Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: false

Declared by:

Always run the activation script, no matter whether the configuration has changed (the default). This behaviour can be enforced even if it's set to false using the command line option --always-activate on deployment. If this is set to false, activation is done only if the new system profile doesn't match the previous one.

Type: boolean

Default: true

Declared by:

The LUKS volumes to be created. The name of each attribute set specifies the name of the LUKS volume; thus, the resulting device will be named /dev/mapper/name.

Type: attribute set of submodules

Default: { }

Example: { secretdisk = { device = "/dev/xvdf"; passphrase = "foobar"; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

If the underlying device does not currently contain a filesystem (as determined by blkid, then automatically initialise it using cryptsetup luksFormat.

Type: boolean

Default: false

Declared by:

The cipher used to encrypt the volume.

Type: string

Default: "aes-cbc-essiv:sha256"

Declared by:

The underlying (encrypted) device.

Type: string

Example: "/dev/xvdg"

Declared by:

The size in bits of the encryption key.

Type: integer

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the volume. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or underlying device, unless you copy it from NixOps's state file. Note that unless deployment.storeKeysOnMachine is set to false, the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the disk containing the store can subsequently decrypt the encrypted volume.

Type: string

Default: ""

Declared by:

The RAID-0 volumes to be created. The name of each attribute set specifies the name of both the volume group and the logical volume; thus, the resulting device will be named /dev/name/name.

Type: attribute set of submodules

Default: { }

Example: { bigdisk = { devices = [ "/dev/xvdg" "/dev/xvdh" ] ; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

The underlying devices to be combined into a RAID-0 volume.

Type: list of strings

Example: [ "/dev/xvdg" "/dev/xvdh" ]

Declared by:

The NixOS machine on which this container is to be instantiated.

Type: string or a machine

Default: "localhost"

Declared by:

The AWS Access Key ID. If left empty, it defaults to the contents of the environment variables EC2_ACCESS_KEY or AWS_ACCESS_KEY_ID (in that order). The corresponding Secret Access Key is not specified in the deployment model, but looked up in the file ~/.ec2-keys, which should specify, on each line, an Access Key ID followed by the corresponding Secret Access Key. If it does not appear in that file, the environment variables environment variables EC2_SECRET_KEY or AWS_SECRET_ACCESS_KEY are used.

Type: string

Default: ""

Example: "AKIAIEMEJZVMPOHZWKZQ"

Declared by:

EC2 identifier of the AMI disk image used in the virtual machine. This must be a NixOS image providing SSH access.

Type: string

Example: "ami-ecb49e98"

Declared by:

If instance in a subnet/VPC, whether to associate a public IP address with the instance.

Type: boolean

Default: false

Declared by:

Block device mapping. /dev/xvd[a-e] must be ephemeral devices.

Type: attribute set of submodules

Default: { }

Example: { /dev/xvdb = { disk = "ephemeral0"; } ; /dev/xvdg = { disk = "vol-d04895b8"; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

The cipher used to encrypt the disk.

Type: string

Default: "aes-cbc-essiv:sha256"

Declared by:

For automatically created EBS volumes, determines whether the volume should be deleted on instance termination.

Type: boolean

Declared by:

EC2 identifier of the disk to be mounted. This can be an ephemeral disk (e.g. ephemeral0), a snapshot ID (e.g. snap-1cbda474) or a volume ID (e.g. vol-d04895b8). Leave empty to create an EBS volume automatically. It can also be an EBS resource (e.g. resources.ebsVolumes.big-disk).

Type: string or resource of type ‘ebs-volume’

Default: ""

Example: "vol-d04895b8"

Declared by:

Whether the EBS volume should be encrypted using LUKS.

Type: boolean

Default: false

Declared by:

Whether the EBS volume should be encrypted using LUKS or on the underlying EBS volume (Amazon EBS feature). Possible values are "luks" (default) and "ebs".

Type: one of luks, ebs

Default: "luks"

Declared by:

Filesystem type for automatically created EBS volumes.

Type: string

Default: "ext4"

Declared by:

The provisioned IOPS you want to associate with this EBS volume.

Type: integer

Default: 0

Declared by:

The size of the encryption key.

Type: integer

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the device. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or remove the volume, unless you copy it from NixOps's state file. Note that the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the EBS volume or instance store that contains the Nix store can subsequently decrypt the encrypted volume.

Type: string

Default: ""

Declared by:

Volume size (in gigabytes). This may be left unset if you are creating the volume from a snapshot, in which case the size of the volume will be equal to the size of the snapshot. However, you can set a size larger than the snapshot, allowing the volume to be larger than the snapshot from which it is created.

Type: integer

Example: 100

Declared by:

The volume type for the EBS volume, which must be one of "standard" (a magnetic volume), "io1" (a provisioned IOPS SSD volume) or "gp2" (a general purpose SSD volume).

Type: one of standard, io1, gp2

Default: "standard"

Declared by:

Whether you want to boot from an EBS-backed AMI. Only EBS-backed instances can be stopped and restarted, and attach other EBS volumes at boot time. This option determines the selection of the default AMI; if you explicitly specify deployment.ec2.ami, it has no effect.

Type: boolean

Default: true

Declared by:

Preferred size (G) of the root disk of the EBS-backed instance. By default, EBS-backed images have a root disk of 20G. Only supported on creation of the instance.

Type: integer

Default: 0

Declared by:

Whether the EC2 instance should be created as an EBS Optimized instance.

Type: boolean

Default: false

Declared by:

Elastic IPv4 address to be associated with this machine.

Type: string or resource of type ‘elastic-ip’

Default: ""

Example: "203.0.113.123"

Declared by:

EC2 instance ID (set by NixOps).

Type: string

Default: ""

Declared by:

The name of the IAM Instance Profile (IIP) to associate with the instances.

Type: string

Default: ""

Example: "rolename"

Declared by:

EC2 instance type. See http://aws.amazon.com/ec2/instance-types/ for a list of valid Amazon EC2 instance types.

Type: string

Default: "m1.small"

Example: "m1.large"

Declared by:

Name of the SSH key pair to be used to communicate securely with the instance. Key pairs can be created using the ec2-add-keypair command.

Type: string or resource of type ‘ec2-keypair’

Example: "my-keypair"

Declared by:

Attribute set containing number of CPUs and memory available to the machine.

Type: unspecified

Default: { }

Example: { cores = 4; memory = 14985; }

Declared by:

Placement group for the instance.

Type: string or resource of type ‘ec2-placement-group’

Default: ""

Example: "my-cluster"

Declared by:

Path of the SSH private key file corresponding with deployment.ec2.keyPair. NixOps will use this private key if set; otherwise, the key must be findable by SSH through its normal mechanisms (e.g. it should be listed in ~/.ssh/config or added to the ssh-agent).

Type: string

Default: ""

Example: "/home/alice/.ssh/id_rsa-my-keypair"

Declared by:

Amazon EC2 region in which the instance is to be deployed. This option only applies when using EC2. It implicitly sets deployment.ec2.ami.

Type: string

Default: ""

Example: "us-east-1"

Declared by:

Security Group IDs for the instance. Necessary if starting an instance inside a VPC/subnet. In the non-default VPC, security groups needs to be specified by ID and not name.

Type: list of strings

Default: [ ]

Declared by:

Security groups for the instance. These determine the firewall rules applied to the instance.

Type: list of string or resource of type ‘ec2-security-group’s

Default: [ "default" ]

Example: [ "my-group" "my-other-group" ]

Declared by:

Price (in dollar cents per hour) to use for spot instances request for the machine. If the value is equal to 0 (default), then spot instances are not used.

Type: integer

Default: 0

Declared by:

The subnet inside a VPC to launch the instance in.

Type: string

Default: ""

Example: "subnet-9d4a7b6c"

Declared by:

Tags assigned to the instance. Each tag name can be at most 128 characters, and each tag value can be at most 256 characters. There can be at most 10 tags.

Type: attribute set of strings

Default: { }

Example: { foo = "bar"; xyzzy = "bla"; }

Declared by:

If instance is in a subnet/VPC whether to use the private IP address for ssh connections to this host. Defaults to true in the case that you are deploying into a subnet but not associating a public ip address.

Type: boolean

Default: false

Declared by:

The EC2 availability zone in which the instance should be created. If not specified, a zone is selected automatically.

