System options
desktop.style
Section titled “desktop.style”The desktop’s overall look and feel, which GNOME is tuned towards: the
familiar arrangement of window controls, panel and app grid for someone
coming from Windows or macOS, or GNOME’s own GNOME.
Type: one of “Windows”, “macOS”, “GNOME”
Default:
"GNOME"Declared by:
disk.owners
Section titled “disk.owners”LUKS keyslot owners (the host’s normal users), consumed by just deploy.
Type: list of string
Default:
[ "nixos"]Declared by:
gnome.terminal
Section titled “gnome.terminal”The terminal emulator GNOME opens: GNOME Console (kgx) or Ghostty
(ghostty).
Type: one of “kgx”, “ghostty”
Default:
"kgx"Declared by:
localization.dates
Section titled “localization.dates”Locale for the calendar and clock (LC_TIME). This category also
decides the language of weekday and month names, so set it to an
English locale (e.g. en_GB) to keep the calendar English while
formats stays regional. Defaults to formats.
Type: null or string
Default:
config.localization.formatsExample:
"en_GB"Declared by:
localization.formats
Section titled “localization.formats”Locale for regional formatting — numbers, currency, paper size,
measurement, address and telephone conventions. Independent of
language; left null these follow language. The charset defaults to
UTF-8, so give the bare locale (e.g. de_CH).
Type: null or string
Default:
nullExample:
"de_CH"Declared by:
localization.keyboardLayouts
Section titled “localization.keyboardLayouts”Keyboard layouts, shared by the X server (and the login greeter), the
virtual console, and — through osConfig — each user’s desktop input
sources. A user may override their own layouts via user.keyboardLayouts.
Left empty the keyboard stays as NixOS configures it.
Type: list of string
Default:
[ ]Example:
[ "ch" "at"]Declared by:
localization.language
Section titled “localization.language”Locale for the interface and terminal language (LC_MESSAGES, set as
i18n.defaultLocale). Keep this English so command output and error
messages stay English. The charset defaults to UTF-8, so give the bare
locale (e.g. en_US).
Type: string
Default:
"en_US"Example:
"en_US"Declared by:
localization.timeZone
Section titled “localization.timeZone”System time zone (time.timeZone). Unlike the locale categories it is
not derived from language or formats, so it is set here directly;
left null the time zone stays as NixOS configures it (UTC).
Type: null or string
Default:
nullExample:
"Europe/Zurich"Declared by:
passwords.secrets
Section titled “passwords.secrets”sops file mapping each username to its password hash (from mkpasswd). A user it lists takes that hash as their hashedPasswordFile; entries for users not present on the host are ignored.
Type: null or absolute path
Default:
nullDeclared by:
wifi.secrets
Section titled “wifi.secrets”sops file with a wifi list; each entry becomes a NetworkManager connection
named after its SSID. Two entry shapes are supported:
WPA-PSK: { ssid, password } WPA-EAP: { ssid, eap, identity, password, anonymous_identity?, phase2_auth?, domain_suffix_match?, ca_cert? }
WPA-EAP servers are validated against the system CA trust store by default.
Set domain_suffix_match to the RADIUS server’s domain to additionally pin
it, or ca_cert (PEM contents) to validate against a specific CA instead of
the system store — needed when the server’s CA is not publicly trusted.
The secret is the only source of truth: a connection whose settings drifted from its entry is recreated, so changes made outside it do not survive.
Type: null or absolute path
Default:
nullDeclared by: