ghaf.boot.loader.systemd-boot-dtb.enable

Whether to enable systemd-boot-dtb.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.development.debug.tools.enable

Whether to enable Debug Tools.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.development.nix-setup.enable

Whether to enable Target Nix config options.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.development.nix-setup.nixpkgs

Path to the nixpkgs repository

Type: null or path

Default: null

Declared by:

ghaf.development.ssh.daemon.enable

Whether to enable ssh daemon.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.development.usb-serial.enable

Whether to enable Usb-Serial.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.firewall.kernel-modules.enable

Whether to enable kernel modules required for firewall.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.givc.enable

Whether to enable Enable gRPC inter-vm communication.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.givc.enableTls

Enable TLS for gRPC communication globally, or disable for debugging.

Type: boolean

Default: false

Declared by:

ghaf.givc.adminConfig

Admin server configuration.

Type: submodule

Declared by:

ghaf.givc.adminConfig.addr

Address of admin server

Type: string

Declared by:

ghaf.givc.adminConfig.name

Host name of admin server

Type: string

Declared by:

ghaf.givc.adminConfig.port

Port of admin server

Type: string

Declared by:

ghaf.givc.adminConfig.protocol

Protocol of admin server

Type: string

Declared by:

ghaf.givc.appPrefix

Common application path prefix.

Type: string

Default: "/run/current-system/sw/bin"

Declared by:

ghaf.givc.host.enable

Whether to enable Enable host givc module…

Type: boolean

Default: false

Example: true

Declared by:

ghaf.givc.idsExtraArgs

Extra arguments for applications when IDS/MITM is enabled.

Type: string

Default: ""

Declared by:

ghaf.graphics.enableDemoApplications

Whether to enable some applications for demoing.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.graphics.boot.enable

Enables graphical boot with plymouth.

Type: boolean

Default: false

Declared by:

ghaf.graphics.demo-apps.chromium

Include package Chromium browser to menu and system environment

Type: boolean

Default: false

Declared by:

ghaf.graphics.demo-apps.element-desktop

Include package Element desktop to menu and system environment

Type: boolean

Default: false

Declared by:

ghaf.graphics.demo-apps.firefox

Include package Firefox browser to menu and system environment

Type: boolean

Default: false

Declared by:

ghaf.graphics.demo-apps.gala-app

Include package Gala App to menu and system environment

Type: boolean

Default: false

Declared by:

ghaf.graphics.demo-apps.google-chrome

Include package Google Chrome browser to menu and system environment

Type: boolean

Default: false

Declared by:

ghaf.graphics.demo-apps.zathura

Include package zathura to menu and system environment

Type: boolean

Default: false

Declared by:

ghaf.graphics.labwc.enable

Whether to enable labwc.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.graphics.labwc.autolock.enable

Whether to enable screen autolocking.

Type: boolean

Default: true

Declared by:

ghaf.graphics.labwc.autolock.duration

Timeout for screen autolock in seconds.

Type: signed integer

Default: 300

Declared by:

ghaf.graphics.labwc.autologinUser

Username of the account that will be automatically logged in to the desktop. If unspecified, the login manager is shown as usual.

Type: null or string

Default: "ghaf"

Declared by:

ghaf.graphics.labwc.extraAutostart

These lines go to the end of labwc autoconfig

Type: string

Default: ""

Declared by:

ghaf.graphics.labwc.frameColouring

List of applications and their frame colours

Type: list of (submodule)

Default:

[
  {
    colour = "#006305";
    identifier = "foot";
  }
]

Declared by:

ghaf.graphics.labwc.frameColouring.*.colour

Colour of the window frame

Type: string

Example: "#006305"

Declared by:

ghaf.graphics.labwc.frameColouring.*.identifier

Identifier of the application

Type: string

Example: "foot"

Declared by:

ghaf.graphics.labwc.gtk

Global gtk+ configuration

Type: submodule

Default:

{
  colorScheme = "prefer-dark";
  fontName = "Cantarell";
  fontSize = "11";
  iconTheme = "Papirus";
  theme = "Adwaita";
}

Declared by:

ghaf.graphics.labwc.gtk.colorScheme

The preferred color scheme for gtk+. Valid values are ‘default’, ‘prefer-dark’, ‘prefer-light’.

Type: one of “default”, “prefer-dark”, “prefer-light”

Example: "prefer-dark"

Declared by:

ghaf.graphics.labwc.gtk.fontName

The preferred font family.

Type: string

Example: "Cantarell"

Declared by:

ghaf.graphics.labwc.gtk.fontSize

The preferred default font size.

Type: null or string

Example: "11"

Declared by:

ghaf.graphics.labwc.gtk.iconTheme

Name of the default icon theme used by gtk+.

Type: string

Example: "Papirus"

Declared by:

ghaf.graphics.labwc.gtk.theme

Basename of the default theme used by gtk+.