Type: string

Default: ""

Example: "us-east-1c"

Declared by:

NixOps will set up an encrypted tunnel (via SSH) to the machines listed here. Since this is a two-way (peer to peer) connection, it is not necessary to set this option on both endpoints. NixOps will set up /etc/hosts so that the host names of the machines listed here resolve to the IP addresses of the tunnels. It will also add the alias machine-encrypted for each machine.

Type: list of strings

Default: [ ]

Declared by:

The path to GCE Service Account key. If left empty, it defaults to the contents of the environment variable ACCESS_KEY_PATH.

Type: string

Default: ""

Example: "/path/to/secret/key.pem"

Declared by:

Block device mapping.

Type: attribute set of submodules

Default: { }

Example: { /dev/sda = { image = "bootstrap-img"; } ; /dev/sdb = { disk = "vol-d04895b8"; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

Should the instance boot from this disk.

Type: boolean

Default: false

Declared by:

The cipher used to encrypt the disk.

Type: string

Default: "aes-cbc-essiv:sha256"

Declared by:

For automatically created GCE disks, determines whether the disk should be deleted on instance destruction.

Type: boolean

Declared by:

GCE Disk resource or name of a disk not managed by NixOps to be mounted.

Type: null or string or resource of type ‘gce-disk’

Default: null

Example: "resources.gceDisks.exampleDisk"

Declared by:

The disk storage type (standard/ssd).

Type: string

Default: "standard"

Declared by:

Name of the GCE disk to create.

Type: null or string

Default: null

Example: "machine-persistent-disk2"

Declared by:

Whether the GCE disk should be encrypted using LUKS.

Type: boolean

Default: false

Declared by:

The image name or resource from which to create the GCE disk. If not specified, an empty disk is created. Changing the image name has no effect if the disk already exists.

Type: null or string or resource of type ‘gce-image’

Default: null

Example: "image-432"

Declared by:

The size of the encryption key.

Type: integer

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the device. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or remove the volume, unless you copy it from NixOps's state file. Note that the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the GCE disk or instance store that contains the Nix store can subsequently decrypt the encrypted volume.

Type: string

Default: ""

Declared by:

Should the disk be attached to the instance as read-only.

Type: boolean

Default: false

Declared by:

Volume size (in gigabytes) for automatically created GCE disks. This may be left unset if you are creating the disk from a snapshot or image, in which case the size of the disk will be equal to the size of the snapshot or image. You can set a size larger than the snapshot or image, allowing the disk to be larger than the snapshot from which it is created.

Type: null or integer

Default: null

Declared by:

The snapshot name from which to create the GCE disk. If not specified, an empty disk is created. Changing the snapshot name has no effect if the disk already exists.

Type: null or string

Default: null

Example: "snapshot-432"

Declared by:

Bootstrap image name or resource to use to create the root disk of the instance.

Type: string or resource of type ‘gce-image’

Default: { }

Declared by:

GCE instance type. See https://developers.google.com/compute/pricing for a list of valid instance types.

Type: string

Default: "g1-small"

Example: "n1-standard-1"

Declared by:

GCE Static IP address resource to bind to or the name of an IP address not managed by NixOps.

Type: null or string or resource of type ‘gce-static-ip’

Default: null

Example: "resources.gceStaticIPs.exampleIP"

Declared by:

The GCE Instance Name.

Type: string

Default: "n-<uuid>-<name>"

Example: "custom-machine-name"

Declared by:

Metadata to assign to the instance. These are available to the instance via the metadata server. Some metadata keys such as "startup-script" are reserved by GCE and can influence the instance.

Type: attribute set of strings

Default: { }

Example: { loglevel = "warn"; }

Declared by:

The GCE Network to make the instance a part of. Can be either a gceNetworks resource or a name of a network not managed by NixOps.

Type: null or string or resource of type ‘gce-network’

Default: null

Example: "resources.gceNetworks.verySecureNetwork"

Declared by:

The GCE project which should own the instance. If left empty, it defaults to the contents of the environment variable GCE_PROJECT.

Type: string

Default: ""

Example: "myproject"

Declared by:

The GCE datacenter in which the instance should be created.

Type: string

Example: "europe-west1-b"

Declared by:

Root disk size(in gigabytes). Leave unset to be the same as bootstrapImage size.

Type: null or integer

Default: null

Example: 200

Declared by:

The root disk storage type (standard/ssd).

Type: string

Default: "standard"

Declared by:

Whether the Instance should be automatically restarted when it is terminated by Google Compute Engine (not terminated by user).

