homelab.apps.audiobookshelf.enable¶

Whether to enable audiobookshelf with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.bazarr.enable¶

Whether to enable bazarr with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.jellyfin.enable¶

Whether to enable jellyfin with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.lidarr.enable¶

Whether to enable lidarr with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.navidrome.enable¶

Whether to enable navidrome with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.nzbget.enable¶

Whether to enable nzbget with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.nzbget.bindAddress¶

Control interface address.

Type: string

Default:

"127.0.0.1"

Declared by: - \

homelab.apps.nzbget.controlPort¶

Control interface TCP port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

6789

Declared by: - \

homelab.apps.nzbget.credentialsFile¶

User-provided runtime credential fragment. Merged before each start; values never enter command arguments or the Nix store.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.apps.nzbget.vpn.enable¶

Whether to enable VPN egress for NZBGet.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.plex.enable¶

Whether to enable plex with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.prowlarr.enable¶

Whether to enable prowlarr with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.prowlarr.bindAddress¶

Prowlarr listen address.

Type: string

Default:

"127.0.0.1"

Declared by: - \

homelab.apps.prowlarr.port¶

Default Prowlarr TCP port; native services.prowlarr.settings.server.port can override it.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

9696

Declared by: - \

homelab.apps.prowlarr.vpn.enable¶

Whether to enable confinement of all Prowlarr traffic, including app sync.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.qbittorrent.enable¶

Whether to enable qbittorrent with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.qbittorrent.apiKeyFile¶

Runtime qBittorrent 5.2 API-key file used only to reconcile declared categories and tags.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.apps.qbittorrent.bindAddress¶

Web UI listen address. Confined traffic is reachable only from the host link.

Type: string

Default:

"127.0.0.1"

Declared by: - \

homelab.apps.qbittorrent.configuration.categories¶

Named qBittorrent categories. Paths must stay under the homelab downloads directory.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.apps.qbittorrent.configuration.categories.\.savePath¶

Absolute category save path. The default isolates each workflow below the torrent download root.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"${config.homelab.storage.downloadsDir}/torrents/${name}"

Declared by: - \

homelab.apps.qbittorrent.configuration.interval¶

Delay between completed qBittorrent resource reconciliation runs.

Type: string

Default:

"15min"

Declared by: - \

homelab.apps.qbittorrent.configuration.mode¶

Bootstrap creates absent resources; managed also updates declared category paths. Neither mode deletes resources.

Type: one of “bootstrap”, “managed”

Default:

"bootstrap"

Declared by: - \

homelab.apps.qbittorrent.configuration.tags¶

Tags to create if absent. Existing and undeclared tags are preserved.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.apps.qbittorrent.credentialsFile¶

Runtime INI file with WebUI username and Password_PBKDF2 under [Preferences]. Merged after public settings on every start.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.ignoreSlowTorrents¶

Whether slow torrents may exceed the active queue limits.

Type: boolean

Default:

false

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.localPeerDiscovery¶

Enable local peer discovery. Disabled by default to avoid LAN discovery traffic from the VPN namespace.

Type: boolean

Default:

false

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxActiveDownloads¶

Maximum number of torrents downloading concurrently.

Type: positive integer, meaning >0

Default:

3

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxActiveTorrents¶

Maximum combined number of active downloading and seeding torrents.

Type: positive integer, meaning >0

Default:

8

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxActiveUploads¶

Maximum number of torrents seeding concurrently.

Type: positive integer, meaning >0

Default:

5

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxConnections¶

Maximum global peer connections.

Type: positive integer, meaning >0

Default:

200

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxConnectionsPerTorrent¶

Maximum peer connections for one torrent.

Type: positive integer, meaning >0

Default:

50

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxUploads¶

Maximum global upload slots.

Type: positive integer, meaning >0

Default:

20

Declared by: - \

homelab.apps.qbittorrent.resourcePolicy.maxUploadsPerTorrent¶

Maximum upload slots for one torrent.

Type: positive integer, meaning >0

Default:

8

Declared by: - \

homelab.apps.qbittorrent.torrentingPort¶

Peer TCP/UDP port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

51413

Declared by: - \

homelab.apps.qbittorrent.vpn.enable¶

Confine BitTorrent traffic. Disable explicitly only if direct ISP-visible peer traffic is intended.

Type: boolean

Default:

true

Declared by: - \

homelab.apps.qbittorrent.vpn.allowInbound¶

Whether to enable inbound peer traffic from a provider that supports port forwarding.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.qbittorrent.webuiPort¶

Web UI TCP port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8081

Declared by: - \

homelab.apps.radarr.enable¶

Whether to enable radarr with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.sabnzbd.enable¶

Whether to enable sabnzbd with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.sabnzbd.port¶

SABnzbd Web UI port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8080

Declared by: - \

homelab.apps.sabnzbd.vpn.enable¶

Whether to enable VPN egress for SABnzbd in addition to provider TLS.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.seerr.enable¶

Whether to enable seerr with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.apps.sonarr.enable¶

Whether to enable sonarr with homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.indexerProxy.enable¶

Whether to enable an authenticated VPN-confined SOCKS5 proxy for selected Prowlarr indexers.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.indexerProxy.passwordFile¶

Absolute runtime file containing the SOCKS5 password.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.indexerProxy.port¶

SOCKS5 port reachable only over the namespace host link.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

1080

Declared by: - \

homelab.indexerProxy.username¶

SOCKS5 username supplied to explicitly configured Prowlarr proxies.

Type: string matching the pattern [A-Za-z0-9._-]+

Default:

"prowlarr"

Declared by: - \

homelab.integration.enable¶

Whether to enable authenticated application reconciliation.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.integration.interval¶

Delay between completed reconciliation runs. No overlapping jobs are started.

Type: string

Default:

"15min"

Declared by: - \

homelab.integration.services¶

Application API jobs. Settings support {_secret = /absolute/runtime/path;} references; values are loaded through systemd credentials.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integration.services.\.after¶

Additional prerequisite systemd units, including user secret activation and other integration jobs.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integration.services.\.apiKeyFile¶

User-supplied runtime API key file. Jellyfin, Seerr, Navidrome and Audiobookshelf may instead use settings.login.

Type: null or string

Default:

null

Declared by: - \

homelab.integration.services.\.extraResources¶

Unsupported raw Arr resources for forward compatibility. They retain runtime secret validation but carry no versioned compatibility promise.

Type: list of (JSON value)

Default:

[ ]

Declared by: - \

homelab.integration.services.\.extraSettings¶

Unsupported raw adapter settings recursively merged over typed settings for forward compatibility. These fields carry no versioned compatibility promise.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integration.services.\.installApiKey¶

Install a user-provided key into a local Servarr runtime environment file or Bazarr configuration. Restart the key unit when present and the application after rotation.

Type: boolean

Default:

false

Declared by: - \

homelab.integration.services.\.kind¶

Application API adapter.

Type: one of “audiobookshelf”, “autobrr”, “bazarr”, “jellyfin”, “lidarr”, “navidrome”, “prowlarr”, “radarr”, “seerr”, “sonarr”

Default:

"‹name›"

Declared by: - \

homelab.integration.services.\.mode¶

Bootstrap preserves existing objects. Managed updates declared fields. Neither mode deletes undeclared objects.

Type: one of “bootstrap”, “managed”

Default:

"bootstrap"

Declared by: - \

homelab.integration.services.\.resources¶

Typed Arr resource envelopes. Provider-specific values remain schema-validated by the running application.

Type: list of (submodule)

Default:

[ ]

Declared by: - \

homelab.integration.services.\.resources.*.endpoint¶

Supported Arr collection endpoint.

Type: one of “rootfolder”, “downloadclient”, “indexer”, “indexerproxy”, “applications”, “tag”, “qualityprofile”, “delayprofile”, “notification”, “remotepathmapping”

Declared by: - \

homelab.integration.services.\.resources.*.match¶

Stable name, path, or label used to find exactly one owned object.

Type: attribute set of (JSON value)

Default:

{ }

Declared by: - \

homelab.integration.services.\.resources.*.values¶

Declared provider fields, validated against the running application’s schema.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integration.services.\.settings¶

Typed adapter configuration for supported libraries, accounts, request policies and subtitle settings. See the integration guide.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integration.services.\.url¶

Local HTTP or remote HTTPS API base URL. Redirects and credential-bearing URLs are rejected.

Type: string matching the pattern https?://[^@?#]+

Declared by: - \

homelab.integrations.downloadClients¶

Reusable typed download-client connections referenced by Servarr instances.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.downloadClients.\.after¶

Units that must complete before managers reconcile this client.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.downloadClients.\.apiKeyFile¶

Runtime file containing the client API key.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.downloadClients.\.extraFields¶

Schema-checked provider fields not covered by the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.downloadClients.\.host¶

Host name or address reachable from the manager.

Type: string

Default:

"127.0.0.1"

Declared by: - \

homelab.integrations.downloadClients.\.manageCategories¶

Create referenced categories in the local qBittorrent service before manager reconciliation.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.downloadClients.\.name¶

Stable display name used to own this client in each manager.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.downloadClients.\.passwordFile¶

Runtime file containing the client password.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.downloadClients.\.port¶

Download-client API port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Declared by: - \

homelab.integrations.downloadClients.\.type¶

Download-client provider translated to the running Servarr schema.

Type: one of “qbittorrent”, “sabnzbd”, “nzbget”, “transmission”, “deluge”

Declared by: - \

homelab.integrations.downloadClients.\.urlBase¶

Optional URL path used by the client’s RPC interface.

Type: string

Default:

""

Declared by: - \

homelab.integrations.downloadClients.\.useSsl¶

Use TLS between the manager and download client.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.downloadClients.\.usernameFile¶

Runtime file containing the client username.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.jellyfin¶

Typed Jellyfin bootstrap, library, encoding and restricted-user reconciliation.

Type: null or (submodule)

Default:

null

Declared by: - \

homelab.integrations.jellyfin.administrator.name¶

Administrator name used for first-run setup and optional password rotation.

Type: string

Default:

"admin"

Declared by: - \

homelab.integrations.jellyfin.administrator.passwordFile¶

Runtime file containing the administrator password.

Type: string matching the pattern /[A-Za-z0-9_./ -]+

Declared by: - \

homelab.integrations.jellyfin.after¶

Additional prerequisite units for Jellyfin reconciliation.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.jellyfin.apiKeyFile¶

Runtime API-key file used after attended bootstrap.

Type: string matching the pattern /[A-Za-z0-9_./ -]+

Declared by: - \

homelab.integrations.jellyfin.encoding¶

Portable encoding policy; device access and packages remain native service settings.

Type: submodule

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.encoding.enableSegmentDeletion¶

Delete old transcoding segments during playback.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.encoding.enableThrottling¶

Throttle transcodes that are sufficiently ahead of playback.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.encoding.extraSettings¶

Version-specific encoding settings outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.encoding.hardwareAccelerationType¶

Jellyfin hardware acceleration backend selected by the host.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.jellyfin.encoding.hardwareDecodingCodecs¶

Codecs explicitly allowed for hardware decoding; an empty list leaves the API value unmanaged.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.jellyfin.encoding.segmentKeepSeconds¶

Seconds of completed segments retained behind playback.

Type: null or (positive integer, meaning >0)

Default:

null

Declared by: - \

homelab.integrations.jellyfin.encoding.threadCount¶

FFmpeg encoding thread count; -1 lets Jellyfin choose.

Type: null or signed integer

Default:

null

Declared by: - \

homelab.integrations.jellyfin.extraSettings¶

Version-specific top-level reconciler settings outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.libraries¶

Named Jellyfin libraries updated without deleting undeclared libraries.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.libraries.\.enableChapterImageExtraction¶

Allow chapter-image extraction for this library.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.libraries.\.enableRealtimeMonitor¶

Watch supported filesystems for library changes.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.libraries.\.enableTrickplayImageExtraction¶

Allow trickplay image generation for this library.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.libraries.\.collectionType¶

Jellyfin content type used when the library is created.

Type: one of “books”, “homevideos”, “mixed”, “movies”, “music”, “musicvideos”, “photos”, “tvshows”

Declared by: - \

homelab.integrations.jellyfin.libraries.\.extraOptions¶

Version-specific Jellyfin LibraryOptions outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.libraries.\.extractChapterImagesDuringLibraryScan¶

Extract chapter images during full scans.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.libraries.\.extractTrickplayImagesDuringLibraryScan¶

Generate trickplay images during full scans.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.libraries.\.paths¶

Absolute media locations owned by this named library.

Type: non-empty (list of string matching the pattern /[A-Za-z0-9_./ -]+)

Declared by: - \

homelab.integrations.jellyfin.libraries.\.saveTrickplayWithMedia¶

Store trickplay data beside media rather than only in Jellyfin state.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.jellyfin.mode¶

Bootstrap preserves existing objects; managed updates fields owned by this declaration.

Type: one of “bootstrap”, “managed”

Default:

"bootstrap"

Declared by: - \

homelab.integrations.jellyfin.startup.metadataCountryCode¶

Metadata country installed during first-run setup.

Type: string

Default:

"US"

Declared by: - \

homelab.integrations.jellyfin.startup.preferredMetadataLanguage¶

Metadata language installed during first-run setup.

Type: string

Default:

"en"

Declared by: - \

homelab.integrations.jellyfin.startup.serverName¶

Server name installed during first-run setup.

Type: string

Default:

"Media library"

Declared by: - \

homelab.integrations.jellyfin.startup.uiCulture¶

UI culture installed during first-run setup.

Type: string

Default:

"en"

Declared by: - \

homelab.integrations.jellyfin.url¶

Jellyfin API base URL.

Type: string

Declared by: - \

homelab.integrations.jellyfin.users¶

Named local Jellyfin users with restrictive policy defaults.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.users.\.enableAllFolders¶

Grant access to every library, including libraries created outside this module.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.enableAudioPlaybackTranscoding¶

Allow server-side audio transcoding for this user.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.enableContentDeletion¶

Allow this user to delete media from storage.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.enableContentDownloading¶

Allow this user to download original media files.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.enableMediaPlayback¶

Allow local media playback.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.jellyfin.users.\.enablePlaybackRemuxing¶

Allow container remuxing without re-encoding media.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.jellyfin.users.\.enableRemoteAccess¶

Allow authentication from outside Jellyfin’s local-network classification.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.enableVideoPlaybackTranscoding¶

Allow server-side video transcoding for this user.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.extraPolicy¶

Version-specific Jellyfin UserPolicy fields outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.jellyfin.users.\.isAdministrator¶

Grant Jellyfin administrator privileges.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.jellyfin.users.\.isHidden¶

Hide this account from the login screen.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.jellyfin.users.\.passwordFile¶

Runtime file containing this user’s desired password.

Type: string matching the pattern /[A-Za-z0-9_./ -]+

Declared by: - \

homelab.integrations.notifications¶

Reusable typed Jellyfin and ntfy notifications referenced by Servarr instances.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.notifications.\.accessTokenFile¶

Runtime file containing an ntfy access token.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.notifications.\.after¶

Units that must be ready before managers reconcile this notification.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.notifications.\.apiKeyFile¶

Runtime file containing the Jellyfin API key.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.notifications.\.clickUrl¶

Optional ntfy notification click target.

Type: string

Default:

""

Declared by: - \

homelab.integrations.notifications.\.events¶

Events that trigger this notification.

Type: submodule

Default:

{ }

Declared by: - \

homelab.integrations.notifications.\.events.includeHealthWarnings¶

Include warning-level manager health events.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.notifications.\.events.onApplicationUpdate¶

Notify after the manager updates itself.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.notifications.\.events.onDownload¶

Notify after a download is imported.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.events.onGrab¶

Notify when a release is grabbed.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.notifications.\.events.onHealthIssue¶

Notify when a manager health check fails.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.events.onHealthRestored¶

Notify when a manager health check recovers.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.events.onImportComplete¶

Notify after all files in an import complete.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.events.onManualInteractionRequired¶

Notify when an import requires operator intervention.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.events.onRename¶

Notify after files are renamed.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.events.onUpgrade¶

Include upgrades in download notifications.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.extraFields¶

Schema-checked provider fields not covered by the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.notifications.\.host¶

Jellyfin host name or address.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.notifications.\.mapFrom¶

Optional manager path prefix translated for Jellyfin.

Type: string

Default:

""

Declared by: - \

homelab.integrations.notifications.\.mapTo¶

Optional Jellyfin path prefix paired with mapFrom.

Type: string

Default:

""

Declared by: - \

homelab.integrations.notifications.\.messageTags¶

ntfy message tags or emoji short names.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.notifications.\.name¶

Stable display name owned in each referencing manager.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.notifications.\.notify¶

Send Jellyfin user notifications as well as library updates.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.notifications.\.passwordFile¶

Runtime file containing an ntfy password.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.notifications.\.port¶

Jellyfin API port.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by: - \

homelab.integrations.notifications.\.priority¶

ntfy message priority from 1 (minimum) through 5 (maximum).

Type: integer between 1 and 5 (both inclusive)

Default:

3

Declared by: - \

homelab.integrations.notifications.\.serverUrl¶

ntfy server URL; null uses the provider default.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.notifications.\.tags¶

Manager tags restricting this notification.

Type: list of string matching the pattern [A-Za-z0-9][A-Za-z0-9._ -]*

Default:

[ ]

Declared by: - \

homelab.integrations.notifications.\.topics¶

ntfy topics receiving events.

Type: list of string matching the pattern [A-Za-z0-9_-]+

Default:

[ ]

Declared by: - \

homelab.integrations.notifications.\.type¶

Reviewed Servarr notification provider.

Type: one of “jellyfin”, “ntfy”

Declared by: - \

homelab.integrations.notifications.\.updateLibrary¶

Tell Jellyfin to refresh affected library items.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.notifications.\.urlBase¶

Optional Jellyfin URL base.

Type: string

Default:

""

Declared by: - \

homelab.integrations.notifications.\.useSsl¶

Use TLS for the Jellyfin connection.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.notifications.\.username¶

Optional ntfy username.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.prowlarr¶

Typed Prowlarr application, indexer, tag and per-indexer proxy reconciliation.

Type: null or (submodule)

Default:

null

Declared by: - \

homelab.integrations.prowlarr.after¶

Additional prerequisite units for Prowlarr reconciliation.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.prowlarr.apiKeyFile¶

Runtime file containing the Prowlarr API key.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Declared by: - \

homelab.integrations.prowlarr.applications¶

Named Servarr instances synchronized by Prowlarr.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.applications.\.animeSyncCategories¶

Sonarr anime categories synchronized in addition to the standard categories.

Type: list of (unsigned integer, meaning >=0)

Default:

[
  5070
]

Declared by: - \

homelab.integrations.prowlarr.applications.\.authPasswordFile¶

Runtime file containing application HTTP-auth password.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.prowlarr.applications.\.authUsername¶

Optional application HTTP-auth username.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.prowlarr.applications.\.extraFields¶

Schema-checked application fields not covered by the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.applications.\.manager¶

Named homelab.integrations.servarr instance to synchronize.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.prowlarr.applications.\.name¶

Stable display name owned in Prowlarr.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.prowlarr.applications.\.syncAnimeStandardFormatSearch¶

Allow Prowlarr to synchronize Sonarr’s standard-numbering anime search.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.prowlarr.applications.\.syncCategories¶

Newznab categories to synchronize; null uses the pinned Prowlarr defaults.

Type: null or (list of (unsigned integer, meaning >=0))

Default:

null

Declared by: - \

homelab.integrations.prowlarr.applications.\.syncLevel¶

Whether Prowlarr only adds indexers or also updates and removes synchronized indexers.

Type: one of “addOnly”, “fullSync”

Default:

"fullSync"

Declared by: - \

homelab.integrations.prowlarr.applications.\.syncRejectBlocklistedTorrentHashesWhileGrabbing¶

Ask the target manager to reject blocklisted torrent hashes while grabbing.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.prowlarr.extraResources¶

Unsupported schema-checked Prowlarr resources for forward compatibility.

Type: list of (JSON value)

Default:

[ ]

Declared by: - \

homelab.integrations.prowlarr.indexers¶

Opt-in provider indexers; provider-specific fields remain runtime-schema validated.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.indexers.\.enable¶

Enable this indexer in Prowlarr.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.prowlarr.indexers.\.extraSettings¶

Schema-checked indexer settings outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.indexers.\.fields¶

Non-secret provider fields validated against the running Prowlarr schema.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.indexers.\.implementation¶

Implementation selected from the running Prowlarr indexer schema.

Type: string

Declared by: - \

homelab.integrations.prowlarr.indexers.\.name¶

Stable display name owned in Prowlarr.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.prowlarr.indexers.\.priority¶

Indexer priority; lower values are preferred.

Type: integer between 1 and 50 (both inclusive)

Default:

25

Declared by: - \

homelab.integrations.prowlarr.indexers.\.secretFields¶

Provider field names mapped to runtime secret files.

Type: attribute set of string matching the pattern /[A-Za-z0-9_./-]+

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.indexers.\.tags¶

Named tags used for proxy selection and application filtering.

Type: list of string matching the pattern [A-Za-z0-9][A-Za-z0-9._ -]*

Default:

[ ]

Declared by: - \

homelab.integrations.prowlarr.installApiKey¶

Install the declared API key into the local native Prowlarr service.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.prowlarr.mode¶

Bootstrap preserves existing matches; managed updates declared fields. Neither mode deletes resources.

Type: one of “bootstrap”, “managed”

Default:

"bootstrap"

Declared by: - \

homelab.integrations.prowlarr.proxies¶

Tagged per-indexer proxies managed in Prowlarr.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.proxies.\.extraFields¶

Schema-checked proxy fields not covered by the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.prowlarr.proxies.\.host¶

HTTP or SOCKS5 proxy host name or address.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.prowlarr.proxies.\.name¶

Stable display name owned in Prowlarr.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.prowlarr.proxies.\.passwordFile¶

Runtime file containing proxy password.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.prowlarr.proxies.\.port¶

HTTP or SOCKS5 proxy port.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

null

Declared by: - \

homelab.integrations.prowlarr.proxies.\.requestTimeout¶

FlareSolverr request timeout in seconds.

Type: integer between 1 and 180 (both inclusive)

Default:

60

Declared by: - \

homelab.integrations.prowlarr.proxies.\.tags¶

Named tags selecting the indexers that use this proxy.

Type: non-empty (list of string matching the pattern [A-Za-z0-9][A-Za-z0-9._ -]*)

Declared by: - \

homelab.integrations.prowlarr.proxies.\.type¶

Prowlarr indexer-proxy implementation.

Type: one of “http”, “socks5”, “flaresolverr”

Declared by: - \

homelab.integrations.prowlarr.proxies.\.url¶

FlareSolverr-compatible service URL.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.prowlarr.proxies.\.username¶

Optional HTTP or SOCKS5 proxy username.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.prowlarr.url¶

Prowlarr API base URL, including a URL base when configured.

Type: string

Declared by: - \

homelab.integrations.seerr¶

Typed Seerr onboarding, destination and conservative request policy reconciliation.

Type: null or (submodule)

Default:

null

Declared by: - \

homelab.integrations.seerr.after¶

Additional prerequisite units for Seerr reconciliation.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.seerr.allowAutomaticRequests¶

Explicit safety gate for auto-approval or automatic-request permissions.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.seerr.apiKeyFile¶

Optional runtime Seerr API-key file; login is used when absent.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.seerr.defaultPermissions¶

Permissions granted to new media-server users.

Type: list of (one of “autoApprove”, “autoApprove4k”, “autoApprove4kMovie”, “autoApprove4kTv”, “autoApproveMovie”, “autoApproveTv”, “autoRequest”, “autoRequestMovie”, “autoRequestTv”, “createIssues”, “recentView”, “request”, “request4k”, “requestAdvanced”, “requestMovie”, “requestTv”, “requestView”, “viewBlocklist”, “viewIssues”, “vote”, “watchlistView”)

Default:

[
  "request"
]

Declared by: - \

homelab.integrations.seerr.destinations¶

Named Sonarr and Radarr request destinations.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.seerr.destinations.\.enableSeasonFolders¶

Create Sonarr season folders.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.seerr.destinations.\.extraSettings¶

Version-specific destination settings outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.seerr.destinations.\.is4k¶

Mark this as a 4K destination.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.seerr.destinations.\.isDefault¶

Use this as Seerr’s default destination for its media type.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.seerr.destinations.\.manager¶

Named Sonarr or Radarr instance from homelab.integrations.servarr.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.seerr.destinations.\.minimumAvailability¶

Radarr minimum availability for new requests.

Type: one of “announced”, “inCinemas”, “released”, “preDB”

Default:

"released"

Declared by: - \

homelab.integrations.seerr.destinations.\.name¶

Stable Seerr destination name.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.seerr.destinations.\.preventSearch¶

Add requests without starting an automatic search.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.seerr.destinations.\.qualityProfile¶

Exact quality profile name exposed by the referenced manager.

Type: string

Declared by: - \

homelab.integrations.seerr.destinations.\.rootFolder¶

Named root folder in the referenced manager declaration.

Type: string

Declared by: - \

homelab.integrations.seerr.destinations.\.syncEnabled¶

Synchronize manager state into Seerr.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.seerr.extraMainSettings¶

Version-specific Seerr main settings outside the stable typed interface.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.seerr.extraNotificationSettings¶

Version-specific Seerr notification settings.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.seerr.jellyfin.email¶

Initial Seerr administrator email.

Type: string

Declared by: - \

homelab.integrations.seerr.jellyfin.hostname¶

Jellyfin host reachable from Seerr.

Type: string

Default:

"127.0.0.1"

Declared by: - \

homelab.integrations.seerr.jellyfin.libraries¶

Declared Jellyfin library names enabled in Seerr.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.seerr.jellyfin.port¶

Jellyfin port reachable from Seerr.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8096

Declared by: - \

homelab.integrations.seerr.jellyfin.urlBase¶

Jellyfin URL base.

Type: string

Default:

""

Declared by: - \

homelab.integrations.seerr.jellyfin.useSsl¶

Use TLS for Seerr’s Jellyfin connection.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.seerr.mode¶

Bootstrap preserves existing destinations; managed updates declared fields.

Type: one of “bootstrap”, “managed”

Default:

"bootstrap"

Declared by: - \

homelab.integrations.seerr.quotas.movie¶

Default movie request quota.

Type: null or (submodule)

Default:

null

Declared by: - \

homelab.integrations.seerr.quotas.movie.days¶

Rolling quota window in days.