Type: string

Example: "Adwaita"

Declared by:

ghaf.graphics.labwc.securityContext

Wayland security context settings

Type: list of (submodule)

Default: [ ]

Declared by:

ghaf.graphics.labwc.securityContext.*.color

Window frame color

Type: string

Example: "#006305"

Declared by:

ghaf.graphics.labwc.securityContext.*.identifier

The identifier attached to the security context

Type: string

Declared by:

ghaf.graphics.labwc.wallpaper

Path to the wallpaper image

Type: path

Default: "/nix/store/53w4s59h4zybwi4bgil48hf3r13kzksy-ghaf-artwork-0.1.0/ghaf-desert-sunset.jpg"

Declared by:

ghaf.graphics.launchers

Application launchers to show in the system drawer or launcher.

Type: list of (submodule)

Default: [ ]

Declared by:

ghaf.graphics.launchers.*.description

Description of the application

Type: string

Default: "Secured Ghaf Application"

Declared by:

ghaf.graphics.launchers.*.icon

Optional icon for the launcher. If unspecified, active icon theme will be searched to find an icon matching the launcher name. Can be set to an icon name from the current theme (Papirus) or a full path to an icon file.

Type: null or string

Default: null

Declared by:

ghaf.graphics.launchers.*.name

Name of the application

Type: string

Declared by:

ghaf.graphics.launchers.*.path

Path to the executable to be launched

Type: path

Declared by:

ghaf.graphics.launchers.*.vm

VM name in case this launches an isolated application.

Type: null or string

Default: null

Declared by:

ghaf.graphics.login-manager.enable

Whether to enable login manager using greetd.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.guest.kernel.hardening.enable

Enable Ghaf Guest hardening feature

Type: boolean

Default: false

Declared by:

ghaf.guest.kernel.hardening.graphics.enable

Enable support for Graphics in the Ghaf Guest

Type: boolean

Default: false

Declared by:

ghaf.hardware.definition.audio.kernelConfig

Hardware specific kernel configuration for audio devices

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.audio.kernelConfig.kernelParams

Hardware specific kernel parameters

Type: list of string

Default: [ ]

Example:

[
  "intel_iommu=on,sm_on"
  "iommu=pt"
  "module_blacklist=i915"
  "acpi_backlight=vendor"
  "acpi_osi=linux"
]

Declared by:

ghaf.hardware.definition.audio.kernelConfig.stage1.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.audio.kernelConfig.stage2.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.audio.pciDevices

PCI Devices to passthrough to AudioVM

Type: list of (submodule)

Default: [ ]

Example:

[
  {
    path = "0000:00:1f.0";
    vendorId = "8086";
    productId = "519d";
  }
  {
    path = "0000:00:1f.3";
    vendorId = "8086";
    productId = "51ca";
  }
  {
    path = "0000:00:1f.4";
    vendorId = "8086";
    productId = "51a3";
  }
  {
    path = "0000:00:1f.5";
    vendorId = "8086";
    productId = "51a4";
  }
]

Declared by:

ghaf.hardware.definition.audio.pciDevices.*.name

PCI device name (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.audio.pciDevices.*.path

PCI device path

Type: string

Declared by:

ghaf.hardware.definition.audio.pciDevices.*.productId

PCI Product ID (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.audio.pciDevices.*.vendorId

PCI Vendor ID (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.disks

Disks to format and mount

Type: attribute set of (submodule)

Default: { }

Example:

{
  disk1.device = "/dev/nvme0n1";
}

Declared by:

ghaf.hardware.definition.disks.<name>.device

Path to the disk

Type: string

Declared by:

ghaf.hardware.definition.gpu.kernelConfig

Hardware specific kernel configuration for gpu devices

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.gpu.kernelConfig.kernelParams

Hardware specific kernel parameters

Type: list of string

Default: [ ]

Example:

[
  "intel_iommu=on,sm_on"
  "iommu=pt"
  "module_blacklist=i915"
  "acpi_backlight=vendor"
  "acpi_osi=linux"
]

Declared by:

ghaf.hardware.definition.gpu.kernelConfig.stage1.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.gpu.kernelConfig.stage2.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.gpu.pciDevices

PCI Devices to passthrough to GuiVM

Type: list of (submodule)

Default: [ ]

Example:

[{
  path = "0000:00:02.0";
  vendorId = "8086";
  productId = "a7a1";
}]

Declared by:

ghaf.hardware.definition.gpu.pciDevices.*.name

PCI device name (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.gpu.pciDevices.*.path

PCI device path

Type: string

Declared by:

ghaf.hardware.definition.gpu.pciDevices.*.productId

PCI Product ID (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.gpu.pciDevices.*.vendorId

PCI Vendor ID (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.host.kernelConfig

Host kernel configuration

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.host.kernelConfig.kernelParams

Hardware specific kernel parameters

Type: list of string

Default: [ ]

Example:

[
  "intel_iommu=on,sm_on"
  "iommu=pt"
  "module_blacklist=i915"
  "acpi_backlight=vendor"
  "acpi_osi=linux"
]

Declared by:

ghaf.hardware.definition.host.kernelConfig.stage1.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.host.kernelConfig.stage2.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.input.keyboard

Name of the keyboard device(s)

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.input.keyboard.evdev

List of event devices.

Type: list of string

Default: [ ]

Declared by:

ghaf.hardware.definition.input.keyboard.name

List of input device names. Can either be a string, or a list of strings. The list option allows to bind several input device names to the same evdev. This allows to create one generic hardware definition for multiple SKUs.

Type: list of raw value

Default: [ ]

Declared by:

ghaf.hardware.definition.input.misc

Name of the misc device(s)

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.input.misc.evdev

List of event devices.

Type: list of string

Default: [ ]

Declared by:

ghaf.hardware.definition.input.misc.name

List of input device names. Can either be a string, or a list of strings. The list option allows to bind several input device names to the same evdev. This allows to create one generic hardware definition for multiple SKUs.

Type: list of raw value

Default: [ ]

Declared by:

ghaf.hardware.definition.input.mouse

Name of the mouse device(s)

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.input.mouse.evdev

List of event devices.

Type: list of string

Default: [ ]

Declared by:

ghaf.hardware.definition.input.mouse.name

List of input device names. Can either be a string, or a list of strings. The list option allows to bind several input device names to the same evdev. This allows to create one generic hardware definition for multiple SKUs.

Type: list of raw value

Default: [ ]

Declared by:

ghaf.hardware.definition.input.touchpad

Name of the touchpad device(s)

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.input.touchpad.evdev

List of event devices.

Type: list of string

Default: [ ]

Declared by:

ghaf.hardware.definition.input.touchpad.name

List of input device names. Can either be a string, or a list of strings. The list option allows to bind several input device names to the same evdev. This allows to create one generic hardware definition for multiple SKUs.

Type: list of raw value

Default: [ ]

Declared by:

ghaf.hardware.definition.name

Name of the hardware

Type: string

Default: ""

Declared by:

ghaf.hardware.definition.network.kernelConfig

Hardware specific kernel configuration for network devices

Type: submodule

Default: { }

Declared by:

ghaf.hardware.definition.network.kernelConfig.kernelParams

Hardware specific kernel parameters

Type: list of string

Default: [ ]

Example:

[
  "intel_iommu=on,sm_on"
  "iommu=pt"
  "module_blacklist=i915"
  "acpi_backlight=vendor"
  "acpi_osi=linux"
]

Declared by:

ghaf.hardware.definition.network.kernelConfig.stage1.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.network.kernelConfig.stage2.kernelModules

Hardware specific kernel modules

Type: list of string

Default: [ ]

Example:

[
  "i915"
]

Declared by:

ghaf.hardware.definition.network.pciDevices

PCI Devices to passthrough to NetVM

Type: list of (submodule)

Default: [ ]

Example:

[{
  path = "0000:00:14.3";
  vendorId = "8086";
  productId = "51f1";
}]

Declared by:

ghaf.hardware.definition.network.pciDevices.*.name

PCI device name (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.network.pciDevices.*.path

PCI device path

Type: string

Declared by:

ghaf.hardware.definition.network.pciDevices.*.productId

PCI Product ID (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.network.pciDevices.*.vendorId

PCI Vendor ID (optional)

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.skus

List of hardware SKUs (Stock Keeping Unit) covered with this definition

Type: list of string

Default: [ ]

Declared by:

ghaf.hardware.definition.usb.external

External USB device(s) to passthrough. Requires name, vendorId, and productId.

Type: list of (submodule)

Default: [ ]

Example:

[
  {
    name = "external-device-1";
    vendorId = "0123";
    productId = "0123";
  }
  {
    name = "external-device-2";
    vendorId = "0123";
    productId = "0123";
  }
]

Declared by:

ghaf.hardware.definition.usb.external.*.hostbus

USB device bus number (optional). If this is set, the hostport must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.external.*.hostport

USB device device number (optional). If this is set, the hostbus must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.external.*.name

USB device name. NOT optional for external devices, in which case it must not contain spaces or extravagant characters.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.external.*.productId

USB Product ID (optional). If this is set, the vendorId must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.external.*.vendorId

USB Vendor ID (optional). If this is set, the productId must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.internal

Internal USB device(s) to passthrough.

Each device definition requires a name, and either vendorId and productId, or hostbus and hostport. The latter is useful for addressing devices that may have different vendor and product IDs in the same hardware generation.

Note that internal devices must follow the naming convention to be correctly identified and subsequently used. Current special names are:

  • ‘cam0’ for the internal cam0 device
  • ‘fpr0’ for the internal fingerprint reader device

Type: list of (submodule)

Default: [ ]

Example:

[
  {
    name = "cam0";
    vendorId = "0123";
    productId = "0123";
  }
  {
    name = "fpr0";
    hostbus = "3";
    hostport = "3";
  }
]

Declared by:

ghaf.hardware.definition.usb.internal.*.hostbus

USB device bus number (optional). If this is set, the hostport must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.internal.*.hostport

USB device device number (optional). If this is set, the hostbus must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.internal.*.name

USB device name. NOT optional for external devices, in which case it must not contain spaces or extravagant characters.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.internal.*.productId

USB Product ID (optional). If this is set, the vendorId must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.definition.usb.internal.*.vendorId

USB Vendor ID (optional). If this is set, the productId must also be set.

Type: null or string

Default: null

Declared by:

ghaf.hardware.devices.audiovmPCIPassthroughModule

PCI devices to passthrough to the audiovm.

Type: attribute set of anything

Default: { }

Declared by:

ghaf.hardware.devices.guivmPCIPassthroughModule

PCI devices to passthrough to the guivm.

Type: attribute set of anything

Default: { }

Declared by:

ghaf.hardware.devices.guivmVirtioInputHostEvdevModule

Virtio evdev paths’ to passthrough to the guivm.

Type: attribute set of anything

Default: { }

Declared by:

ghaf.hardware.devices.netvmPCIPassthroughModule

PCI devices to passthrough to the netvm.

Type: attribute set of anything

Default: { }

Declared by:

ghaf.hardware.tpm2.enable

Whether to enable TPM2 PKCS#11 interface.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.hardware.usb.external.enable

Whether to enable Enable external USB device(s) passthrough support.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.hardware.usb.external.qemuExtraArgs

Extra arguments to pass to qemu when enabling the external USB device(s). Since there can be several devices that may need to be passed to different machines, the device names are used as keys to access the qemu arguments.

Type: attribute set of anything

Default: { }

Example:

{
  "device1" = ["-device" "qemu-xhci" "-device" "usb-host,vendorid=0x1234,productid=0x1234"];
  "device2" = ["-device" "qemu-xhci" "-device" "usb-host,vendorid=0x0001,productid=0x0001"];
}

Declared by:

ghaf.hardware.usb.internal.enable

Whether to enable Enable internal USB device(s) passthrough support.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.hardware.usb.internal.qemuExtraArgs

Extra arguments to pass to qemu when enabling the internal USB device(s). Since there could be several devices that may need to be passed to different machines, the device names are used as keys to access the qemu arguments. Note that some devices require special names to be used correctly.

Type: attribute set of anything

Default: { }

Example:

{
  "device1" = ["-device" "qemu-xhci" "-device" "usb-host,vendorid=0x1234,productid=0x1234"];
  "device2" = ["-device" "qemu-xhci" "-device" "usb-host,vendorid=0x0001,productid=0x0001"];
}

Declared by:

ghaf.hardware.usb.vhotplug.enable

Whether to enable Enable hot plugging of USB devices.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.hardware.usb.vhotplug.enableEvdevPassthrough

Enable passthrough of non-USB input devices on startup using QEMU virtio-input-host-pci device.

Type: boolean

Default: true

Declared by:

ghaf.hardware.usb.vhotplug.pcieBusPrefix

PCIe bus prefix used for the pcie-root-port QEMU device when evdev passthrough is enabled.

Type: null or string

Default: "rp"

Declared by:

ghaf.hardware.usb.vhotplug.pciePortCount

The number of PCIe ports used for hot-plugging virtio-input-host-pci devices.

Type: signed integer

Default: 5

Declared by:

ghaf.hardware.usb.vhotplug.rules

List of virtual machines with USB hot plugging rules.

Type: list of (attribute set)

Default:

[
  {
    evdevPassthrough = {
      enable = true;
      pcieBusPrefix = "rp";
    };
    name = "GUIVM";
    qmpSocket = "/var/lib/microvms/gui-vm/gui-vm.sock";
    usbPassthrough = [
      {
        class = 3;
        description = "HID Keyboard";
        protocol = 1;
      }
      {
        class = 3;
        description = "HID Mouse";
        protocol = 2;
      }
      {
        class = 11;
        description = "Chip/SmartCard (e.g. YubiKey)";
      }
      {
        class = 224;
        description = "Bluetooth";
        disable = true;
        protocol = 1;
        subclass = 1;
      }
      {
        class = 8;
        description = "Mass Storage - SCSI (USB drives)";
        sublass = 6;
      }
    ];
  }
  {
    name = "NetVM";
    qmpSocket = "/var/lib/microvms/net-vm/net-vm.sock";
    usbPassthrough = [
      {
        class = 2;
        description = "Communications - Ethernet Networking";
        disable = true;
        sublass = 6;
      }
    ];
  }
  {
    name = "ChromeVM";
    qmpSocket = "/var/lib/microvms/chrome-vm/chrome-vm.sock";
    usbPassthrough = [
      {
        class = 14;
        description = "Video (USB Webcams)";
        ignore = [
          {
            description = "Lenovo X1 Integrated Camera";
            productId = "b751";
            vendorId = "04f2";
          }
          {
            description = "Lenovo X1 Integrated Camera";
            productId = "2145";
            vendorId = "5986";
          }
          {
            description = "Lenovo X1 Integrated Camera";
            productId = "0052";
            vendorId = "30c9";
          }
        ];
      }
    ];
  }
  {
    name = "AudioVM";
    qmpSocket = "/var/lib/microvms/audio-vm/audio-vm.sock";
    usbPassthrough = [
      {
        class = 1;
        description = "Audio";
      }
    ];
  }
]

