Canaille

services.canaille.enable

Whether to enable Canaille.

Type:

boolean

Default:

false

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.jwtPrivateKeyFile

File containing the JWT private key. Make sure it has appropriate permissions.

You can generate one using

openssl genrsa -out private.pem 4096
openssl rsa -in private.pem -pubout -outform PEM -out public.pem

Type:

null or absolute path

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.ldapBindPasswordFile

File containing the LDAP bind password.

Type:

null or absolute path

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.package

The canaille package to use.

Type:

package

Default:

pkgs.canaille

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.secretKeyFile

File containing the Flask secret key. Its content is going to be provided to Canaille as SECRET_KEY. Make sure it has appropriate permissions. For example, copy the output of this to the specified file:

python3 -c 'import secrets; print(secrets.token_hex())'

Type:

absolute path

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings

Settings for Canaille. See the documentation for details.

Type:

open submodule of (TOML value)

Default:

{ }

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE.ACL

Access Control Lists.

See also the documentation.

Type:

null or (open submodule of (TOML value))

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE.SMTP

SMTP configuration. By default, sending emails is not enabled.

Set to an empty attrs to send emails from localhost without authentication.

See also the documentation.

Type:

null or (open submodule of (TOML value))

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE.SMTP.PASSWORD

Read-only

SMTP Password. Can't be set and has to be provided using services.canaille.smtpPasswordFile.

Type:

null or string

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE_LDAP

Configuration for the LDAP backend. This storage backend is not yet supported by the module, so use at your own risk!

Type:

null or (open submodule of (TOML value))

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE_LDAP.BIND_PW

Read-only

The LDAP bind password. Can't be set and has to be provided using services.canaille.ldapBindPasswordFile.

Type:

null or string

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE_OIDC

OpenID Connect settings. See the documentation.

Type:

null or (open submodule of (TOML value))

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE_OIDC.JWT.PRIVATE_KEY

Read-only

JWT private key. Can't be set and has to be provided using services.canaille.jwtPrivateKeyFile.

Type:

null or string

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.CANAILLE_SQL.DATABASE_URI

The SQL server URI. Will configure a local PostgreSQL db if left to default. Please note that the NixOS module only really supports PostgreSQL for now. Change at your own risk!

Type:

string

Default:

"postgresql://localhost/canaille?host=/run/postgresql"

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.PREFERRED_URL_SCHEME

The url scheme by which canaille will be served.

Type:

one of "http", "https"

Default:

"https"

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.SECRET_KEY

Read-only

Flask Secret Key. Can't be set and must be provided through services.canaille.settings.secretKeyFile.

Type:

null or string

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.settings.SERVER_NAME

The domain name on which canaille will be served.

Type:

string

Declared in:

nixos/modules/services/security/canaille.nix

services.canaille.smtpPasswordFile

File containing the SMTP password. Make sure it has appropriate permissions.

Type:

null or absolute path

Default:

null

Declared in:

nixos/modules/services/security/canaille.nix

{ ... }:

{
  services.canaille.enable = true;
  services.canaille.settings.SERVER_NAME = "auth.mydomain.example";
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "you@example.com";
  services.canaille.secretKeyFile = "/etc/nixos/canaille-secret.key";
}

Declared in: projects/Canaille/services/Canaille/examples/basic.nix