Operator configuration schema

This page documents the operator-facing configuration schema: what an operator sets when configuring a deployment through the hosting provider's panel.

This is the tf-incus-hosts setup's frontendConfiguration module type. The same tree is converted to a JSON schema (see core/lib/schema-for-source.nix) that drives the frontend form, so these options and the form fields stay in sync by construction.

Unlike the data model's abstract configuration option, this view has the concrete applications wired in, so the per-application options appear with their descriptions and types. The view is built from the components marked configurable: the applications the operator turns on and off (mastodon, peertube, pixelfed, marked optional), and the SSO portal (authelia) and directory (lldap) that every deployment runs. The other infrastructure components those applications need -- databases, object storage, the mail relay -- are absent by construction, and the operator can set none of their options.

Its top-level options are:

enable -- whether the configuration is active.
domain -- the apex domain under which services are deployed.
email -- recovery email of the seeded directory administrator. The central LDAP directory is seeded with a single administrator user, named after the deployment group (operator in an operator deployment), added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively -- the operator establishes it with the reset of lldap at https://users.<domain>/reset-password/step1, which mails a single-use link to this address and takes the new password over published HTTPS. Only the reset routes of that vhost are open without an authelia session, with a rate limit on the requests. "Forgot password?" on the authelia portal does not serve this account: authelia binds as a member of lldap_password_manager, which cannot set the password of an lldap_admin member. Two preconditions the address alone does not establish: the group must contain an smtp relay node (with no relay, authelia falls back to its filesystem notifier and nothing is sent), and that relay's submission listener must carry a publicly trusted certificate, which it takes from acme only where it can answer an HTTP-01 challenge (neither authelia's nor lldap's SMTP client is taught the internal CA).
applications -- the per-application configuration. Mastodon, peertube and pixelfed each have their own enable, domain, and application-specific options. Authelia and lldap have no enable, because they always run, and have only their settings (and lldap its senderName, the display name of the sender of its mail).

These option paths (for example email) correspond directly to the fields the frontend form generates.

Which application settings are operator-facing

Beside options our own modules declare, an application's fields are the upstream NixOS module's own options, wrapped by core/components/nixosService.nix -- and which of them appear is the application's own call, stated where it is defined as an expose selection over the upstream option set (core/lib/option-selection.nix): an allow-list or a deny-list of names at each layer, nesting into each other. A name that ends in * selects every option whose name starts with the part before it. Today mastodon offers mediaAutoRemove, pixelfed maxUploadSize, lldap senderName, and each of the five components its settings, narrowed again in turn.

An allow-list is why a nixpkgs bump that adds an option does not put it in the form: nobody has decided to offer it yet. The reverse -- a selection naming an option a bump renamed away -- throws rather than quietly stop offering it.

core/components/operator/operator-facing-options.csv is where those calls come from. It records, for every configuration setting the three applications have, and those of the SSO provider (authelia) and directory (lldap) each group runs, whose it is, with the reasoning per row; it is the audit the selections were written from and the place to revisit them, not something the build reads.

The file has one row per setting, with these columns:

application -- authelia, lldap, mastodon, peertube or pixelfed.
surface -- nixos-module for a services.<app>.* option of the upstream NixOS module, upstream for a key of the application's own configuration (authelia's YAML, lldap's lldap_config.toml, mastodon's .env, peertube's YAML, pixelfed's .env).
option -- the option path or key in its native spelling. A trailing * marks a collapsed group: the row covers every setting whose name starts with the prefix, and those members are not listed separately. Where the judgement differs inside a group, the members that differ are spelled out instead, so every setting is covered by exactly one row.
audience -- operator for something that could reach the operator's form; hosting-provider for a knob the hosting provider sets or caps for the whole platform, typically because it spends the node's CPU, storage or bandwidth; fediversity for something our own modules and contracts determine (database and cache coordinates, secrets, TLS, nginx, SSO, object storage), so it is nobody's dial.
partial -- yes where only part of the value space is the operator's, for instance a quota they distribute inside a total the hosting provider allocates. notes then says which part.
sensitive -- yes where the value is a secret, such as a password or an API key, and partial where the row covers secrets as well as other settings. For upstream keys this follows what the schema marks (x-secret for mastodon, x-sensitive for pixelfed), except pixelfed's CAPTCHA_SITEKEY, which is the public half of a keypair. The schemas of authelia and lldap mark no secrets, so there it follows the meaning of the key. A nixos-module option that takes the path of a secret file is no: the path is not a secret.
code-execution -- yes where whoever sets the value can make the node run code of their choice: a package, a binary path, an environment map that sets LD_PRELOAD, a file that the application loads as code or as configuration of any key, or a value that the current modules write without escapes into a shell script, a configuration file or YAML that Rails reads with YAML.unsafe_load. partial where only some keys of the row are yes; notes then says which. Code that runs only in the browsers of visitors, such as custom JavaScript, is no.
notes -- the reasoning, where it is not obvious.