Example:

[
 {
    name = "GUIVM";
    qmpSocket = "/var/lib/microvms/gui-vm/gui-vm.sock";
    usbPassthrough = [
      {
        class = 3;
        protocol = 1;
        description = "HID Keyboard";
        ignore = [
          {
            vendorId = "046d";
            productId = "c52b";
            description = "Logitech, Inc. Unifying Receiver";
          }
        ];
      }
      {
        vendorId = "067b";
        productId = "23a3";
        description = "Prolific Technology, Inc. USB-Serial Controller";
        disable = true;
      }
    ];
  }
  {
    name = "NetVM";
    qmpSocket = "/var/lib/microvms/net-vm/net-vm.sock";
    usbPassthrough = [
      {
        productName = ".*ethernet.*";
        description = "Ethernet devices";
      }
    ];
  }
];

Declared by:

ghaf.hardware.x86_64.common.enable

Whether to enable Common x86 configs.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.host.kernel.hardening.enable

Enable Ghaf Host hardening feature

Type: boolean

Default: false

Declared by:

ghaf.host.kernel.hardening.debug.enable

Enable support for debug features in the Ghaf Host

Type: boolean

Default: false

Declared by:

ghaf.host.kernel.hardening.hypervisor.enable

Enable Hypervisor hardening feature

Type: boolean

Default: false

Declared by:

ghaf.host.kernel.hardening.inputdevices.enable

Enable support for input devices in the Ghaf Host

Type: boolean

Default: false

Declared by:

ghaf.host.kernel.hardening.networking.enable

Enable support for networking in the Ghaf Host

Type: boolean

Default: false

Declared by:

ghaf.host.kernel.hardening.usb.enable

Enable support for USB in the Ghaf Host

Type: boolean

Default: false

Declared by:

ghaf.host.kernel.hardening.virtualization.enable

Enable support for virtualization in the Ghaf Host

Type: boolean

Default: false

Declared by:

ghaf.host.networking.enable

Whether to enable Host networking.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.host.powercontrol.enable

Enable host power control

Type: boolean

Default: false

Declared by:

ghaf.host.secureboot.enable

Whether to enable Host secureboot.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.kernel.audiovm

AudioVM kernel configuration

Type: attribute set

Default: { }

Declared by:

ghaf.kernel.guivm

GuiVM kernel configuration

Type: attribute set

Default: { }

Declared by:

ghaf.kernel.host

Host kernel configuration

Type: attribute set

Default: { }

Declared by:

ghaf.logging.client.enable

Enable logging client service. Currently we have grafana alloy running as client which will upload system journal logs to grafana alloy running in admin-vm.

Type: boolean

Default: false

Declared by:

ghaf.logging.client.endpoint

Assign endpoint url value to the alloy.service running in different log producers. This endpoint URL will include protocol, upstream, address along with port value.

Type: string

Declared by:

ghaf.logging.listener.address

Listener address will be used where log producers will push logs and where admin-vm alloy.service will be keep on listening or receiving logs.

Type: string

Declared by:

ghaf.logging.listener.port

Listener port for the logproto endpoint which will be used to receive logs from different log producers. Also this port value will be used to open the port in the admin-vm firewall.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 9999

Declared by:

ghaf.namespaces.vms

List of VMs currently enabled.

Type: list of string

Default: [ ]

Declared by:

ghaf.networking.hosts.enable

Whether to enable Ghaf hosts entries.

Type: boolean

Default: true

Example: true

Declared by:

ghaf.networking.hosts.entries

List of hosts entries.

Type: list of (submodule)

Default: null

Declared by:

ghaf.networking.hosts.entries.*.ip

Host IPv4 address as string.

Type: string

Declared by:

ghaf.networking.hosts.entries.*.name

Host name as string.

Type: string

Declared by:

ghaf.profiles.applications.enable

Whether to enable Some sample applications.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.profiles.debug.enable

Whether to enable debug profile.

Type: boolean

Default: true

Example: true

Declared by:

ghaf.profiles.graphics.enable

Whether to enable Graphics profile.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.profiles.graphics.compositor

Which Wayland compositor to use.

Choose one of: labwc

Type: value “labwc” (singular enum)

Default: "labwc"

Declared by:

ghaf.profiles.graphics.renderer

Which wlroots renderer to use.