Type: boolean

Default: true

Declared by:

Defines the maintenance behavior for this instance. For more information, see https://developers.google.com/compute/docs/instances#onhostmaintenance. Allowed values are: "MIGRATE" to let GCE automatically migrate your instances out of the way of maintenance events and "TERMINATE" to allow GCE to terminate and restart the instance.

Type: string

Default: "MIGRATE"

Declared by:

The GCE Service Account Email. If left empty, it defaults to the contents of the environment variable GCE_SERVICE_ACCOUNT.

Type: string

Default: ""

Example: "12345-asdf@developer.gserviceaccount.com"

Declared by:

Tags to assign to the instance. These can be used in firewall and networking rules and are additionally available as metadata.

Type: list of strings

Default: [ ]

Example: [ "random" "tags" ]

Declared by:

Main IP address identifying the server.

Type: null or string

Default: null

Example: "78.46.1.93"

Declared by:

Specify layout of partitions and file systems using Anacondas Kickstart format. For possible options and commands, please have a look at: http://fedoraproject.org/wiki/Anaconda/Kickstart

Type: string

Default:

''
clearpart --all --initlabel --drives=sda,sdb

part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb

part raid.1 --grow --ondisk=sda
part raid.2 --grow --ondisk=sdb

raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
''

Example:

''
# Example for partitioning on a vServer:
clearpart --all --initlabel --drives=vda
part swap --recommended --label=swap --fstype=swap --ondisk=vda
part / --fstype=ext4 --label=root --grow --ondisk=vda
''

Declared by:

Password of the Hetzner robot account. If left empty, the value of the environment variable HETZNER_ROBOT_PASS is used instead.

Type: null or string

Default: ""

Declared by:

Username of the Hetzner robot account. If left empty, the value of the environment variable HETZNER_ROBOT_USER is used instead.

Type: null or string

Default: ""

Declared by:

The set of keys to be deployed to the machine. Each attribute maps a key name to a file that can be accessed as /run/keys/name. Thus, { password.text = "foobar"; } causes a file /run/keys/password to be created with contents foobar. The directory /run/keys is only accessible to root and the keys group. So keep in mind to add any users that need to have access to a particular key to this group.

Type: attribute set of string or key optionss

Default: { }

Example: { password = { text = "foobar"; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

The group that will be set for the key file.

Type: string

Default: "root"

The default permissions to set for the key file, needs to be in the format accepted by chmod(1).

Type: string

Default: "0600"

Example: "0640"

The text the key should contain. So if the key name is password and foobar is set here, the contents of the file /run/keys/password will be foobar.

Type: string

Example: "super secret stuff"

The user which will be the owner of the key file.

Type: string

Default: "root"

The disk is created using the specified disk image as a base.

Type: null or path

Default: null

Example: "/home/alice/base-disk.qcow2"

Declared by:

The size (G) of base image of virtual machine.

Type: integer

Default: 10

Declared by:

Additional XML appended at the end of device tag in domain xml. See https://libvirt.org/formatdomain.html

Type: string

Default: ""

Declared by:

If set VM is started in headless mode, i.e., without a visible display on the host's desktop.

Type: unspecified

Default: false

Declared by:

Directory to store VM image files. Note that it should be writable both by you and by libvirtd daemon.

Type: path

Default: "/var/lib/libvirt/images"

Declared by:

Memory size (M) of virtual machine.

Type: integer

Default: 512

Declared by:

Names of libvirt networks to attach the VM to.

Type: list of strings

Default: [ "default" ]

Declared by:

List of email addresses of the owners of the machines. Used to send email on performing certain actions.

Type: list of strings

Default: [ ]

Declared by:

The AWS Access Key ID. If left empty, it defaults to the contents of the environment variables EC2_ACCESS_KEY or AWS_ACCESS_KEY_ID (in that order). The corresponding Secret Access Key is not specified in the deployment model, but looked up in the file ~/.ec2-keys, which should specify, on each line, an Access Key ID followed by the corresponding Secret Access Key. If it does not appear in that file, the environment variables environment variables EC2_SECRET_KEY or AWS_SECRET_ACCESS_KEY are used.

Type: string

Default: ""

Example: "AKIAIEMEJZVMPOHZWKZQ"

Declared by:

The DNS hostname to bind the public IP address to.