The two surfaces are judged separately, and both are reached. Where an option is a .settings submodule as per Nix RFC 42 -- e.g. services.peertube.settings, what is exposed to the operator is narrowed by a second selection to the upstream keys that are theirs, against the configuration schema PeerTube publishes (core/lib/json-schema.nix). Authelia and lldap declare a settings option of their own, narrowed against the configuration schema each publishes, and write it to services.authelia.instances.main.settings and services.lldap.settings. Mastodon and pixelfed read their upstream keys from the environment, so the component declares a settings option of its own, narrowed in the same way against the configuration schema the application publishes (mastodon-config-schema, pixelfed-config-schema), and writes it to services.mastodon.extraConfig and services.pixelfed.settings. Pixelfed's schema is keyed by configuration path, with the environment variable each path reads in x-env; the form keys it by environment variable instead. Rows with partial set to yes are offered in full for now. So are the operator's secrets, such as DEEPL_API_KEY or STRIPE_SECRET, as plain form fields, which puts their values in the Nix store; the sensitive column marks them until a secret path replaces the form field.

A pinned schema moves on a dependency bump exactly as a nixpkgs option tree does, and with the same consequence for what an operator already stored -- but one option holding a whole settings subtree leaves no mkRenamedOptionModule marker behind for core/lib/renames-for-source.nix to recover the move from. So where upstream renames a key, the move is recorded as data in the settings-renames.json beside the component that declares the option (for example core/components/operator/peertube/settings-renames.json), checked at build time against the narrowed schema, and a stored configuration is carried across it before validation. Where upstream removes a key instead, there is nothing to carry it to: the selection entry naming it is deleted, and a stored value still keyed on it is rejected as invalid. The rejection names it -- every stored path the pinned source has no place for, and that re-saving the form drops them -- because the alternative to naming it is a form that reports one unexpected property and leaves the operator to work out what became of it. The panel shows the same paths when the form opens: it removes from the value the form edits each key that the schema of the whole configuration has no place for, and lists them above the form. A key that the deployed source offered is not in the list, as the form shows it, with its stored value, as a read-only removed option. For a secret, the field shows a note in place of the value. The stored value stays as it is until the operator saves, so parting with what they stored is still theirs to decide.

Recording the move rather than recovering it also changes what each half of the table has to do to reach back. A nixpkgs rename is read off the markers the pinned tree still carries, which is a snapshot: upstream drops an alias some releases after the move, and a rename older than that is no longer recoverable from the pin at all. The declared entries are ours, appended and never rewritten, so they reach back as far as the file does.

So the harvested half is written down too. core/renames-log.json accumulates what each pin was seen to declare, and is prepended to what the current walk finds, which turns that snapshot into the same append-only log -- and a build whose tree declares a rename the log does not carry fails, naming the command that records it, since the bump that retires the marker is the last one able to. Both halves then go from A to C in a single pass, rather than a configuration older than the markers having to be stepped through the intermediate pins that still had them, one bump at a time.

The judgements were taken against versions:

authelia: 4.39.20
lldap: 0.6.3
mastodon: 4.6.4
peertube: 8.2.3
pixelfed: 0.12.7

The settings themselves were enumerated from the applications' NixOS module options plus, per application:

authelia: from the leaf paths of the configuration schema it publishes for 4.39, docs/static/schemas/v4.39/json-schema/configuration.json
lldap: from the leaf paths of the configuration schema that lldap export_config_schema writes, a command proposed upstream in lldap/lldap#1505 and taken from that branch; 0.6.3 reads the same keys
mastodon: keys from .env.production.sample together with the ENV[...] and ENV.fetch(...) references in its source
peertube: from the leaf paths of config/production.yaml.example together with the keys the pinned configuration schema (peertube-config-schema) carries beyond that file
pixelfed: from the env('...') references across config/*.php -- the last being much wider than the 62 keys .env.example documents.

enable

Whether to enable your Fediversity configuration.