Choose one of: vulkan,pixman,gles2

Type: one of “vulkan”, “pixman”, “gles2”

Default: "gles2"

Declared by:

ghaf.profiles.host-hardening.enable

Whether to enable Host hardening profile.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.profiles.release.enable

Whether to enable release profile.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.qemu.audiovm

Extra qemu arguments for AudioVM

Type: attribute set

Default: { }

Declared by:

ghaf.qemu.guivm

Extra qemu arguments for GuiVM

Type: attribute set

Default: { }

Declared by:

ghaf.reference.appvms.enable

Whether to enable Enable the Ghaf reference appvms module.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.appvms.enabled-app-vms

List of appvms to include in the Ghaf reference appvms module

Type: list of (attribute set)

Default: [ ]

Declared by:

ghaf.reference.appvms.business-vm

Whether to enable Enable the Business appvm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.appvms.chrome-vm

Whether to enable Enable the Google Chrome appvm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.appvms.chromium-vm

Whether to enable Enable the Chromium appvm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.appvms.comms-vm

Whether to enable Enable the communications appvm

  • Element
  • Slack
  • Zoom .

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.appvms.gala-vm

Whether to enable Enable the Gala appvm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.appvms.zathura-vm

Whether to enable Enable the Zathura appvm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.personalize.keys.enable

Whether to enable Enable personalization of keys for dev team.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.profiles.laptop-x86.enable

Whether to enable Enable the basic x86 laptop config.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.profiles.laptop-x86.enabled-app-vms

List of appvms to include in the Ghaf reference appvms module

Type: list of (attribute set)

Default: [ ]

Declared by:

ghaf.reference.profiles.laptop-x86.guivmExtraModules

List of additional modules to be passed to the guivm.

Type: unspecified value

Default: [ ]

Declared by:

ghaf.reference.profiles.laptop-x86.netvmExtraModules

List of additional modules to be passed to the netvm.

Type: unspecified value

Default: [ ]

Declared by:

ghaf.reference.profiles.mvp-user-trial.enable

Whether to enable Enable the mvp configuration for apps and services.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.profiles.mvp-user-trial-extras.enable

Whether to enable Enable the mvp configuration for apps and services.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.programs.google-chrome.enable

Whether to enable Enable Google chrome program settings.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.programs.google-chrome.defaultPolicy

Google chrome policy options. A list of available policies can be found in the Chrome Enterprise documentation: https://cloud.google.com/docs/chrome-enterprise/policies/ Make sure the selected policy is supported on Linux and your browser version.

Type: attribute set

Default:

{
  AlwaysOpenPdfExternally = true;
  DefaultBrowserSettingEnabled = true;
  DeviceMetricsReportingEnabled = false;
  MetricsReportingEnabled = false;
  PromptForDownloadLocation = true;
  StartupBrowserWindowLaunchSuppressed = true;
}

Example:

{
  PromptForDownloadLocation=true;
}

Declared by:

ghaf.reference.programs.google-chrome.extraOpts

Extra google chrome policy options. A list of available policies can be found in the Chrome Enterprise documentation: https://cloud.google.com/docs/chrome-enterprise/policies/ Make sure the selected policy is supported on Linux and your browser version.

Type: attribute set

Default: { }

Example:

{
  "BrowserSignin" = 0;
  "SyncDisabled" = true;
  "PasswordManagerEnabled" = false;
  "SpellcheckEnabled" = true;
  "SpellcheckLanguage" = [
    "de"
    "en-US"
  ];
}

Declared by:

ghaf.reference.programs.google-chrome.useZathuraVM

Whether to enable Open PDFs in Zathura VM.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.programs.windows-launcher.enable

Whether to enable Windows launcher.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.programs.windows-launcher.spice

Whether to enable remote access to the virtual machine using spice.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.programs.windows-launcher.spice-host

Spice host

Type: string

Default: "192.168.101.2"

Declared by:

ghaf.reference.programs.windows-launcher.spice-port

Spice port

Type: signed integer

Default: 5900

Declared by:

ghaf.reference.programs.zathura.enable

Whether to enable Enable Zathura program settings.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.enable

Whether to enable Ghaf reference services.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.dendrite

Whether to enable dendrite-pinecone service.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.dendrite-pinecone.enable

Whether to enable Enable dendrite pinecone module.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.dendrite-pinecone.externalNic

External network interface

Type: string

Default: ""

Declared by:

ghaf.reference.services.dendrite-pinecone.internalNic

Internal network interface

Type: string

Default: ""

Declared by:

ghaf.reference.services.dendrite-pinecone.serverIpAddr

Dendrite Server Ip address

Type: string

Default: ""

Declared by:

ghaf.reference.services.ollama

Whether to enable ollama service.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.proxy-business

Whether to enable Enable the proxy server service.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.proxy-server.enable

Whether to enable Enable proxy server module.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.reference.services.proxy-server.bindPort

Bind port for proxy server

Type: signed integer

Default: 3128

Declared by:

ghaf.security.sshKeys.getAuthKeysFileName

The name of the get-auth-keys file

Type: string

Default: "get-auth-keys"

Declared by:

ghaf.security.sshKeys.getAuthKeysFilePathInEtc

The path to the SSH host key relative to /etc

Type: string

Default: "ssh/get-auth-keys"