Type: string

Default: ""

Example: "test.x.logicblox.com"

Declared by:

The time to live (TTL) for the A record created for the specified DNS hostname.

Type: integer

Default: 300

Example: 300

Declared by:

Whether to create a CNAME record with the instance's public DNS name. This will resolve inside AWS to a private IP and outside AWS to the public IP.

Type: boolean

Default: false

Declared by:

If true, secret information such as LUKS encryption keys or SSL private keys is stored on the root disk of the machine, allowing the machine to do unattended reboots. If false, secrets are not stored; NixOps supplies them to the machine at mount time. This means that a reboot will not complete entirely until you run nixops deploy or nixops send-keys.

Type: boolean

Default: false

Declared by:

This option specifies the type of the environment in which the machine is to be deployed by NixOps. Currently, it can have the following values. "none" means deploying to a pre-existing physical or virtual NixOS machine, reachable via SSH under the hostname or IP address specified in deployment.targetHost. "ec2" means that a virtual machine should be instantiated in an Amazon EC2-compatible cloud environment (see deployment.ec2.*). "virtualbox" causes a VirtualBox VM to be created on your machine. (This requires VirtualBox to be configured on your system.)

Type: string

Default: "none"

Example: "ec2"

Declared by:

This option specifies the hostname or IP address to be used by NixOps to execute remote deployment operations.

Type: string

Declared by:

This option specifies the SSH port to be used by NixOps to execute remote deployment operations.

Type: integer

Declared by:

Definition of the virtual disks attached to this instance.

Type: attribute set of submodules

Default: { }

Example: { big-disk = { port = 1; size = 1048576; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

If set, this disk is created as a clone of the specified disk image (and the size attribute is ignored).

Type: null or path

Default: null

Example: "/home/alice/base-disk.vdi"

Declared by:

SATA port number to which the disk is attached.

Type: integer

Example: 1

Declared by:

Size (in megabytes) of this disk.

Type: integer

Declared by:

If set, the VirtualBox instance is started in headless mode, i.e., without a visible display on the host's desktop.

Type: unspecified

Default: false

Declared by:

Memory size (M) of virtual machine.

Type: integer

Default: 512

Declared by:

Definition of the host folders that should be shared with this instance.

Type: attribute set of submodules

Default: { }

Example: { home = { hostPath = "/home"; readOnly = false; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

The path of the host directory that should be shared to the guest

Type: string

Example: "/home"

Declared by:

Specifies if the shared folder should be read-only for the guest

Type: boolean

Default: true

Declared by:

NixOps extends NixOS' fileSystem option to allow convenient attaching of EC2 volumes.

Type: list of submodules

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

EC2 disk to be attached to this mount point. This is shorthand for defining a separate deployment.ec2.blockDeviceMapping attribute.

Type: null or submodule

Default: null

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

The cipher used to encrypt the disk.

Type: string

Default: "aes-cbc-essiv:sha256"

Declared by:

For automatically created EBS volumes, determines whether the volume should be deleted on instance termination.

Type: boolean

Declared by:

EC2 identifier of the disk to be mounted. This can be an ephemeral disk (e.g. ephemeral0), a snapshot ID (e.g. snap-1cbda474) or a volume ID (e.g. vol-d04895b8). Leave empty to create an EBS volume automatically. It can also be an EBS resource (e.g. resources.ebsVolumes.big-disk).

Type: string or resource of type ‘ebs-volume’

Default: ""

Example: "vol-d04895b8"

Declared by:

Whether the EBS volume should be encrypted using LUKS.

Type: boolean

Default: false

Declared by:

Whether the EBS volume should be encrypted using LUKS or on the underlying EBS volume (Amazon EBS feature). Possible values are "luks" (default) and "ebs".

Type: one of luks, ebs

Default: "luks"

Declared by:

Filesystem type for automatically created EBS volumes.

Type: string

Default: "ext4"

Declared by:

The provisioned IOPS you want to associate with this EBS volume.

Type: integer

Default: 0

Declared by:

The size of the encryption key.

Type: integer

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the device. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or remove the volume, unless you copy it from NixOps's state file. Note that the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the EBS volume or instance store that contains the Nix store can subsequently decrypt the encrypted volume.