Type: positive integer, meaning >0

Declared by: - \

homelab.integrations.seerr.quotas.movie.limit¶

Maximum requests during the quota window; zero disables requests of this type.

Type: unsigned integer, meaning >=0

Declared by: - \

homelab.integrations.seerr.quotas.tv¶

Default television request quota.

Type: null or (submodule)

Default:

null

Declared by: - \

homelab.integrations.seerr.quotas.tv.days¶

Rolling quota window in days.

Type: positive integer, meaning >0

Declared by: - \

homelab.integrations.seerr.quotas.tv.limit¶

Maximum requests during the quota window; zero disables requests of this type.

Type: unsigned integer, meaning >=0

Declared by: - \

homelab.integrations.seerr.url¶

Seerr API base URL.

Type: string

Declared by: - \

homelab.integrations.servarr¶

Independently named Sonarr, Radarr and Lidarr API instances.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.after¶

Additional prerequisite units for this instance.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.servarr.\.apiKeyFile¶

Runtime API-key file for this instance.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Declared by: - \

homelab.integrations.servarr.\.downloadClients¶

References to reusable download-client declarations with unique categories.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.enable¶

Whether the manager may send jobs to this client.

Type: boolean

Default:

true

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.category¶

Unique queue category for this manager workflow.

Type: string matching the pattern [A-Za-z0-9][A-Za-z0-9._/-]*

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.client¶

Name of a declaration in homelab.integrations.downloadClients.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.priority¶

Manager-side client priority; lower values are preferred.

Type: integer between 1 and 50 (both inclusive)

Default:

1

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.removeCompletedDownloads¶

Allow the manager to remove completed client jobs.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.removeFailedDownloads¶

Allow the manager to remove failed client jobs.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.servarr.\.downloadClients.\.savePath¶

Local qBittorrent category path; defaults below the shared torrent root.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.servarr.\.extraResources¶

Unsupported schema-checked Arr resources for forward compatibility.

Type: list of (JSON value)

Default:

[ ]

Declared by: - \

homelab.integrations.servarr.\.extraSettings¶

Unsupported manager settings for forward compatibility.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.installApiKey¶

Install this key into the one local native service of the same kind.

Type: boolean

Default:

false

Declared by: - \

homelab.integrations.servarr.\.kind¶

Servarr application represented by this independently named instance.

Type: one of “sonarr”, “radarr”, “lidarr”

Declared by: - \

homelab.integrations.servarr.\.mode¶

Bootstrap preserves existing matches; managed updates declared fields. Neither deletes resources.

Type: one of “bootstrap”, “managed”

Default:

"bootstrap"

Declared by: - \

homelab.integrations.servarr.\.notifications¶

Names from homelab.integrations.notifications reconciled into this instance.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.integrations.servarr.\.rootFolders¶

Named library roots, matched by their stable absolute paths.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.rootFolders.\.extraSettings¶

Schema-checked root fields, such as Lidarr’s named profile lookups.

Type: JSON value

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.rootFolders.\.path¶

Stable absolute library root registered with the manager.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Declared by: - \

homelab.integrations.servarr.\.settings.downloadHandling¶

Typed completed-download and retry policy.

Type: submodule

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.settings.downloadHandling.enableCompletedDownloadHandling¶

Import completed downloads automatically.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.downloadHandling.autoRedownloadFailed¶

Automatically search again after a failed download.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.downloadHandling.autoRedownloadFailedFromInteractiveSearch¶

Automatically search again after a failed interactive download.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement¶

Typed storage and import policy supported by the pinned managers.

Type: submodule

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.enableMediaInfo¶

Read media information during imports.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.allowFingerprinting¶

Lidarr audio fingerprint policy.

Type: null or one of “allFiles”, “newFiles”, “never”

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.autoRenameFolders¶

Radarr folder rename policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.autoUnmonitorPreviouslyDownloadedEpisodes¶

Sonarr unmonitor policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.autoUnmonitorPreviouslyDownloadedMovies¶

Radarr unmonitor policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.autoUnmonitorPreviouslyDownloadedTracks¶

Lidarr unmonitor policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.chmodFolder¶

Permission mode used when permission management is enabled.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.chownGroup¶

Group used when permission management is enabled.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.copyUsingHardlinks¶

Prefer hardlinks when downloads and libraries share a filesystem.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.createEmptyArtistFolders¶

Lidarr empty-artist-folder policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.createEmptyMovieFolders¶

Radarr empty-movie-folder policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.createEmptySeriesFolders¶

Sonarr empty-series-folder policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.deleteEmptyFolders¶

Remove empty library directories after import.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.downloadPropersAndRepacks¶

Policy for proper and repack releases.

Type: null or one of “preferAndUpgrade”, “doNotUpgrade”, “doNotPrefer”

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.episodeTitleRequired¶

Sonarr episode-title requirement.

Type: null or one of “always”, “bulkSeasonReleases”, “never”

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.extraFileExtensions¶

Comma-separated extra file extensions accepted by Servarr.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.fileDate¶

Upstream file timestamp policy.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.importExtraFiles¶

Import declared non-media file extensions.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.minimumFreeSpaceWhenImporting¶

Minimum free space in MiB before import.

Type: null or (unsigned integer, meaning >=0)

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.pathsDefaultStatic¶

Radarr static-path default.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.recycleBin¶

Directory receiving deleted or upgraded media.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.recycleBinCleanupDays¶

Days to retain items in the recycle directory.

Type: null or (unsigned integer, meaning >=0)

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.rescanAfterRefresh¶

When to rescan files after a metadata refresh.

Type: null or one of “always”, “afterManual”, “never”

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.scriptImportPath¶

Absolute operator-supplied import script path.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.setPermissionsLinux¶

Let the manager chmod imported files.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.skipFreeSpaceCheckWhenImporting¶

Skip the import free-space guard.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.useScriptImport¶

Use an operator-supplied import script.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.mediaManagement.watchLibraryForChanges¶

Lidarr library watcher policy.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming¶

Typed service-specific naming templates.

Type: submodule

Default:

{ }

Declared by: - \

homelab.integrations.servarr.\.settings.naming.animeEpisodeFormat¶

Sonarr anime episode template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.artistFolderFormat¶

Lidarr artist directory template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.colonReplacementFormat¶

Upstream colon replacement style.

Type: null or signed integer

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.customColonReplacementFormat¶

Custom replacement used for colons.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.dailyEpisodeFormat¶

Sonarr daily episode template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.movieFolderFormat¶

Radarr movie directory template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.multiDiscTrackFormat¶

Lidarr multidisc track template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.multiEpisodeStyle¶

Sonarr multi-episode naming style.

Type: null or signed integer

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.renameEpisodes¶

Rename imported Sonarr episodes.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.renameMovies¶

Rename imported Radarr movies.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.renameTracks¶

Rename imported Lidarr tracks.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.replaceIllegalCharacters¶

Replace filesystem-invalid characters.

Type: null or boolean

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.seasonFolderFormat¶

Sonarr season directory template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.seriesFolderFormat¶

Sonarr series directory template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.specialsFolderFormat¶

Sonarr specials directory template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.standardEpisodeFormat¶

Sonarr standard episode template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.standardMovieFormat¶

Radarr movie filename template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.settings.naming.standardTrackFormat¶

Lidarr track filename template.

Type: null or string

Default:

null

Declared by: - \

homelab.integrations.servarr.\.tags¶

Manager tags to create if absent. Undeclared tags are preserved.

Type: list of string matching the pattern [A-Za-z0-9][A-Za-z0-9._ -]*

Default:

[ ]

Declared by: - \

homelab.integrations.servarr.\.url¶

Loopback HTTP or remote HTTPS API base URL.

Type: string

Declared by: - \

homelab.operations.enable¶

Whether to enable an inventory of application state and optional operational integrations.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.operations.access.enable¶

Whether to enable private HTTPS access with native Caddy and Authelia.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.operations.access.allowedInterfaces¶

Host interfaces on which to allow HTTPS; empty keeps remote firewall closed.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.operations.access.backends¶

Browser-compatible protected services. Native app authentication remains enabled; applications with non-browser clients need separate compatibility validation.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.operations.access.backends.\.policy¶

Authentication policy; two-factor enrollment is the default.

Type: one of “one_factor”, “two_factor”

Default:

"two_factor"

Declared by: - \

homelab.operations.access.backends.\.port¶

Loopback-only backend HTTP port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Declared by: - \

homelab.operations.access.backends.\.subjects¶

Authelia subjects, such as group:media; empty permits any authenticated user meeting the policy.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.operations.access.backends.\.unit¶

Existing backend systemd service name without .service; coupled to the ingress guard for fail-closed shutdown.

Type: string matching the pattern [A-Za-z0-9_-]+

Default:

"‹name›"

Declared by: - \

homelab.operations.access.bindAddress¶

Private host IPv4 address for HTTPS. The host owns address assignment and DNS.

Type: string matching the pattern [0-9.]+

Default:

"127.0.0.1"

Declared by: - \

homelab.operations.access.certificateFile¶

User-provided certificate chain with the required DNS names.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.access.domain¶

Host-owned private DNS/cookie domain; certificates must cover portal and backend hostnames.

Type: string matching the pattern [a-z0-9][a-z0-9.-]+

Default:

"homelab.home.arpa"

Declared by: - \

homelab.operations.access.jwtSecretFile¶

nix-seal identity-validation secret.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.access.keyFile¶

User-provided nix-seal TLS private key.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.access.portal¶

Authentication portal subdomain.

Type: string matching the pattern [a-z0-9][a-z0-9-]*

Default:

"auth"

Declared by: - \

homelab.operations.access.sessionSecretFile¶

nix-seal session secret.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.access.storageEncryptionKeyFile¶

nix-seal persistent identity-storage encryption key; retain with recovery material.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.access.usersFile¶

nix-seal Authelia YAML user database with Argon2id password hashes and group membership; updates require service restart.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.arrPostgresql.migratedServices¶

Services whose existing SQLite state has been migrated and validated by the operator. This removes the startup guard; it never migrates or deletes data.

Type: list of (one of “sonarr”, “radarr”, “lidarr”, “prowlarr”)

Default:

[ ]

Declared by: - \

homelab.operations.arrPostgresql.services¶

Explicitly selected Arr services using local PostgreSQL over peer-authenticated Unix sockets. Empty keeps native SQLite defaults.

Type: list of (one of “sonarr”, “radarr”, “lidarr”, “prowlarr”)

Default:

[ ]

Declared by: - \

homelab.operations.backup.job¶

Existing root-owned native Restic job to extend; host supplies repository, password, schedule and retention.

Type: null or string matching the pattern [A-Za-z0-9_-]+

Default:

null

Declared by: - \

homelab.operations.backup.stagingDir¶

Private staging on a filesystem with room for application state. Writers stop only during this local copy.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"/var/lib/homelab-recovery"

Declared by: - \

homelab.operations.dashboard.enable¶

Whether to enable a private Homepage view of inventory endpoints.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.operations.endpoints¶

Host-visible health and dashboard endpoints. Keep credentials in Gatus environment files, never URLs.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.operations.endpoints.\.enable¶

Include this endpoint in generated operations views.

Type: boolean

Default:

true

Declared by: - \

homelab.operations.endpoints.\.conditions¶

Gatus health conditions; select an application health API where available.

Type: list of string

Default:

[
  "[STATUS] == 200"
]

Declared by: - \

homelab.operations.endpoints.\.description¶

Dashboard description.

Type: string

Default:

"‹name›"

Declared by: - \

homelab.operations.endpoints.\.healthUrl¶

Health probe URL, separate from the browser dashboard link.

Type: string matching the pattern https?://[A-Za-z0-9:._/-]+

Default:

config.url

Declared by: - \

homelab.operations.endpoints.\.monitor¶

Create a Gatus probe as well as a dashboard link. Disable when authentication or API semantics require a host-owned check.

Type: boolean

Default:

true

Declared by: - \

homelab.operations.endpoints.\.url¶

Credential-free URL reachable from the host.

Type: string matching the pattern https?://[A-Za-z0-9:._/-]+

Declared by: - \

homelab.operations.monitoring.enable¶

Whether to enable Gatus checks generated from the endpoint inventory.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.operations.monitoring.alerts¶

Native Gatus alert types for generated endpoints; configure their providers under services.gatus.settings.alerting.

Type: list of string

Default:

[ ]

Declared by: - \

homelab.operations.monitoring.health.enable¶

Publish private backup, storage and job health when monitoring is enabled.

Type: boolean

Default:

true

Declared by: - \

homelab.operations.monitoring.health.backupMaxAgeSeconds¶

Maximum age of a fully successful Restic unit before health fails.

Type: positive integer, meaning >0

Default:

129600

Declared by: - \

homelab.operations.monitoring.health.port¶

Loopback-only operational health port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

9086

Declared by: - \

homelab.operations.monitoring.health.pressureMaxAgeSeconds¶

Maximum pressure-marker age; increase when overriding the native pressure timer interval.

Type: positive integer, meaning >0

Default:

180

Declared by: - \

homelab.operations.monitoring.health.vpnDnsProbeHost¶

Public hostname resolved inside the VPN namespace by homelab-doctor.

Type: string matching the pattern [A-Za-z0-9.-]+

Default:

"example.com"

Declared by: - \

homelab.operations.monitoring.health.vpnMaxHandshakeAgeSeconds¶

Maximum age of the newest WireGuard peer handshake accepted by homelab-doctor.

Type: positive integer, meaning >0

Default:

180

Declared by: - \

homelab.operations.notifications.enable¶

Whether to enable private deny-by-default ntfy notifications.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.operations.notifications.environmentFile¶

nix-seal EnvironmentFile containing NTFY_AUTH_USERS and NTFY_AUTH_ACCESS declarations and optional tokens.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.paperlessDatabase¶

Declare PostgreSQL explicitly when Paperless selects its database through a private environment file; native public DBHOST is detected.

Type: one of “sqlite”, “postgresql”

Default:

"sqlite"

Declared by: - \

homelab.operations.postgresql¶

Explicit logical database exports included in the stopped-writer recovery copy. Local exports use PostgreSQL peer authentication; remote exports require a runtime pgpass file.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.operations.postgresql.\.caFile¶

Trusted CA bundle for remote PostgreSQL verify-full TLS. Override with the host’s private CA when needed.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"/nix/store/biiabd2fcxdxmy0f99r7i88nziqdqsy6-nss-cacert-3.126/etc/ssl/certs/ca-bundle.crt"

Declared by: - \

homelab.operations.postgresql.\.database¶

Existing database to export.

Type: string matching the pattern [A-Za-z0-9_-]+

Default:

"‹name›"

Declared by: - \

homelab.operations.postgresql.\.host¶

Socket directory or trusted PostgreSQL hostname.

Type: string matching the pattern [A-Za-z0-9_./:-]+

Default:

"/run/postgresql"

Declared by: - \

homelab.operations.postgresql.\.local¶

Use the local postgres operating-system account and peer authentication.

Type: boolean

Default:

true

Declared by: - \

homelab.operations.postgresql.\.passwordFile¶

nix-seal pgpass file for a remote database, loaded through systemd credentials during backup.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.operations.postgresql.\.port¶

PostgreSQL port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

5432

Declared by: - \

homelab.operations.postgresql.\.user¶

Export/restore database login.

Type: string matching the pattern [A-Za-z0-9_-]+

Default:

"postgres"

Declared by: - \

homelab.operations.pressure.enable¶

Whether to enable download pausing with filesystem headroom and hysteresis.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.operations.pressure.clients¶

qBittorrent v5 and/or SABnzbd APIs. qBittorrent credentials are a JSON username/password object; SABnzbd uses a raw API key file.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.operations.pressure.clients.\.credentialsFile¶

User-provided nix-seal runtime file, loaded with systemd credentials.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Declared by: - \

homelab.operations.pressure.clients.\.url¶

Trusted private API origin, including an optional base path.

Type: string matching the pattern https?://[A-Za-z0-9:._/-]+

Declared by: - \

homelab.operations.pressure.path¶

Existing directory on the filesystem whose available space is measured.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"/srv/media/downloads"

Declared by: - \

homelab.operations.pressure.pauseBytes¶

Pause below these available bytes; tune for unpacking and backup headroom.

Type: positive integer, meaning >0

Default:

42949672960

Declared by: - \

homelab.operations.pressure.requiredMounts¶

Mountpoints that must exist; absence forces the pause policy.

Type: list of string matching the pattern /[A-Za-z0-9_./-]+

Default:

[ ]

Declared by: - \

homelab.operations.pressure.resumeBytes¶

Resume owned pauses only above this free-space threshold.

Type: positive integer, meaning >0

Default:

64424509440

Declared by: - \

homelab.operations.state¶

State directories and every writer to stop for a consistent copy. Override entries when external databases or queue paths are used. Media and secret catalogs are separate host backup decisions.

Type: attribute set of (submodule)

Default:

{ }

Declared by: - \

homelab.operations.state.\.paths¶

Persistent directories; DynamicUser symlinks are resolved during staging.

Type: list of string matching the pattern /[A-Za-z0-9_./-]+

Default:

[ ]

Declared by: - \

homelab.operations.state.\.prepareCommand¶

Host export command run after all writers stop and before state copies. A failure aborts staging and restarts writers. Read secrets from runtime files.

Type: null or strings concatenated with “\n”

Default:

null

Declared by: - \

homelab.operations.state.\.units¶

All systemd writers and timer triggers for these directories.

Type: list of string matching the pattern [A-Za-z0-9_@.:-]+\.(service|timer)

Default:

[ ]

Declared by: - \

homelab.optional.apps.adguardhome.enable¶

Whether to enable adguardhome with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.autobrr.enable¶

Whether to enable autobrr with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.cross-seed.enable¶

Whether to enable cross-seed with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.flaresolverr.enable¶

Whether to enable flaresolverr with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.immich.enable¶

Whether to enable immich with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.karakeep.enable¶

Whether to enable karakeep with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.kavita.enable¶

Whether to enable kavita with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.komga.enable¶

Whether to enable komga with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.maintainerr.enable¶

Whether to enable maintainerr with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.paperless.enable¶

Whether to enable paperless with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.pinchflat.enable¶

Whether to enable pinchflat with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.scrutiny.enable¶

Whether to enable scrutiny with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.shelfmark.enable¶

Whether to enable shelfmark with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.syncthing.enable¶

Whether to enable syncthing with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.apps.unpackerr.enable¶

Whether to enable unpackerr with private homelab defaults.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.karakeep.package¶

The karakeep package to use.

Type: package

Default:

pkgs.karakeep

Declared by: - \

homelab.optional.karakeep.browserPort¶

Loopback Chrome DevTools port used by Karakeep workers.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

9222

Declared by: - \

homelab.optional.karakeep.browserUid¶

Dedicated headless-browser UID, used numerically by the browser firewall rule.

Type: positive integer, meaning >0

Default:

62463

Declared by: - \

homelab.optional.karakeep.environmentFile¶

Optional runtime environment file for provider credentials. Karakeep and Meilisearch authentication variables are module-owned.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.optional.karakeep.extraEnvironment¶

Non-secret Karakeep environment variables that do not change module-owned topology or authentication.

Type: attribute set of string

Default:

{ }

Declared by: - \

homelab.optional.karakeep.port¶

Loopback port for the Karakeep web interface.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

5337

Declared by: - \

homelab.optional.karakeep.uid¶

Dedicated Karakeep service UID, used numerically by the browser firewall rule.

Type: positive integer, meaning >0

Default:

62462

Declared by: - \

homelab.optional.maintainerr.package¶

The maintainerr package to use.

Type: package

Default:

pkgs.maintainerr

Declared by: - \

homelab.optional.maintainerr.backendPort¶

Loopback service port, restricted to nginx, root and the Maintainerr account by nftables.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

6247

Declared by: - \

homelab.optional.maintainerr.htpasswdFile¶

User-provided nix-seal htpasswd file for HTTP Basic authentication. Use TLS when exposing the proxy beyond loopback.

Type: null or string matching the pattern /[A-Za-z0-9_./-]+

Default:

null

Declared by: - \

homelab.optional.maintainerr.port¶

Authenticated loopback proxy port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

6246

Declared by: - \

homelab.optional.maintainerr.uid¶

Dedicated service UID; choose an unused host UID. Used numerically in the firewall ruleset.

Type: positive integer, meaning >0

Default:

62460

Declared by: - \

homelab.optional.quality.enable¶

Whether to enable a conservative, locally declared Recyclarr 1080p profile.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.optional.quality.radarrApiKeyFile¶

User-provided runtime Radarr API key. Null leaves Radarr unmanaged.

Type: null or string matching the pattern /[^ ]+

Default:

null

Declared by: - \

homelab.optional.quality.sonarrApiKeyFile¶

User-provided runtime Sonarr API key. Null leaves Sonarr unmanaged.

Type: null or string matching the pattern /[^ ]+

Default:

null

Declared by: - \

homelab.profiles.desktop.enable¶

Whether to enable lower media background CPU and I/O priority on a shared desktop.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.profiles.media.enable¶

Whether to enable Jellyfin, Seerr, Sonarr, Radarr, Bazarr, Prowlarr and confined qBittorrent.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.readiness.enable¶

Whether to enable strict checks that reject enabled applications without their production credentials, configuration ownership, recovery, and monitoring contracts .

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.readiness.checks.*.assertion¶

Whether this production-readiness condition is satisfied.

Type: boolean

Declared by: - \

homelab.readiness.checks.*.message¶

Actionable failure message for an unsatisfied readiness condition.

Type: string

Declared by: - \

homelab.readiness.hostManaged¶

Applications whose account, provider, hardware, client, or destructive policy was configured and tested by the consuming host. Listing a name records responsibility; it does not make the setup safe by itself.

Type: list of (one of “adguardhome”, “audiobookshelf”, “autobrr”, “bazarr”, “cross-seed”, “flaresolverr”, “immich”, “jellyfin”, “karakeep”, “kavita”, “komga”, “lidarr”, “maintainerr”, “navidrome”, “nzbget”, “paperless”, “pinchflat”, “plex”, “prowlarr”, “qbittorrent”, “radarr”, “sabnzbd”, “scrutiny”, “seerr”, “shelfmark”, “sonarr”, “syncthing”, “unpackerr”)

Default:

[ ]

Declared by: - \

homelab.storage.enable¶

Whether to enable shared media storage.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.storage.downloadsDir¶

Downloads root, on the same filesystem as the library for hardlinks.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"${config.homelab.storage.rootDir}/downloads"

Declared by: - \

homelab.storage.group¶

Supplementary group shared by media services; state keeps each service’s own group.

Type: string matching the pattern [a-z_][a-z0-9_-]*

Default:

"media"

Declared by: - \

homelab.storage.libraryDir¶

Library root. Avoid separate mounts for downloads and libraries.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"${config.homelab.storage.rootDir}/library"

Declared by: - \

homelab.storage.requiredMounts¶

Actual media mount points. Start fails when absent, preventing fallback writes onto the root disk.

Type: list of string matching the pattern /[A-Za-z0-9_./-]+

Default:

[ ]

Example:

[
  "/mnt/homelab"
]

Declared by: - \

homelab.storage.rootDir¶

Media root on one filesystem. State databases remain on the system disk.

Type: string matching the pattern /[A-Za-z0-9_./-]+

Default:

"/srv/media"

Declared by: - \

homelab.vpn.enable¶

Whether to enable WireGuard confinement for selected homelab services.

Type: boolean

Default:

false

Example:

true

Declared by: - \

homelab.vpn.inboundPorts.tcp¶

TCP ports accepted from the tunnel. The VPN provider must forward these ports separately.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

[ ]

Declared by: - \

homelab.vpn.inboundPorts.udp¶

UDP ports accepted from the tunnel. The VPN provider must forward these ports separately.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

[ ]

Declared by: - \

homelab.vpn.interface.addressIPv4¶

Provider-assigned tunnel IPv4 address, without a prefix length.

Type: null or string

Default:

null

Example:

"10.64.0.2"

Declared by: - \

homelab.vpn.interface.addressIPv6¶

Provider-assigned tunnel IPv6 address, without a prefix length. Null disables namespace IPv6.

Type: null or string

Default:

null

Example:

"fd00::2"

Declared by: - \

homelab.vpn.interface.dns¶

Literal resolver IPs reachable through the tunnel. DNS containment uses strict mode.

Type: list of string

Default:

[ ]

Example:

[
  "10.64.0.1"
]

Declared by: - \

homelab.vpn.interface.mtu¶

WireGuard MTU. Change only to match the provider or measured path MTU.

Type: integer between 1280 and 65535 (both inclusive)

Default:

1420

Declared by: - \

homelab.vpn.interface.name¶

WireGuard interface name. Must be unique on the host.

Type: string

Default:

"wg0"

Declared by: - \

homelab.vpn.interface.privateKeyFile¶

Absolute string path to a root-readable private key outside the Nix store.

Type: null or string

Default:

null

Example:

"/run/secrets/wireguard-private-key"

Declared by: - \

homelab.vpn.namespace.bindAddress¶

Service address on the namespace side of the host link. Derived by vpn-confinement when enabled; loopback when disabled. This link permits host access to declared TCP ports without opening the host firewall.

Type: string (read only)

Default:

"127.0.0.1"

Declared by: - \

homelab.vpn.namespace.hostIngressPorts.tcp¶

TCP ports published to the host. Enabled homelab services add their Web UI ports.

Type: list of 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

[ ]

Declared by: - \

homelab.vpn.namespace.name¶

Name of the namespace managed by nix-forge/vpn-confinement.

Type: string

Default:

"vpnapps"

Declared by: - \

homelab.vpn.peer.endpointHost¶

Literal public IPv4 or IPv6 peer address. Hostnames are rejected to avoid host-side DNS.

Type: null or string

Default:

null

Declared by: - \

homelab.vpn.peer.endpointPort¶

VPN peer’s WireGuard UDP port.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

51820

Declared by: - \

homelab.vpn.peer.persistentKeepalive¶

WireGuard keepalive interval in seconds. Zero disables keepalives.

Type: integer between 0 and 65535 (both inclusive)

Default:

25

Declared by: - \

homelab.vpn.peer.presharedKeyFile¶

Optional absolute string path to a preshared key outside the Nix store.

Type: null or string

Default:

null

Declared by: - \

homelab.vpn.peer.publicKey¶

VPN peer’s WireGuard public key.

Type: null or string

Default:

null

Declared by: - \