Declared by:

ghaf.security.sshKeys.sshAuthorizedKeysCommand

The authorized_keys command

Type: attribute set

Default:

{
  authorizedKeysCommand = "/etc/ssh/get-auth-keys";
  authorizedKeysCommandUser = "nobody";
}

Declared by:

ghaf.security.sshKeys.sshKeyPath

The ssh privatekey

Type: string

Default: "/run/waypipe-ssh/id_ed25519"

Declared by:

ghaf.security.sshKeys.waypipeSshPublicKeyDir

The path to the Waypipe public key

Type: string

Default: "/run/waypipe-ssh-public-key"

Declared by:

ghaf.security.sshKeys.waypipeSshPublicKeyFile

The Waypipe public key

Type: string

Default: "/run/waypipe-ssh-public-key/id_ed25519.pub"

Declared by:

ghaf.security.sshKeys.waypipeSshPublicKeyName

The name of the Waypipe public key

Type: string

Default: "waypipe-ssh-public-key"

Declared by:

ghaf.services.audio.enable

Whether to enable Enable audio service for audio VM.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.audio.pulseaudioTcpControlPort

TCP port used by Pipewire-pulseaudio control

Type: signed integer

Default: 4714

Declared by:

ghaf.services.audio.pulseaudioTcpPort

TCP port used by Pipewire-pulseaudio service

Type: signed integer

Default: 4713

Declared by:

ghaf.services.bluetooth.enable

Whether to enable Bluetooth configurations.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.desktop.enable

Whether to enable Enable the desktop configuration.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.disks.enable

Whether to enable Enable disk mount daemon.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.disks.fileManager

The program to open mounted directories

Type: string

Default: "xdg-open"

Declared by:

ghaf.services.firmware.enable

Whether to enable PLaceholder for firmware handling.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.fprint.enable

Whether to enable Enable fingerprint reader support.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.wifi.enable

Whether to enable Wifi configuration for the net-vm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.xdghandlers.enable

Whether to enable Enable Ghaf XDG handlers.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.xdgopener.enable

Whether to enable Enable the XDG opening service.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.xdgopener.xdgPort

TCP port for the XDG socket

Type: signed integer

Default: 1200

Declared by:

ghaf.services.yubikey.enable

Whether to enable Enable yubikey support which provide 2FA.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.services.yubikey.u2fKeys

It will contain U2F Keys / public keys reterived from Yubikey hardware

Type: string

Default: [ ]

Example: "ghaf:SZ2CwN7EAE4Ujfxhm+CediUaT9ngoaMOqsKRDrOC+wUkTriKlc1cVtsxkOSav2r9ztaNKn/OwoHiN3BmsBYdZA==,oIdGgoGmkVrVis1kdzpvX3kXrOmBe2noFrpHqh4VKlq/WxrFk+Du670BL7DzLas+GxIPNjgdDCHo9daVzthIwQ==,es256,+presence:9CEdjOg0YGpvNeisK5OW1hjjg0nRvJDBpr7X8Q4QPtxJP4iC5C6dShTxEpxmLAkqAi8x/jKCDwpt146AYAXfFg==,q8ddSEI2tIyRwB2MhRlrGZRv6ZDkEC2RYn/n33fdmK1KjBkcMy6ELUMQQDVGtsvsiQFbRS3v4qxjsgXF5BVD0A==,es256,+presence+pin"

Declared by:

ghaf.systemd.enable

Whether to enable Enable minimal systemd configuration…

Type: boolean

Default: false

Example: true

Declared by:

ghaf.systemd.boot.enable

Whether to enable Enable systemd in stage 1 of the boot (initrd)…

Type: boolean

Default: false

Example: true

Declared by:

ghaf.systemd.excludedHardenedConfigs

A list of units to skip when applying hardened systemd service configurations. The main purpose of this is to provide a mechanism to exclude specific hardened configurations for fast debugging and problem resolution.

Type: list of string

Default: [ ]

Example:

[
  "sshd.service"
]

Declared by:

ghaf.systemd.logLevel

Log Level for systemd services. Available options: “emerg”, “alert”, “crit”, “err”, “warning”, “info”, “debug”

Type: string

Default: "info"

Declared by:

ghaf.systemd.withApparmor

Enable systemd apparmor functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withAudit

Enable systemd audit functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withBootloader

Enable systemd bootloader functionality.

Type: boolean

Default: true

Declared by:

ghaf.systemd.withCryptsetup

Enable systemd LUKS2 functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withDebug

Enable systemd debug functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withEfi

Enable systemd EFI functionality.

Type: boolean

Default: true

Declared by:

ghaf.systemd.withFido2

Enable systemd Fido2 token functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withHardenedConfigs

Enable common hardened configs.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withHostnamed

Enable systemd hostname daemon.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withJournal

Enable systemd journal daemon.

Type: boolean

Default: true

Declared by:

ghaf.systemd.withLocaled

Enable systemd locale daemon.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withLogind

Enable systemd login daemon.