Type: string

Default: ""

Declared by:

Volume size (in gigabytes). This may be left unset if you are creating the volume from a snapshot, in which case the size of the volume will be equal to the size of the snapshot. However, you can set a size larger than the snapshot, allowing the volume to be larger than the snapshot from which it is created.

Type: integer

Example: 100

Declared by:

The volume type for the EBS volume, which must be one of "standard" (a magnetic volume), "io1" (a provisioned IOPS SSD volume) or "gp2" (a general purpose SSD volume).

Type: one of standard, io1, gp2

Default: "standard"

Declared by:

GCE disk to be attached to this mount point. This is shorthand for defining a separate deployment.gce.blockDeviceMapping attribute.

Type: null or submodule

Default: null

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

Should the instance boot from this disk.

Type: boolean

Default: false

Declared by:

The cipher used to encrypt the disk.

Type: string

Default: "aes-cbc-essiv:sha256"

Declared by:

For automatically created GCE disks, determines whether the disk should be deleted on instance destruction.

Type: boolean

Declared by:

GCE Disk resource or name of a disk not managed by NixOps to be mounted.

Type: null or string or resource of type ‘gce-disk’

Default: null

Example: "resources.gceDisks.exampleDisk"

Declared by:

The disk storage type (standard/ssd).

Type: string

Default: "standard"

Declared by:

Name of the GCE disk to create.

Type: null or string

Default: null

Example: "machine-persistent-disk2"

Declared by:

Whether the GCE disk should be encrypted using LUKS.

Type: boolean

Default: false

Declared by:

The image name or resource from which to create the GCE disk. If not specified, an empty disk is created. Changing the image name has no effect if the disk already exists.

Type: null or string or resource of type ‘gce-image’

Default: null

Example: "image-432"

Declared by:

The size of the encryption key.

Type: integer

Default: 128

Declared by:

The passphrase (key file) used to decrypt the key to access the device. If left empty, a passphrase is generated automatically; this passphrase is lost when you destroy the machine or remove the volume, unless you copy it from NixOps's state file. Note that the passphrase is stored in the Nix store of the instance, so an attacker who gains access to the GCE disk or instance store that contains the Nix store can subsequently decrypt the encrypted volume.

Type: string

Default: ""

Declared by:

Should the disk be attached to the instance as read-only.

Type: boolean

Default: false

Declared by:

Volume size (in gigabytes) for automatically created GCE disks. This may be left unset if you are creating the disk from a snapshot or image, in which case the size of the disk will be equal to the size of the snapshot or image. You can set a size larger than the snapshot or image, allowing the disk to be larger than the snapshot from which it is created.

Type: null or integer

Default: null

Declared by:

The snapshot name from which to create the GCE disk. If not specified, an empty disk is created. Changing the snapshot name has no effect if the disk already exists.

Type: null or string

Default: null

Example: "snapshot-432"

Declared by:

A set of peer-to-peer tunnels set up automatically over SSH.

Type: attribute set of submodules

Default: { }

Example: { tunnel1 = { localIPv4 = "172.16.12.1"; localTunnel = 0; privateKey = "/root/.ssh/id_vpn"; remoteIPv4 = "172.16.12.2"; remoteTunnel = 1; target = "192.0.2.1"; } ; }

Declared by:

Arguments passed to each module.

Type: attribute set of unspecifieds

Declared by:

Whether to check whether all option definitions have matching declarations.

Type: boolean

Default: true

Declared by:

IPv4 address of the local endpoint of the tunnel.

Type: string

Declared by:

Local tunnel device number.

Type: integer

Declared by:

Path to the private key file used to connect to the remote machine.

Type: path

Declared by:

IPv4 address of the remote endpoint of the tunnel.

Type: string

Declared by:

Remote tunnel device number.

Type: integer

Declared by:

Host name or IP address of the remote machine.

Type: string

Declared by:

Port number that SSH listens to on the remote machine.

Type: integer

Declared by:

IPv4 address of this machine within in the logical network. This address can be used by other machines in the logical network to reach this machine. However, it need not be visible to the outside (i.e., publicly routable).

Type: string

Example: "10.1.2.3"

Declared by:

Publicly routable IPv4 address of this machine.

Type: string

Example: "198.51.100.123"

Declared by:

Public key of the machine's VPN key (set by nixops)

Type: null or string

Default: null

Declared by: