Services

`systemd.services.<name>.after`

If the specified units are started at the same time as this unit, delay this unit until they have started.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.aliases`

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.before`

If the specified units are started at the same time as this unit, delay them until this unit has started.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.bindsTo`

Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.confinement.binSh`

The program to make available as {file}/bin/sh inside the chroot. If this is set to null, no {file}/bin/sh is provided at all.

This is useful for some applications, which for example use the {manpage}system(3) library function to execute commands.

Type: null or path

Default

config.environment.binsh

Example

"${pkgs.dash}/bin/dash"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/security/systemd-confinement.nix

`systemd.services.<name>.confinement.enable`

If set, all the required runtime store paths for this service are bind-mounted into a tmpfs-based {manpage}chroot(2).

Type: boolean

Default

false

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/security/systemd-confinement.nix

`systemd.services.<name>.confinement.fullUnit`

Whether to include the full closure of the systemd unit file into the chroot, instead of just the dependencies for the executables.

::: {.warning} While it may be tempting to just enable this option to make things work quickly, please be aware that this might add paths to the closure of the chroot that you didn't anticipate. It's better to use {option}confinement.packages to explicitly add additional store paths to the chroot. :::

Type: boolean

Default

false

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/security/systemd-confinement.nix

`systemd.services.<name>.confinement.mode`

The value full-apivfs (the default) sets up private {file}/dev, {file}/proc, {file}/sys, {file}/tmp and {file}/var/tmp file systems in a separate user name space.

If this is set to chroot-only, only the file system name space is set up along with the call to {manpage}chroot(2).

In all cases, unless serviceConfig.PrivateTmp=true is set, both {file}/tmp and {file}/var/tmp paths are added to InaccessiblePaths=. This is to overcome options like DynamicUser=true implying PrivateTmp=true without letting it being turned off. Beware however that giving processes the CAP_SYS_ADMIN and @mount privileges can let them undo the effects of InaccessiblePaths=.

::: {.note} This doesn't cover network namespaces and is solely for file system level isolation. :::

Type: one of "full-apivfs", "chroot-only"

Default

"full-apivfs"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/security/systemd-confinement.nix

`systemd.services.<name>.confinement.packages`

Additional packages or strings with context to add to the closure of the chroot. By default, this includes all the packages from the {option}serviceConfig.ExecReload, {option}serviceConfig.ExecStartPost, {option}serviceConfig.ExecStartPre, {option}serviceConfig.ExecStop, {option}serviceConfig.ExecStopPost and {option}serviceConfig.ExecStart options. If you want to have all the dependencies of this systemd unit, you can use {option}confinement.fullUnit.

::: {.note} The store paths listed in {option}path are not included in the closure as well as paths from other options except those listed above. :::

Type: list of (string or package)

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/security/systemd-confinement.nix

`systemd.services.<name>.conflicts`

If the specified units are started, then this unit is stopped and vice versa.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.description`

Description of this unit used in systemd messages and progress indicators. Type: (optionally newline-terminated) single-line string

Default

""

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.documentation`

A list of URIs referencing documentation for this unit or its configuration. Type: list of string

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.enable`

If set to false, this unit will be a symlink to /dev/null. This is primarily useful to prevent specific template instances (e.g. serial-getty@ttyS0) from being started. Note that enable=true does not make a unit start by default at boot; if you want that, see wantedBy.

Type: boolean

Default

true

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.environment`

Environment variables passed to the service's processes. Type: attribute set of (null or string or path or package)

Default

{ }

Example

{LANG = "nl_NL.UTF-8";PATH = "/foo/bar/bin";}

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.name`

The name of this systemd unit, including its extension. This can be used to refer to this unit from other systemd units.

Type: string

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.onFailure`

A list of one or more units that are activated when this unit enters the "failed" state.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.onSuccess`

A list of one or more units that are activated when this unit enters the "inactive" state.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.overrideStrategy`

Defines how unit configuration is provided for systemd:

asDropinIfExists creates a unit file when no unit file is provided by the package otherwise a drop-in file name overrides.conf.

asDropin creates a drop-in file named overrides.conf. Mainly needed to define instances for systemd template units (e.g. systemd-nspawn@mycontainer.service).

Default

"asDropinIfExists"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.partOf`

If the specified units are stopped or restarted, then this unit is stopped or restarted as well.

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix

`systemd.services.<name>.path`

Packages added to the service's {env}PATH environment variable. Both the {file}bin and {file}sbin subdirectories of each package are added.

Type: list of (package or string)

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/system/boot/systemd.nix