Type: boolean

Default:

true

Example:

false

deployment-method

What to run: a deployment method (ssh-hosts / tf-hosts / tf-incus-hosts / k8s-hosts) or a non-deploy operator effect (tf-incus-image / octodns-zone). Pick one, then fill in its settings. The tag key is the method/effect; its value is that entry’s settings. A method deploys the enabled applications; an effect runs a standalone action. Always set – there is no “no selection” state (issue #723).

Type: attribute-tagged union with choices: k8s-hosts, octodns-zone, ssh-hosts, tf-hosts, tf-incus-hosts, tf-incus-image, tf-incus-operator-hosts

Default:

{
  tf-incus-operator-hosts = { };
}

deployment-method.k8s-hosts

Deploy to a kubernetes cluster via OpenTofu, with each node as a pod, and an HTTP state backend.

Type: submodule

Declared by:

effects/default.nix

deployment-method.k8s-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.k8s-hosts.applications.authelia

Shared SSO node (Authelia). Its daemon config, the aggregated OIDC clients, the lldap first-factor backend, the OpenBao secret delivery, and the SMTP notifier account are wired by the setup (hosts-common.nix) from the oidc resource on the node that runs this component; this app model carries the node’s SPIFFE identity and the operator’s portal settings. Shared by the hosting-provider and operator groups (each group runs its own SSO portal).

Type: submodule

Default:

{ }

deployment-method.k8s-hosts.applications.authelia.settings

Portal settings, from authelia’s configuration file.

Type: authelia’s portal settings

Default:

{ }

Declared by:

components/shared/authelia

deployment-method.k8s-hosts.applications.lldap

Shared LDAP directory node (lldap). Its daemon config, the per-consumer directory provisioning, and the OpenBao bind-password generation are wired by the setup (hosts-common.nix) from the directory.ldap resource on the node that runs this component; this app model carries the node’s SPIFFE identity and the operator’s mail settings. Shared by the hosting-provider and operator groups (each group runs its own directory).

Type: submodule

Default:

{ }

deployment-method.k8s-hosts.applications.lldap.senderName

Name of the sender of the directory’s mail, such as a password reset.

Type: string

Default:

"Fediversity Directory"

Declared by:

components/shared/lldap

deployment-method.k8s-hosts.applications.lldap.settings

Directory settings, from lldap’s configuration file.

Type: lldap’s directory settings

Default:

{ }

Declared by:

components/shared/lldap

deployment-method.k8s-hosts.applications.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

Type: submodule

Default:

{ }

deployment-method.k8s-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.k8s-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.k8s-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.k8s-hosts.applications.mastodon.settings

Instance settings, from the environment Mastodon reads its configuration from.

Type: mastodon’s instance settings

Default:

{ }

Declared by:

components/operator/mastodon

deployment-method.k8s-hosts.applications.mastodon.subdomain

Label the Mastodon instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"mastodon"

Declared by:

components/operator/mastodon

deployment-method.k8s-hosts.applications.peertube

Free software to take back control of your videos

Type: submodule

Default:

{ }

deployment-method.k8s-hosts.applications.peertube.enable

Whether to enable Enable a PeerTube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.k8s-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.k8s-hosts.applications.peertube.subdomain

Label the PeerTube instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"peertube"

Declared by:

components/operator/peertube

deployment-method.k8s-hosts.applications.pixelfed

Federated image sharing platform

Type: submodule

Default:

{ }

deployment-method.k8s-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.k8s-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: size, such as `8M`

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.k8s-hosts.applications.pixelfed.settings

Instance settings, from the environment Pixelfed reads its configuration from.

Type: pixelfed’s instance settings

Default:

{ }

Declared by:

components/operator/pixelfed

deployment-method.k8s-hosts.applications.pixelfed.subdomain

Label the Pixelfed instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"pixelfed"

Declared by:

components/operator/pixelfed

deployment-method.k8s-hosts.domain

Apex domain under which the services will be deployed.

Type: host name

Example:

"example.com"

deployment-method.k8s-hosts.email

Password reset email for the SSO’s admin user.

Type: string

Example:

"operator@example.com"

deployment-method.k8s-hosts.httpBackendAddress

Address of the OpenTofu HTTP state backend REST endpoint (TF_HTTP_ADDRESS).

Type: null or string

Default:

null

deployment-method.k8s-hosts.registry

Address of the image registry, as host[:port][/path] (K8S_REGISTRY).

Type: null or string

Default:

null

deployment-method.octodns-zone

Manage DNS records for a zone via OctoDNS.

Type: submodule

Declared by:

effects/default.nix

deployment-method.octodns-zone.apiTokenFile

Path, on the deployer, to the file holding the service’s API token. A PATH and never a value, so no credential reaches the Nix store: the effect reads it at run time. Empty means the provider needs no token (the self-hosted bind path authenticates with a TSIG key instead).

Type: string

Default:

""

Example:

"/run/secrets/dns-api-token"

deployment-method.octodns-zone.domain

The DNS domain (zone) to manage.

Type: string

Example:

"example.tld"

deployment-method.octodns-zone.provider

The OctoDNS provider to use, see https://octodns.readthedocs.io/en/latest/#providers.

Type: string

Example:

"powerdns"

deployment-method.octodns-zone.secretFiles

The files from which to read the secrets to use with the provider.

Type: attribute set of string

Default:

{ }

Example:

{
  token = "/path/to/token";
}

deployment-method.octodns-zone.serverUrl

URL of the authoritative-DNS service’s API, scheme and port included. Empty means the domain is served by the deployment’s own bind node.

Type: string

Default:

""

Example:

"https://pdns.example.org"

deployment-method.ssh-hosts

Deploy over SSH to existing hosts: a shared SSH identity plus, per node, where to reach it and any identity override.

Type: submodule

Declared by:

effects/default.nix

deployment-method.ssh-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.applications.authelia

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.authelia.settings

Portal settings, from authelia’s configuration file.

Type: authelia’s portal settings

Default:

{ }

Declared by:

components/shared/authelia

deployment-method.ssh-hosts.applications.lldap

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.lldap.senderName

Name of the sender of the directory’s mail, such as a password reset.

Type: string

Default:

"Fediversity Directory"

Declared by:

components/shared/lldap

deployment-method.ssh-hosts.applications.lldap.settings

Directory settings, from lldap’s configuration file.

Type: lldap’s directory settings

Default:

{ }

Declared by:

components/shared/lldap

deployment-method.ssh-hosts.applications.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.settings

Instance settings, from the environment Mastodon reads its configuration from.

Type: mastodon’s instance settings

Default:

{ }

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.mastodon.subdomain

Label the Mastodon instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"mastodon"

Declared by:

components/operator/mastodon

deployment-method.ssh-hosts.applications.peertube

Free software to take back control of your videos

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.peertube.enable

Whether to enable Enable a PeerTube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.ssh-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.ssh-hosts.applications.peertube.subdomain

Label the PeerTube instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"peertube"

Declared by:

components/operator/peertube

deployment-method.ssh-hosts.applications.pixelfed

Federated image sharing platform

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: size, such as `8M`

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.applications.pixelfed.settings

Instance settings, from the environment Pixelfed reads its configuration from.

Type: pixelfed’s instance settings

Default:

{ }

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.applications.pixelfed.subdomain

Label the Pixelfed instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"pixelfed"

Declared by:

components/operator/pixelfed

deployment-method.ssh-hosts.defaults

Shared SSH identity applied to every node, unless a node overrides it.

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.defaults.keyFile

Path to the SSH private key the deployer reads (a reference, not key material). Null uses an agent / the deployer default.

Type: null or string

Default:

null

deployment-method.ssh-hosts.defaults.sshOpts

Extra SSH options applied to every node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item.

Type: list of bare `ssh` option `Key=Value` (without `-o`)

Default:

[ ]

deployment-method.ssh-hosts.defaults.username

SSH user to connect as. Null uses the deployer default.

Type: null or string

Default:

null

deployment-method.ssh-hosts.domain

Apex domain under which the services will be deployed.

Type: host name

Example:

"example.com"

deployment-method.ssh-hosts.email

Password reset email for the SSO’s admin user.

Type: string

Example:

"operator@example.com"

deployment-method.ssh-hosts.nodes

Per-node SSH connection info, one optional entry per node in the roster of each group that runs an application. A null field of a set node falls back: host to the roster FQDN, identity fields to defaults.

Type: submodule

Default:

{ }

deployment-method.ssh-hosts.nodes.authelia

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.authelia.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.authelia.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.authelia.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.authelia.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.authelia.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.lldap

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.lldap.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.lldap.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.lldap.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.lldap.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.lldap.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.mastodon

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.mastodon.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.peertube

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.peertube.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.peertube.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.peertube.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.peertube.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.peertube.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.pixelfed.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.smtp

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.smtp.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.smtp.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.smtp.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.smtp.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.smtp.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.valkey

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.ssh-hosts.nodes.valkey.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.valkey.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.valkey.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.ssh-hosts.nodes.valkey.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.ssh-hosts.nodes.valkey.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts

Deploy via OpenTofu to existing hosts over SSH, with an HTTP state backend.

Type: submodule

Declared by:

effects/default.nix

deployment-method.tf-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.applications.authelia

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.authelia.settings

Portal settings, from authelia’s configuration file.

Type: authelia’s portal settings

Default:

{ }

Declared by:

components/shared/authelia

deployment-method.tf-hosts.applications.lldap

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.lldap.senderName

Name of the sender of the directory’s mail, such as a password reset.

Type: string

Default:

"Fediversity Directory"

Declared by:

components/shared/lldap

deployment-method.tf-hosts.applications.lldap.settings

Directory settings, from lldap’s configuration file.

Type: lldap’s directory settings

Default:

{ }

Declared by:

components/shared/lldap

deployment-method.tf-hosts.applications.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.settings

Instance settings, from the environment Mastodon reads its configuration from.

Type: mastodon’s instance settings

Default:

{ }

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.mastodon.subdomain

Label the Mastodon instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"mastodon"

Declared by:

components/operator/mastodon

deployment-method.tf-hosts.applications.peertube

Free software to take back control of your videos

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.peertube.enable

Whether to enable Enable a PeerTube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.tf-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.tf-hosts.applications.peertube.subdomain

Label the PeerTube instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"peertube"

Declared by:

components/operator/peertube

deployment-method.tf-hosts.applications.pixelfed

Federated image sharing platform

Type: submodule

Default:

{ }

deployment-method.tf-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: size, such as `8M`

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.applications.pixelfed.settings

Instance settings, from the environment Pixelfed reads its configuration from.

Type: pixelfed’s instance settings

Default:

{ }

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.applications.pixelfed.subdomain

Label the Pixelfed instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"pixelfed"

Declared by:

components/operator/pixelfed

deployment-method.tf-hosts.defaults

Shared SSH identity applied to every node, unless a node overrides it.

Type: submodule

Default:

{ }

deployment-method.tf-hosts.defaults.keyFile

Path to the SSH private key the deployer reads (a reference, not key material). Null uses an agent / the deployer default.

Type: null or string

Default:

null

deployment-method.tf-hosts.defaults.sshOpts

Extra SSH options applied to every node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item.

Type: list of bare `ssh` option `Key=Value` (without `-o`)

Default:

[ ]

deployment-method.tf-hosts.defaults.username

SSH user to connect as. Null uses the deployer default.

Type: null or string

Default:

null

deployment-method.tf-hosts.domain

Apex domain under which the services will be deployed.

Type: host name

Example:

"example.com"

deployment-method.tf-hosts.email

Password reset email for the SSO’s admin user.

Type: string

Example:

"operator@example.com"

deployment-method.tf-hosts.httpBackendAddress

Address of the OpenTofu HTTP state backend REST endpoint (TF_HTTP_ADDRESS).

