The Fediversity data model's own options, declared in core/lib/data-model.nix.

Collection of Fediversity components

Description to be shown in the component overview

Operator-facing configuration options for the component

Whether this component is an application in the glossary sense: software the operator picks, configures and toggles. Components left at false are infrastructure the applications need and the operator never chooses.

Configuration type declaring options to be set by operators. Carries every declared component, so the deploy path (default-configuration, which enables every roster node including the infrastructure nodes) type-checks against it.

Run-time environments for Fediversity components to be deployed to

The mapping from an operator configuration to a deployment: it resolves each enabled component's required resources and then applies this environment's resource-mapping. Declared as a type-checked function whose output is a deployment (env-output).

Generates a deployment from a configuration by applying this environment's resource policies to the components' resource mappings. By default this is just config-mapping applied, i.e. the end-to-end "configuration in, deployment out" entry point for the environment.

Maps the resources required by the deployed components to the resources this environment actually offers, producing something that can be deployed. This is the environment-specific glue a hosting provider writes; its exact function type (resource-mapping.function-type) is fixed per deployment.

The function type for implementation: it takes the components' required resources (plus a deployment name) and returns a deployment (env-output). Declared as a type-checked function so inputs and outputs are validated.

Resources the hosting provider makes available in this environment, keyed by resource name, each holding that resource's policy (how the provider supplies it). Setting this is optional; it is a place to declare provider-side resource information for use in the resource mapping. The concrete shape of each entry is fixed by the matching resource's policy module under core/resources, so it depends on which resources the environment wires in.

Collection of deployment resources that can be required by components and policed by hosting providers

Description of the resource to help component module authors and hosting providers to work with it

Options for configuring the resource policy for the hosting provider, a description of how the resource is made available

Apply the policy to a request

Collect the relevant requests across all components, then apply the policy to them

The type of resource this policy configures

Options for declaring resource requirements by a component, a description of how the resource is consumed or accessed

Supporting resource requests not tied to a single component, made available to every environment.

Operator-facing configuration for a Fediversity deployment, as set through the hosting provider's panel. This is the schema that drives the frontend form.

What to run: a deployment method (ssh-hosts / tf-hosts / tf-incus-hosts) or a non-deploy operator effect (tf-incus-image / octodns-zone). Pick one, then fill in its settings. The tag key is the method/effect; its value is that entry's settings. A method deploys the enabled applications; an effect runs a standalone action. Always set -- there is no "no selection" state (issue #723).

Manage DNS records for a zone via OctoDNS.

Path, on the deployer, to the file holding the service's API token. A PATH and never a value, so no credential reaches the Nix store: the effect reads it at run time. Empty means the provider needs no token (the self-hosted bind path authenticates with a TSIG key instead).

The DNS domain (zone) to manage.

The OctoDNS provider to use, see <https://octodns.readthedocs.io/en/latest/#providers>.

The files from which to read the secrets to use with the provider.

URL of the authoritative-DNS service's API, scheme and port included. Empty means the domain is served by the deployment's own bind node.

Deploy over SSH to existing hosts: a shared SSH identity plus, per node, where to reach it and any identity override.

Per-application configuration the operator sets to enable and configure each Fediversity application.

Your self-hosted, globally interconnected microblogging community

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Mastodon server on the machine.

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Recommended in <https://docs.joinmastodon.org/admin/setup/>.

How old remote media needs to be in order to be removed.

ActivityPub-federated video streaming platform using P2P directly in your web browser

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Peertube server on the machine.

Instance settings, from PeerTube's own configuration file.

Photo Sharing. For Everyone.

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Pixelfed server on the machine.

Max upload size with units.

Shared SSH identity applied to every node, unless a node overrides it.

Path to the SSH private key the deployer reads (a reference, not key material). Null uses an agent / the deployer default.

Extra SSH options (-o) applied to every node.

SSH user to connect as. Null uses the deployer default.

Apex domain under which the services will be deployed.

Recovery email of the seeded directory administrator.

The central LDAP directory is seeded with a single administrator user at deploy time, named after the deployment group (operator in an operator deployment) and added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively -- the operator establishes it with "Forgot password?" on the authelia portal, which mails a single-use link here, so this address must be deliverable.

Per-node SSH connection info, one optional entry per node in the operator group's roster. Each set node's host is required; identity fields fall back to defaults.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

Deploy via OpenTofu to existing hosts over SSH, with an HTTP state backend.

Per-application configuration the operator sets to enable and configure each Fediversity application.

Your self-hosted, globally interconnected microblogging community

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Mastodon server on the machine.

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Recommended in <https://docs.joinmastodon.org/admin/setup/>.

How old remote media needs to be in order to be removed.

ActivityPub-federated video streaming platform using P2P directly in your web browser

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Peertube server on the machine.

Instance settings, from PeerTube's own configuration file.

Photo Sharing. For Everyone.

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Pixelfed server on the machine.

Max upload size with units.

Shared SSH identity applied to every node, unless a node overrides it.

Path to the SSH private key the deployer reads (a reference, not key material). Null uses an agent / the deployer default.

Extra SSH options (-o) applied to every node.

SSH user to connect as. Null uses the deployer default.

Apex domain under which the services will be deployed.

Recovery email of the seeded directory administrator.

The central LDAP directory is seeded with a single administrator user at deploy time, named after the deployment group (operator in an operator deployment) and added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively -- the operator establishes it with "Forgot password?" on the authelia portal, which mails a single-use link here, so this address must be deliverable.

Address of the OpenTofu HTTP state backend REST endpoint (TF_HTTP_ADDRESS).

Per-node SSH connection info, one optional entry per node in the operator group's roster. Each set node's host is required; identity fields fall back to defaults.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

SSH connection info for this node. Omit to inherit defaults and the roster FQDN.

Host (address) to reach this node over SSH.

Path to the SSH private key for this node. Null inherits defaults.keyFile.

Extra SSH options (-o) for this node, appended to defaults.sshOpts.

SSH user to connect as for this node. Null inherits defaults.username.

Deploy via OpenTofu to Incus-provisioned hosts: Incus connection and instance settings.

Per-application configuration the operator sets to enable and configure each Fediversity application.

Your self-hosted, globally interconnected microblogging community

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Mastodon server on the machine.

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Recommended in <https://docs.joinmastodon.org/admin/setup/>.

How old remote media needs to be in order to be removed.

ActivityPub-federated video streaming platform using P2P directly in your web browser

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Peertube server on the machine.

Instance settings, from PeerTube's own configuration file.

Photo Sharing. For Everyone.

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Pixelfed server on the machine.

Max upload size with units.

Apex domain under which the services will be deployed.

Recovery email of the seeded directory administrator.

The central LDAP directory is seeded with a single administrator user at deploy time, named after the deployment group (operator in an operator deployment) and added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively -- the operator establishes it with "Forgot password?" on the authelia portal, which mails a single-use link here, so this address must be deliverable.

Attach a software-TPM 2.0 device to each container, enabling SPIRE TPM node attestation. Only emitted for container instances.

Address of the Incus server.

SSH identity for the Incus host's own store, used by nodes that share it.

Address of the Incus host's SSH service. Null (the default) reuses host, the address its Incus API is reached at.

Deployer-side path to the private half of the scoped store-serve identity, which the Incus host minted and published to KV. Null offers whatever the deployer's ssh is otherwise configured with.

Deployer-side path to the Nix secret signing key the Incus host's trusted-public-keys lists the public half of. The scoped identity is not one of that host's trusted-users, so its daemon checks the signature on every path it is handed; unsigned, a shared-store copy is refused. Null signs nothing.

Extra SSH options (-o) used to reach the Incus host.

SSH user on the Incus host. The default suits a hosting provider's own deploy, which reaches its hypervisor by the identity it deployed it with. incus-store is the scoped alternative that host can mint (core/components/hosting-provider/incus-store-serve.nix), whose whole vocabulary is the closure copy and the two profile verbs a shared-store deploy needs, and which is what a deployer that is not the machine's administrator gets. core/setups/tf-incus-operator-hosts.nix defaults its own lane to it, an operator's deployer being one of those by definition.

Alias resolved to a fingerprint on the target daemon when imageFingerprint is null. tf-incus-image uploads under this name.

Fingerprint of the Incus image to use. Null (the default) resolves imageAlias on the target daemon; set one only to pin an exact image.

Incus instance type: container or virtual-machine.

Name of the Incus network bridge to attach to.

Port of the Incus HTTPS API.

Upload a NixOS image to an Incus server.

Alias name for the uploaded image.

Address of the Incus server.

Which of the group's nodes to build the image from. Null uses the group's first node.

Port of the Incus HTTPS API.

Deploy via OpenTofu to Incus-provisioned hosts, provisioning the operator's per-namespace garage alongside: Incus connection and instance settings.

Per-application configuration the operator sets to enable and configure each Fediversity application.

Your self-hosted, globally interconnected microblogging community

Fully-qualified domain name the Mastodon instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Mastodon server on the machine.

Automatically remove remote media attachments and preview cards older than the configured amount of days.

Recommended in <https://docs.joinmastodon.org/admin/setup/>.

How old remote media needs to be in order to be removed.

ActivityPub-federated video streaming platform using P2P directly in your web browser

Fully-qualified domain name the Peertube instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Peertube server on the machine.

Instance settings, from PeerTube's own configuration file.

Photo Sharing. For Everyone.

Fully-qualified domain name the Pixelfed instance is served from (e.g. mastodon.example.org). Used as the instance's canonical host in generated URLs, certificates, and federation identifiers.

Whether to enable Enable a Pixelfed server on the machine.

Max upload size with units.

Apex domain under which the services will be deployed.

Recovery email of the seeded directory administrator.

The central LDAP directory is seeded with a single administrator user at deploy time, named after the deployment group (operator in an operator deployment) and added to authelia-users so it can log into every SSO-enabled application (mastodon, peertube, pixelfed) through authelia OIDC. The username follows the group; only this recovery email is operator-facing. No password is set declaratively -- the operator establishes it with "Forgot password?" on the authelia portal, which mails a single-use link here, so this address must be deliverable.

Attach a software-TPM 2.0 device to each container, enabling SPIRE TPM node attestation. Only emitted for container instances.

Address of the Incus server.

SSH identity for the Incus host's own store, used by nodes that share it.

Address of the Incus host's SSH service. Null (the default) reuses host, the address its Incus API is reached at.

Deployer-side path to the private half of the scoped store-serve identity, which the Incus host minted and published to KV. Null offers whatever the deployer's ssh is otherwise configured with.

Deployer-side path to the Nix secret signing key the Incus host's trusted-public-keys lists the public half of. The scoped identity is not one of that host's trusted-users, so its daemon checks the signature on every path it is handed; unsigned, a shared-store copy is refused. Null signs nothing.

Extra SSH options (-o) used to reach the Incus host.

SSH user on the Incus host. The default suits a hosting provider's own deploy, which reaches its hypervisor by the identity it deployed it with. incus-store is the scoped alternative that host can mint (core/components/hosting-provider/incus-store-serve.nix), whose whole vocabulary is the closure copy and the two profile verbs a shared-store deploy needs, and which is what a deployer that is not the machine's administrator gets. core/setups/tf-incus-operator-hosts.nix defaults its own lane to it, an operator's deployer being one of those by definition.

Alias resolved to a fingerprint on the target daemon when imageFingerprint is null. tf-incus-image uploads under this name.

Fingerprint of the Incus image to use. Null (the default) resolves imageAlias on the target daemon; set one only to pin an exact image.

Incus instance type: container or virtual-machine.

Name of the Incus network bridge to attach to.

Port of the Incus HTTPS API.

Whether to enable your Fediversity configuration.

Concrete request options declared by each resource module.

Authoritative-DNS coordinates for an application, fulfilled by either a self-hosted bind node or an external service, through the local dns contract.

Options a component sets to request this resource.

Unique consumer name for this app (analog of ldap's/redis's consumerName), used as the contracts.dns.want.<consumerName> key.

Whether to enable authoritative-DNS coordinates on this application's host.

NixOS configuration module merged onto the application node, fed the resolved contract result ({ provider; host; port; scheme; apiTokenFile; domain; }) so the application can address the group's authoritative-DNS.

Which sources reach a node, and which of the ports it serves are published beyond them.

Options a component sets to request this resource.

TCP ports this application needs reachable from the whole internet rather than from the deployment's own peers only.

Request this only for a port whose users are outside the deployment by nature -- an ingest, a federation endpoint, a browser-facing listener. Everything else is reachable from internalSources without asking.

The application still has to serve the port the ordinary way (networking.firewall.allowedTCPPorts, or an upstream module's openFirewall); this says who may reach it, not that it exists.

UDP counterpart of publicTCPPorts.

Garage storage configuration for an application.

Options a component sets to request this resource.

Whether to enable Enable a Garage server on the machine.

S3 buckets to create on Garage for this application, keyed by bucket name. Each entry is provisioned (and configured for website serving, CORS, and aliases) when the deployment runs.

Additional global bucket aliases (alternative names) to register for this bucket in Garage.

Request headers permitted by the bucket's CORS policy (the AllowedHeaders of the S3 CORS rule).

HTTP methods (e.g. GET, PUT) permitted by the bucket's CORS policy.

Origins (e.g. https://app.example.org) allowed to make cross-origin requests to the bucket.

Whether to enable CORS rules on this bucket, allowing other origins (e.g. a frontend) to fetch its objects from the browser.

Whether to serve this bucket's contents as a static website over HTTP, so its objects are publicly reachable by URL.

S3 access keys to provision on Garage for this application, keyed by key name. Each key is imported from the given credential files and granted the configured per-bucket access.

Per-bucket access this key is granted, keyed by bucket name. At least one of read/write/owner should be set per bucket.

Grant this key owner permission on the bucket (manage the bucket itself, not just its objects).

Grant this key permission to read objects from the bucket.

Grant this key permission to write objects to the bucket.

OpenBao KV instance stem the key's credentials publish under (<kvName>-s3). Defaults to the key name; not tenant-prefixed.

Path to a file holding the S3 access key id to import for this key. The in-Nix (garageSide) provisioner imports a pre-generated key from it; the tf provisioner has garage create the key and captures the secret from state, so it leaves this null. The path is the rendered read-back location, not a generation source.

Path to a file containing the S3 secret access key paired with s3AccessKeyFile. Null for the tf provisioner (see s3AccessKeyFile).

The NixOS configuration module to include.

Declarative generation of an application's secret files, via the generateFiles contract.

Options a component sets to request this resource.

Generation instances this application needs run on its host, keyed by name. Each mirrors a contracts.generateFiles request: a script producing the named files under $out/. The vars provider bridges each generated file into contracts.fileSecrets.want.vars.<name>_<file>, read back via config.contracts.fileSecrets.results.vars.<name>_<file>.path.

Names of other instances whose outputs are made available under $in/<name>/.

Files to generate; keys are file names the script must write under $out/.

Unix group that must own the generated file.

File permissions as an octal string.

Unix user that must own the generated file.

Whether the file contains sensitive data.

Whether the instance's files stand on their own. An atomic instance (the default) refuses to run in a partial state; an independent one generates only what is missing, so it can grow a file without rotating its siblings.

Packages available in PATH during script execution.

Shell script writing each declared file to $out/<name>. Dependency outputs are available under $in/<dep>/.

LDAP directory access for an application, fulfilled by an lldap-backed provider of the nixpkgs ldap contract.

Options a component sets to request this resource.

Unique consumer name for this app (analog of oidc's clientID), used as the contracts.ldap.want.<consumerName> key.

Whether to enable LDAP directory access for the application.

LDAP group the application requires. The provider creates this group. Carried verbatim by the nixpkgs ldap contract request.

NixOS configuration module merged onto the application node, fed the cross-node-resolved contract result (host, port, baseDN, bindDN, bindPasswordFile) so the application can configure its LDAP client.

NetBox IPAM coordinates for an application, fulfilled by either a self-hosted NetBox node or an external instance, through the local netbox contract.

Options a component sets to request this resource.

Unique consumer name for this app (analog of ldap's/redis's consumerName), used as the contracts.netbox.want.<consumerName> key.

Whether to enable NetBox IPAM coordinates on this application's host.

NixOS configuration module merged onto the application node, fed the resolved contract result ({ serverUrl; apiTokenFile; clusterName; tenant; prefixSelector; rangeSelector; }) so the application can address the group's NetBox IPAM.

Networking info.

Options a component sets to request this resource.

A NixOS configuration module to include as-is.

Options a component sets to request this resource.

The NixOS configuration module to include.

Single sign-on (OIDC) for an application, fulfilled by an authelia-backed provider of the nixpkgs oidc contract.

Options a component sets to request this resource.

Authelia authorization policy applied to the client (one_factor, two_factor, or a named policy).

Client ID to register with the OIDC provider. Null for a forwardAuth request (which registers no OIDC client -- authelia protects the vhost through nginx auth_request, not a redirect flow).

Whether to enable an OIDC single-sign-on client for the application.

Forward-auth protection for a plain (non-OIDC) admin UI vhost, instead of an OIDC client. A request is EITHER an OIDC client (clientID/redirectURI set) OR a forward-auth protection (forwardAuth.enable). When set, nginx fronts upstream with an auth_request to authelia's /api/authz/auth-request endpoint, so only authenticated sessions reach the UI -- used for services with no native OIDC (garage-webui, pgweb, redis-commander, windmill).

Whether this vhost belongs to the hosting provider's admin-UI category, which deployAdminUIs gates as a whole.

True for a prod convenience fronting a backend with no native OIDC (garage-webui, pgweb, redis-commander). Set false for a UI that is part of the service it fronts and that every group running that service needs -- lldap's own web UI, which is the directory's self-service surface.

Restrict access to members of these authelia groups. Empty (the default) allows any authenticated user (subject to authorizationPolicy).

Authelia authorization policy for this domain (one_factor suffices for any authenticated user; two_factor for MFA).

Public domain the protected UI is served under, stated in full (e.g. garage-webui.example.org). For a UI published in a zone this deployment does not own; subdomain below is what names one under the deployment's own domain.

Exactly one of the two is set -- see ./forward-auth-domain.nix, which resolves them.

Whether to enable forward-auth protection for this UI vhost.

NixOS configuration module merged onto the node serving the protected UI (e.g. the systemd service running the UI). A function of the resource policy config.

Pass websocket upgrades through to the protected UI. Needed by a UI that streams over a websocket -- the windmill UI's job logs -- and off by default, since the plain admin UIs (garage-webui, pgweb, redis-commander, lldap) do not.

The label the protected UI is served under, hung off the deployment's own deploymentDomain.

What a component SHARED between groups states: a tenant deployment's domain is the tenant's own name, and a shared component that instead reaches for the static apex (core/apex.nix) names the hosting provider's node from inside the tenant's deployment -- a name the tenant may neither publish nor hold a certificate for.

Proxy target nginx forwards to once authenticated (e.g. 127.0.0.1:3909).

nginx include pattern pulled into location /, for a protected UI that cannot log a user in itself: one who has just cleared the portal would otherwise be met by a second, unrelated login form. A unit on the node drops a proxy_set_header Authorization ...; line matching this pattern once it holds a token to present, and the gate then presents it on that user's behalf.