Type: boolean

Default: true

Declared by:

ghaf.systemd.withMachines

Enable systemd container and VM functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withName

Set systemd name.

Type: string

Default: "base-systemd"

Declared by:

ghaf.systemd.withNetworkd

Enable systemd networking daemon.

Type: boolean

Default: true

Declared by:

ghaf.systemd.withNss

Enable systemd Name Service Switch (NSS) functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withPolkit

Enable systemd polkit functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withRepart

Enable systemd repart functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withResolved

Enable systemd resolve daemon.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withSerial

Enable systemd serial console.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withTimesyncd

Enable systemd timesync daemon.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withTpm2Tss

Enable systemd TPM functionality.

Type: boolean

Default: false

Declared by:

ghaf.systemd.withUkify

Enable systemd UKI functionality.

Type: boolean

Default: true

Declared by:

ghaf.users.accounts.enable

Whether to enable Default account Setup.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.users.accounts.password

A default password for the user.

Type: string

Default: "ghaf"

Declared by:

ghaf.users.accounts.user

A default user to create in the system.

Type: string

Default: "ghaf"

Declared by:

ghaf.version

The version of Ghaf

Type: string (read only)

Default: "24.09.4"

Declared by:

ghaf.virtualization.docker.daemon.enable

Whether to enable Docker Daemon.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.virtualization.microvm.adminvm.enable

Whether to enable AdminVM.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.adminvm.extraModules

List of additional modules to be imported and evaluated as part of AdminVM’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.enable

Whether to enable appvm.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.extraModules

List of additional modules to be imported and evaluated as part of appvm’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms

List of AppVMs to be created

Type: list of (submodule)

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.packages

Packages that are included into the AppVM

Type: list of package

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.borderColor

Border color of the AppVM window

Type: null or string

Default: null

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.cid

VSOCK context identifier (CID) for the AppVM Default value 0 means auto-assign using vsockBaseCID and AppVM index

Type: signed integer

Default: 0

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.cores

Amount of processor cores for this AppVM

Type: signed integer

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.extraModules

List of additional modules to be imported and evaluated as part of appvm’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.ghafAudio.enable

Whether to enable Ghaf application audio support.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.ghafAudio.useTunneling

Whether to enable Use Pulseaudio tunneling.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.macAddress

AppVM’s network interface MAC address

Type: string

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.name

Name of the AppVM

Type: string

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.ramMb

Amount of RAM for this AppVM

Type: signed integer

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vms.*.vtpm.enable

Whether to enable vTPM support in the virtual machine.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.vsockBaseCID

Context Identifier (CID) of the AppVM VSOCK

Type: signed integer

Default: 100

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.appvm.waypipeBasePort

Waypipe base port number for AppVMs

Type: signed integer

Default: 1100

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.audiovm.enable

Whether to enable AudioVM.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.audiovm.audio

Enable Audio module configuration.

Type: boolean

Default: false

Declared by:

ghaf.virtualization.microvm.audiovm.extraModules

List of additional modules to be imported and evaluated as part of AudioVM’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.guivm.enable

Whether to enable GUIVM.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.guivm.extraModules

List of additional modules to be imported and evaluated as part of GUIVM’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.guivm.fprint

Enable Fingerprint module configuration.

Type: boolean

Default: false

Declared by:

ghaf.virtualization.microvm.guivm.vsockCID

Context Identifier (CID) of the GUIVM VSOCK

Type: signed integer

Default: 3

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.guivm.yubikey

Enable Yubikey module configuration.

Type: boolean

Default: false

Declared by:

ghaf.virtualization.microvm.idsvm.enable

Whether to enable Whether to enable IDS-VM on the system.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.virtualization.microvm.idsvm.extraModules

List of additional modules to be imported and evaluated as part of IDSVM’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

ghaf.virtualization.microvm.idsvm.mitmproxy.enable

Whether to enable Whether to enable mitmproxy on ids-vm.

Type: boolean

Default: false

Example: true

Declared by:

ghaf.virtualization.microvm.netvm.enable

Whether to enable NetVM.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.netvm.extraModules

List of additional modules to be imported and evaluated as part of NetVM’s NixOS configuration.

Type: unspecified value

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm.netvm.wifi

Enable Wifi module configuration.

Type: boolean

Default: false

Declared by:

ghaf.virtualization.microvm-host.enable

Whether to enable MicroVM Host.

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm-host.networkSupport

Whether to enable Network support services to run host applications…

Type: boolean

Default: false

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm-host.sharedVmDirectory.enable

Whether to enable shared directory.

Type: boolean

Default: true

Example: true

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)

ghaf.virtualization.microvm-host.sharedVmDirectory.vms

List of names of virtual machines for which unsafe shared folder will be enabled.

Type: list of string

Default: [ ]

Declared by:

  • [https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm](https://github.com/tiiuae/ghaf/blob/main/modules/microvm/flake-module.nix, via option flake.nixosModules.microvm)