fleet.other

65 options

`fleet.access.users.<name>.email`

Primary email address. Required by Authentik user.email.

Type: string

Default: none (required when its feature is enabled)

Example:

"alice@example.com"

Declared by: nix/fleet/users

`fleet.access.users.<name>.groups`

Authentik groups (LDAP-side membership). NOT the same as Linux groups on a VM — those are declared on cloud_init.users[*].extra_groups.

Type: list of string

Default:

[ ]

Example:

[
  "platform-admins"
]

Declared by: nix/fleet/users

`fleet.access.users.<name>.ssh_keys`

SSH public keys. Published as Authentik attributes.sshPublicKey for SSSD; injected into dev-VM cloud-init.

Type: list of string

Default:

[ ]

Example:

[
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleExampleExampleExampleExampleExa alice@laptop"
]

Declared by: nix/fleet/users

`fleet.access.users.<name>.type`

Maps to Authentik’s user.type field.

Type: one of "internal", "service_account"

Default:

"internal"

Declared by: nix/fleet/users

name → literal IP, merged into publicDnsRecords last. Split-DNS overrides for names whose public zone answer (WAN IP) is not reachable from inside the fleet (no NAT hairpin) — point them at the internal ingress instead.

Type: attribute set of string

Default:

{ }

Example:

{ vpn = "192.0.2.2"; }

Declared by: nix/fleet/dns

`fleet.dnsStaticRecords`

name → literal IP, merged into dnsRecords last. For service aliases pinned to an address rather than a fleet host (edge services like ca/ntp/dns on the ingress box).

Type: attribute set of string

Default:

{ }

Example:

{ ntp = "192.0.2.2"; ca = "192.0.2.2"; }

Declared by: nix/fleet/dns

`fleet.fleets`

Named fleet namespaces sharing this estate’s substrate (ADR-097).

Type: attribute set of (submodule)

Default:

{ }

Example:

{ jeirslab.providers.proxmox.main.nodes.pve1.resources.lxc.foo = { vm_id = 9101; }; }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.description`

What / whose namespace this is (shown in docs projections).

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers`

Provider forest of this fleet: .[.nodes.].resources.., same shape as the top-level tree.

Type: attribute set of attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.cluster`

Proxmox-cluster-specific info. Empty for non-Proxmox providers.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.cluster.ha_manager`

Whether the cluster runs the PVE HA manager. Informational — not consumed by any emitter yet.

Type: boolean

Default:

false

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.cluster.node_addresses`

Node name → SSH host used by out-of-band local-exec steps (fleet.compute..lxc_extra_conf). A node missing here is reached by its name.

Type: attribute set of string

Default:

{ }

Example:

{
  pve1 = "198.51.100.11";
  pve2 = "pve2.mgmt.example.internal";
}

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.cluster.nodes`

Cluster member names. More than one entry makes the instance multi-node, which forces every compute entry on it to set node explicitly (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "pve-alpha"
  "pve-beta"
]

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.cluster.primary_node`

Fallback placement target: compute/resource entries that leave node empty are provisioned here.

Type: string

Default:

""

Example:

"pve-alpha"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.destruction_policy`

strict: emit prevent_destroy=true on EVERY resource in this instance
standard: emit prevent_destroy=true only on stateful-tagged resources
permissive: emit prevent_destroy only on explicit protect=true

Type: one of "strict", "standard", "permissive"

Default:

"standard"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.endpoint`

API endpoint URL. Optional — provider may derive from secrets.

Type: null or string

Default:

null

Example:

"https://192.0.2.10:8006/"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.insecure`

Skip TLS verification (internal step-ca cert).

Type: boolean

Default:

true

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.minVersion`

Lowest Proxmox VE major.minor this instance is expected to run. fleetkit’s zero-touch NixOS LXC first boot needs PVE 9 (its NixOS LXC setup plugin writes the guest’s eth0.network from the container’s net0 at create time); fleet pve status warns when the live node is older. Informational for non-PVE providers.

Type: string

Default:

"9.0"

Example:

"9.0"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes`

Hypervisor members of this instance, as typed objects (mgmt_ip, placed machines). Complements cluster.nodes (names only); a name present in either counts as a member.

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.mgmt_ip`

Management/API address of this hypervisor node. Feeds derived scrape targets when the node is not provides-linked to a fleet VM.

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources`

Machines placed on this node.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc`

LXC containers placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm`

KVM/QEMU VMs placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.provides`

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.secrets`

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.nodes.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.pool`

XCP-ng pool info (master host, primary SR/network). Empty for non-XO providers.

Type: attribute set

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources`

Provider-scoped resources by kind — pools/acls/zones/checks per this provider’s kind map (v2-types.nix), plus lxc/vm.

Type: open submodule of attribute set of attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc`

Instance-scoped containers (single-node instances; multi-node clusters place under nodes.).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.provides`

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.secrets`

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm`

Instance-scoped VMs (XO VMs are pool-placed, so they belong here).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.provides`

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.secrets`

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.secrets`

Map of provider-config-key → SOPS path. Emitter resolves each to $${data.sops_file.secrets.data["<dotted-path>"]} so secrets never appear in config.tf.json.

Type: attribute set of string

Default:

{ }

Example:

{ api_token = "integrations/proxmox/api_token"; }

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.source`

Terraform provider source address (e.g. bpg/proxmox).

Type: string

Default: none (required when its feature is enabled)

Example:

"bpg/proxmox"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.state.prefix`

S3 key prefix for this instance’s tfstate(s). Full path: s3://///terraform.tfstate

Type: string

Default: none (required when its feature is enabled)

Example:

"proxmox-dev"

Declared by: nix/fleet/providers

`fleet.fleets.<name>.providers.<name>.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"0.66.3"

Declared by: nix/fleet/providers

`fleet.hostsRegistry`

{ hostName -> NixOS module function }. Consumed by nix/lib/default.nix mkHosts. Populated by each host file under nix/hosts/**/.

Type: attribute set of unspecified value

Default:

{ }

Example:

{
  app-db = { config, pkgs, helpers, ... }: {
    infra.data.postgresql.enable = true;
  };
}

Declared by: nix/fleet/hosts-registry.nix

`fleet.secrets`

Secret resources: { = { file; consumers?; instances. = { secrets.…; }; }; }. Machine secret facets lift here with consumers.hosts = [ that machine ]. Projections: sops.secrets on consuming hosts, the secrets catalog, env export.

Type: attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/v2-normalize.nix

`fleet.serviceAliasMap`

subdomain → fleet.compute key. Each alias resolves to that host’s internal IP in both dnsRecords and publicDnsRecords. Single source of truth for “which fleet host hosts which service” — also readable by external-DNS zone resources so public and internal record sets stay consistent.

Type: attribute set of string

Default:

{ }

Example:

{ grafana = "observe"; wiki = "docs-host"; }

Declared by: nix/fleet/dns

Keyboard shortcuts

fleetkit