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes

Type: submodule

Default:

{ }

deployment-method.tf-hosts.nodes.authelia

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.authelia.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.authelia.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.authelia.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.authelia.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.authelia.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.lldap

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.lldap.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.lldap.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.lldap.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.lldap.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.lldap.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.mastodon

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.mastodon.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.mastodon.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.mastodon.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.mastodon.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.mastodon.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.peertube

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.peertube.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.peertube.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.peertube.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.peertube.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.peertube.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.pixelfed

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.pixelfed.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.smtp

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.smtp.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.smtp.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.smtp.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.smtp.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.smtp.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.valkey

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Type: null or (submodule)

Default:

null

deployment-method.tf-hosts.nodes.valkey.host

Host (address) to reach this node over SSH. Null uses the node’s roster FQDN.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.valkey.hostKey

Public SSH host key of this node, one line of its ssh_host_*_key.pub. The deploy accepts only this key. Null accepts the key of the first connection.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.valkey.keyFile

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Type: null or string

Default:

null

deployment-method.tf-hosts.nodes.valkey.sshOpts

SSH options for this node, each one a bare Key=Value such as Port=2222. The deploy puts -o in front of each item. A list replaces defaults.sshOpts; null inherits it.

Type: null or (list of bare `ssh` option `Key=Value` (without `-o`))

Default:

null

deployment-method.tf-hosts.nodes.valkey.username

SSH user to connect as for this node. Null inherits defaults.username.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts

Deploy via OpenTofu to Incus-provisioned hosts: Incus connection and instance settings.

Type: submodule

Declared by:

effects/default.nix

deployment-method.tf-incus-hosts.enableTpm

Attach a software-TPM 2.0 device to each container, enabling SPIRE TPM node attestation. Only emitted for container instances.

Type: boolean

Default:

true

deployment-method.tf-incus-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.tf-incus-hosts.applications.authelia

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.authelia.settings

Portal settings, from authelia’s configuration file.

Type: authelia’s portal settings

Default:

{ }

Declared by:

components/shared/authelia

deployment-method.tf-incus-hosts.applications.lldap

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.lldap.senderName

Name of the sender of the directory’s mail, such as a password reset.

Type: string

Default:

"Fediversity Directory"

Declared by:

components/shared/lldap

deployment-method.tf-incus-hosts.applications.lldap.settings

Directory settings, from lldap’s configuration file.

Type: lldap’s directory settings

Default:

{ }

Declared by:

components/shared/lldap

deployment-method.tf-incus-hosts.applications.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.settings

Instance settings, from the environment Mastodon reads its configuration from.

Type: mastodon’s instance settings

Default:

{ }

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.mastodon.subdomain

Label the Mastodon instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"mastodon"

Declared by:

components/operator/mastodon

deployment-method.tf-incus-hosts.applications.peertube

Free software to take back control of your videos

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.peertube.enable

Whether to enable Enable a PeerTube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.tf-incus-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.tf-incus-hosts.applications.peertube.subdomain

Label the PeerTube instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"peertube"

Declared by:

components/operator/peertube

deployment-method.tf-incus-hosts.applications.pixelfed

Federated image sharing platform

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: size, such as `8M`

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.applications.pixelfed.settings

Instance settings, from the environment Pixelfed reads its configuration from.

Type: pixelfed’s instance settings

Default:

{ }

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.applications.pixelfed.subdomain

Label the Pixelfed instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"pixelfed"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-hosts.domain

Apex domain under which the services will be deployed.

Type: host name

Example:

"example.com"

deployment-method.tf-incus-hosts.email

Password reset email for the SSO’s admin user.

Type: string

Example:

"operator@example.com"

deployment-method.tf-incus-hosts.host

Address of the Incus server.

Type: string

Default:

"localhost"

deployment-method.tf-incus-hosts.hostSsh

SSH identity for the Incus host’s own store, used by nodes that share it.

Type: submodule

Default:

{ }

deployment-method.tf-incus-hosts.hostSsh.address

Address of the Incus host’s SSH service. Null (the default) reuses host, the address its Incus API is reached at.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.hostSsh.keyFile

Deployer-side path to the private half of the scoped store-serve identity, which the Incus host minted and published to KV. Null offers whatever the deployer’s ssh is otherwise configured with.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.hostSsh.signingKeyFile

Deployer-side path to the Nix secret signing key the Incus host’s trusted-public-keys lists the public half of. The scoped identity is not one of that host’s trusted-users, so its daemon checks the signature on every path it is handed; unsigned, a shared-store copy is refused. Null signs nothing.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.hostSsh.sshOpts

Extra ssh arguments used to reach the Incus host. The deploy joins the items with spaces and gives the result to ssh as words, so each item carries its own flag, such as -o ConnectTimeout=10.

Type: list of string

Default:

[ ]

deployment-method.tf-incus-hosts.hostSsh.user

SSH user on the Incus host. The default suits a hosting provider’s own deploy, which reaches its hypervisor by the identity it deployed it with. incus-store is the scoped alternative that host can mint (core/components/hosting-provider/incus-store-serve.nix), whose whole vocabulary is the closure copy and the two profile verbs a shared-store deploy needs, and which is what a deployer that is not the machine’s administrator gets. core/setups/tf-incus-operator-hosts.nix defaults its own lane to it, an operator’s deployer being one of those by definition.

Type: string

Default:

"root"

deployment-method.tf-incus-hosts.imageAlias

Alias resolved to a fingerprint on the target daemon when imageFingerprint is null. tf-incus-image uploads under this name.

Type: string

Default:

"nixos-fediversity"

deployment-method.tf-incus-hosts.imageFingerprint

Fingerprint of the Incus image to use. Null (the default) resolves imageAlias on the target daemon; set one only to pin an exact image.

Type: null or string

Default:

null

deployment-method.tf-incus-hosts.instanceType

Incus instance type: container or virtual-machine.

Type: one of “container”, “virtual-machine”

Default:

"container"

deployment-method.tf-incus-hosts.network

Name of the Incus network bridge to attach to.

Type: string

Default:

"incusbr0"

deployment-method.tf-incus-hosts.port

Port of the Incus HTTPS API.

Type: signed integer

Default:

deployment-method.tf-incus-hosts.project

Name of the Incus project that holds the instances. The hypervisor declares the project. Instances in default have no project in the graph.

Type: string

Default:

"fediversity"

deployment-method.tf-incus-image

Upload a NixOS image to an Incus server.

Type: submodule

Declared by:

effects/default.nix

deployment-method.tf-incus-image.alias

Alias name for the uploaded image.

Type: string

Default:

"nixos-fediversity"

deployment-method.tf-incus-image.host

Address of the Incus server.

Type: string

Default:

"localhost"

deployment-method.tf-incus-image.node

Which of the group’s nodes to put in the image, thus a container of that node starts with its closure in place. Null builds the image with no node configuration, thus it changes only on a nixpkgs bump.

Type: null or one of “authelia”, “lldap”, “mastodon”, “peertube”, “pixelfed”, “smtp”, “valkey”

Default:

null

deployment-method.tf-incus-image.port

Port of the Incus HTTPS API.

Type: signed integer

Default:

deployment-method.tf-incus-operator-hosts

Deploy via OpenTofu to Incus-provisioned hosts, provisioning the operator’s per-namespace garage alongside: Incus connection and instance settings.

Type: submodule

Declared by:

effects/default.nix

deployment-method.tf-incus-operator-hosts.enableTpm

Attach a software-TPM 2.0 device to each container, enabling SPIRE TPM node attestation. Only emitted for container instances.

Type: boolean

Default:

true

deployment-method.tf-incus-operator-hosts.applications

Per-application configuration the operator sets to enable and configure each Fediversity application.

Type: null or (submodule)

Default:

null

deployment-method.tf-incus-operator-hosts.applications.authelia

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.authelia.settings

Portal settings, from authelia’s configuration file.

Type: authelia’s portal settings

Default:

{ }

Declared by:

components/shared/authelia

deployment-method.tf-incus-operator-hosts.applications.lldap

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.lldap.senderName

Name of the sender of the directory’s mail, such as a password reset.

Type: string

Default:

"Fediversity Directory"

Declared by:

components/shared/lldap

deployment-method.tf-incus-operator-hosts.applications.lldap.settings

Directory settings, from lldap’s configuration file.

Type: lldap’s directory settings

Default:

{ }

Declared by:

components/shared/lldap

deployment-method.tf-incus-operator-hosts.applications.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.mastodon.enable

Whether to enable Enable a Mastodon server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.mediaAutoRemove.enable

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Type: boolean

Default:

true

Example:

false

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.mediaAutoRemove.olderThanDays

How old remote media needs to be in order to be removed.

Type: signed integer

Default:

Example:

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.settings

Instance settings, from the environment Mastodon reads its configuration from.

Type: mastodon’s instance settings

Default:

{ }

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.mastodon.subdomain

Label the Mastodon instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"mastodon"

Declared by:

components/operator/mastodon

deployment-method.tf-incus-operator-hosts.applications.peertube

Free software to take back control of your videos

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.peertube.enable

Whether to enable Enable a PeerTube server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/peertube

deployment-method.tf-incus-operator-hosts.applications.peertube.settings

Instance settings, from PeerTube’s own configuration file.

Type: peertube’s instance settings

Default:

null

Declared by:

components/operator/peertube

deployment-method.tf-incus-operator-hosts.applications.peertube.subdomain

Label the PeerTube instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"peertube"

Declared by:

components/operator/peertube

deployment-method.tf-incus-operator-hosts.applications.pixelfed

Federated image sharing platform

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.applications.pixelfed.enable

Whether to enable Enable a Pixelfed server on the machine.

Type: boolean

Default:

false

Example:

true

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.applications.pixelfed.maxUploadSize

Max upload size with units.

Type: size, such as `8M`

Default:

"8M"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.applications.pixelfed.settings

Instance settings, from the environment Pixelfed reads its configuration from.

Type: pixelfed’s instance settings

Default:

{ }

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.applications.pixelfed.subdomain

Label the Pixelfed instance is served under, below the domain of the deployment (e.g. mastodon for mastodon.example.org).

Type: DNS label

Default:

"pixelfed"

Declared by:

components/operator/pixelfed

deployment-method.tf-incus-operator-hosts.domain

Apex domain under which the services will be deployed.

Type: host name

Example:

"example.com"

deployment-method.tf-incus-operator-hosts.email

Password reset email for the SSO’s admin user.

Type: string

Example:

"operator@example.com"

deployment-method.tf-incus-operator-hosts.host

Address of the Incus server.

Type: string

Default:

"localhost"

deployment-method.tf-incus-operator-hosts.hostSsh

SSH identity for the Incus host’s own store, used by nodes that share it.

Type: submodule

Default:

{ }

deployment-method.tf-incus-operator-hosts.hostSsh.address

Address of the Incus host’s SSH service. Null (the default) reuses host, the address its Incus API is reached at.

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.hostSsh.keyFile

Deployer-side path to the private half of the scoped store-serve identity, which the Incus host minted and published to KV. Null offers whatever the deployer’s ssh is otherwise configured with.

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.hostSsh.signingKeyFile

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.hostSsh.sshOpts

Extra ssh arguments used to reach the Incus host. The deploy joins the items with spaces and gives the result to ssh as words, so each item carries its own flag, such as -o ConnectTimeout=10.

Type: list of string

Default:

[ ]

deployment-method.tf-incus-operator-hosts.hostSsh.user

Type: string

Default:

"root"

deployment-method.tf-incus-operator-hosts.imageAlias

Alias resolved to a fingerprint on the target daemon when imageFingerprint is null. tf-incus-image uploads under this name.

Type: string

Default:

"nixos-fediversity"

deployment-method.tf-incus-operator-hosts.imageFingerprint

Fingerprint of the Incus image to use. Null (the default) resolves imageAlias on the target daemon; set one only to pin an exact image.

Type: null or string

Default:

null

deployment-method.tf-incus-operator-hosts.instanceType

Incus instance type: container or virtual-machine.

Type: one of “container”, “virtual-machine”

Default:

"container"

deployment-method.tf-incus-operator-hosts.network

Name of the Incus network bridge to attach to.

Type: string

Default:

"incusbr0"

deployment-method.tf-incus-operator-hosts.port

Port of the Incus HTTPS API.

Type: signed integer

Default:

deployment-method.tf-incus-operator-hosts.project

Name of the Incus project that holds the instances. The hypervisor declares the project. Instances in default have no project in the graph.

Type: string

Default:

"fediversity"