A glob rather than a fixed path, because nginx has to start before that unit has ever run: an include of a missing file refuses to load, while one whose mask matches nothing is not an error.

Null (the default) leaves the gate a plain proxy, which is what a UI that authenticates the forwarded Remote-User itself wants.

Issue RFC 9068 JWT-profile access tokens to this client (access_token_signed_response_alg: RS256) instead of authelia's default opaque tokens. For consumers that verify the bearer access token locally as a JWT against the issuer's JWKS, e.g. the incus daemon, which parses every bearer token and rejects an opaque one with "token contains an invalid number of segments".

NixOS configuration module merged onto the application node, so the application can read back its fulfilled contract result via config.contracts.oidc.results.<app>.<instance>.

Register the client as a public OIDC client (no client secret; token_endpoint_auth_method: none, PKCE enforced). For consumers that cannot hold a secret, e.g. the incus UI, whose token exchange sends no client authentication.

Primary callback URI the provider should redirect to after authentication. This is the value carried by the nixpkgs oidc contract request; additional URIs go in redirectURIs. Null for a forwardAuth request (no redirect flow).

Extra callback URIs to register on the OIDC client, beyond redirectURI. Authelia registers the union of redirectURI and these. These ride alongside the contract (which only models a single redirectURI) and are applied by the authelia provider.

OIDC scopes the client may request. Defaults to the standard OpenID Connect profile scopes.

OpenTelemetry collector endpoint for emitting telemetry signals from an application. The policy carries the collector's OTLP endpoint; each application that opts in contributes a nixos-configuration function that, given the endpoint, returns its per-service OTel wiring as a NixOS module. The resource emits those modules onto the application's host.

Options a component sets to request this resource.

Whether to enable emitting OpenTelemetry signals from this application to the configured collector.

Function endpoint -> nixos-module returning the per-service OTel wiring for this application.

PostgreSQL database access for an application, fulfilled by a postgres-backed provider of the postgresql contract on a dedicated database node.

Options a component sets to request this resource.

Application-specific SQL run as the postgres superuser against this app's database, after it is created and before any consumer connects. Some upstream service modules ship migrations assuming roles or objects their NixOS module creates only under a createLocally = true path a remote consumer disables. Has to be idempotent, being re-applied every deploy. @username@ and @database@ are replaced by the request's username and database as created, namespacePrefix included; quote them as identifiers, since a prefixed name carries a hyphen.

Unique consumer name for this app (analog of oidc's clientID), used as the contracts.postgresql.want.<consumerName> key.

How the central OpenBao database engine issues this consumer's credential:

• rotating (default): a fixed-name database/static-roles/<role> whose password the engine rotates on rotation_period; the consumer reads database/static-creds/<role> and the login name never changes. Required wherever a consumer pins a fixed database user.

• dynamic: a database/roles/<role> minting a short-lived role with a random per-lease username on each read of database/creds/<role>. Usable by a consumer that takes the full DSN (result.urlFile) and pins no user, buying per-lease revocation at the cost of a stable username.

TODO: extend dynamic coverage. A fixed-user consumer needs an indirection such as a connection pooler holding the leased DSN behind a stable local socket, so those stay on rotating, with shorter rotation_periods as the interim containment knob.

PostgreSQL database the application requires; the provider creates it. Carried verbatim by the postgresql contract request.

Persistent NOLOGIN role owning every object this app creates under dynamic credentials. Each lease role is granted membership in it and gets ALTER ROLE ... SET role = '<owner>', so objects land on the persistent role rather than the random per-lease role, whose objects become unreachable once revoked. The provider node creates the role and re-owns stranded objects to it. Empty derives <username>_owner. Ignored for rotating consumers.

Existing roles each freshly-minted dynamic lease role is granted membership in, folded into the engine's dynamic creation_statements as GRANT <role> TO "{{name}}". A dynamic consumer connects as a random per-lease role, so any group role it expects to SET ROLE to has to be granted per lease rather than once to a fixed user. Pair with bootstrapSQL, which creates those roles: they have to exist when a lease is minted, or role creation fails. Ignored for rotating consumers.

Whether to enable PostgreSQL database access for the application.

NixOS configuration module merged onto the application node, fed the cross-node-resolved contract result so the application can configure its database client.

Mode of the rendered passwordFile/urlFile. Defaults to 0640, root-owned and group-readable, which suits consumers reading it via systemd LoadCredential. Set 0400 with a non-root passwordFileOwner for an app reading the file as its own service user.

Owner of the rendered passwordFile/urlFile. Defaults to root; set to the app's service user when that user cats the file directly. The agent gives the file to this owner on every render, and again before it starts, so a change to this value reaches a file the render leaves alone.

Systemd units the openbao agent restarts after it re-renders this consumer's credential. Every consumer reads the credential once at process start, so one holding the previous credential starts failing with password authentication failed.

List the app service plus any unit baking the credential into a derived file the app reads; they are restarted in one systemd transaction, which honors their own After=. Empty means the consumer does not converge on rotation, correct only where it reads the credential afresh on each use.

PostgreSQL role the application connects as. Defaults to the consumerName. Carried by the postgresql contract request.

Redis-compatible cache access for an application, fulfilled by an external provider (shared valkey node, OpenBao-brokered per-namespace credentials) of the nixpkgs redis contract.

Options a component sets to request this resource.

Unique consumer name for this app (analog of ldap's consumerName), used as the contracts.redis.want.<consumerName> key.

Units that must not start until this namespace's valkey listener completes a TLS handshake the consumer node can verify, and answers. Each named unit gets an ExecStartPre probe (./wait-reachable.sh), which spends a short budget inside that unit's own start timeout.

For a database migration runner. A Laravel migration can change the schema and then dispatch a queued job, and MySQL does not roll back DDL, so a dispatch that fails on a TLS error leaves the schema changed and the ledger row unwritten. Each later run then stops on a duplicate column, a state no configuration repairs. The gate makes the unit fail before its first statement instead.

The application's logical cache identity. Selects the application's own valkey@<namespace> instance -- its own process and port on the group's valkey node -- so namespaces are isolated by process, not by an ACL key-scope. Also the OpenBao static-role name that rotates the instance's password. The multi-operator case folds the operator id in via namespacePrefix.

NixOS configuration module merged onto the application node, fed the cross-node-resolved contract result (host, port, passwordFile) so the application can configure its redis client and wire the openbao-agent to render the rotated password.

Secrets provisioning for an application, via the fileSecrets contract.

Options a component sets to request this resource.

Secrets this application needs provisioned on its host, keyed by name. Each becomes a contracts.fileSecrets.want.<app>.<name> request, read back from config.contracts.fileSecrets.results.<app>.<name>.path.

Encrypted .age source. Defaults to ./<name>.age for the agenix provider.

Linux group that must own the secret file. Defaults to the owner's primary group, as agenix does.

Mode the secret file must have.

Linux user that must own the secret file.

Outbound SMTP mail submission for an application, fulfilled by a maddy-backed (or external) provider of the nixpkgs smtp contract.

Options a component sets to request this resource.

Whether to enable outbound SMTP mail submission for the application.

NixOS configuration module merged onto the application node, which reads its fulfilled result back from config.contracts.smtp.results.<app>.default.

Email address used as the sender (From header), carried verbatim by the nixpkgs smtp contract request.

SPIFFE workload identity (spire-agent) provisioning for an application's host.

Options a component sets to request this resource.

Whether to enable a spire-agent on this host for SPIFFE workload identity.

TLS certificate provisioning for an application's vhosts.

Options a component sets to request this resource.

Domains this application terminates TLS for (its own vhosts).

Domains served by another node this node must trust as a client (e.g. the garage bucket endpoints). Drives cross-node trust baking.