Default:

deployment-method.tf-incus-image

Upload a NixOS image to an Incus server.

Type: submodule

deployment-method.tf-incus-image.alias

Alias name for the uploaded image.

Type: string

Default:

"nixos-fediversity"

deployment-method.tf-incus-image.host

Address of the Incus server.

Type: string

Default:

"localhost"

deployment-method.tf-incus-image.node

Which of the group’s nodes to build the image from. Null uses the group’s first node.

Type: null or one of “authelia”, “lldap”, “mastodon”, “peertube”, “pixelfed”, “smtp”, “valkey”

Default:

null

deployment-method.tf-incus-image.port

Port of the Incus HTTPS API.

Type: signed integer

Default:

deployment-method.tf-incus-operator-hosts

Deploy via OpenTofu to Incus-provisioned hosts, provisioning the operator’s per-namespace garage alongside: Incus connection and instance settings.

Type: submodule

deployment-method.tf-incus-operator-hosts.enableTpm

Attach a software-TPM 2.0 device to each container, enabling SPIRE TPM node attestation. Only emitted for container instances.

Type: boolean

Default:

true

deployment-method.tf-incus-operator-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.tf-incus-operator-hosts.applications.mastodon

Your self-hosted, globally interconnected microblogging community

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.domain

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"mastodon.fediversity.net"

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.peertube

ActivityPub-federated video streaming platform using P2P directly in your web browser

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.peertube.enable

Whether to enable Enable a Peertube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.tf-incus-operator-hosts.applications.peertube.domain

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"peertube.fediversity.net"

Declared by:

components/operator/peertube

deployment-method.tf-incus-operator-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.tf-incus-operator-hosts.applications.pixelfed

Photo Sharing. For Everyone.

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.applications.pixelfed.domain

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance’s canonical host in generated URLs, certificates, and federation identifiers.

Type: string

Default:

"pixelfed.fediversity.net"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: string

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.domain

Apex domain under which the services will be deployed.

Type: string

Default:

"fediversity.net"

deployment-method.tf-incus-operator-hosts.email

Recovery email of the seeded directory administrator.

Type: string

deployment-method.tf-incus-operator-hosts.host

Address of the Incus server.

Type: string

Default:

"localhost"

deployment-method.tf-incus-operator-hosts.hostSsh

SSH identity for the Incus host’s own store, used by nodes that share it.

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.hostSsh.address

Address of the Incus host’s SSH service. Null (the default) reuses host, the address its Incus API is reached at.

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.hostSsh.keyFile

Deployer-side path to the private half of the scoped store-serve identity, which the Incus host minted and published to KV. Null offers whatever the deployer’s ssh is otherwise configured with.

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.hostSsh.signingKeyFile

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.hostSsh.sshOpts

Extra SSH options (-o) used to reach the Incus host.

Type: list of string

Default:

[ ]

deployment-method.tf-incus-operator-hosts.hostSsh.user

Type: string

Default:

"root"

deployment-method.tf-incus-operator-hosts.imageAlias

Alias resolved to a fingerprint on the target daemon when imageFingerprint is null. tf-incus-image uploads under this name.

Type: string

Default:

"nixos-fediversity"

deployment-method.tf-incus-operator-hosts.imageFingerprint

Fingerprint of the Incus image to use. Null (the default) resolves imageAlias on the target daemon; set one only to pin an exact image.

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.instanceType

Incus instance type: container or virtual-machine.

Type: one of “container”, “virtual-machine”

Default:

"container"

deployment-method.tf-incus-operator-hosts.network

Name of the Incus network bridge to attach to.

Type: string

Default:

"incusbr0"

deployment-method.tf-incus-operator-hosts.port

Port of the Incus HTTPS API.

Type: signed integer

Default: