System options

claude.convertDocuments

Whether Claude Code converts documents to text before reading them, instead of reading a PDF page by page as images or failing on an Office file. The converters are installed alongside, every session is told about them, and a read of such a file, through the Read tool or through a plain shell reader such as cat, is redirected to the matching one:

• PDF: pdftotext in layout mode, which keeps columns aligned and punctuation intact where MarkItDown drops it
• Word, Excel, PowerPoint, EPUB and Outlook messages: markitdown, as Markdown

A document is recognised by its file extension alone. The policy is delivered machine-wide and carries nothing but these hooks; personal settings, hooks and permissions stay in the user’s hands.

Type: boolean

Default:

true

Declared by:

• system/software/shared/claude-code.nix

desktop.style

The desktop’s overall look and feel, which GNOME is tuned towards: the familiar arrangement of window controls, panel and app grid for someone coming from Windows or macOS, or GNOME’s own GNOME. The other desktops come as they ship and leave this setting aside.

Type: one of “Windows”, “macOS”, “GNOME”

Default:

"GNOME"

Declared by:

• system/desktop/workstation.nix

disk.owners

LUKS keyslot owners (the host’s normal users), consumed by just deploy.

Type: list of string

Default:

[
  "nixos"
]

Declared by:

• system/base/disks.nix

gnome.terminal

The terminal emulator GNOME opens: GNOME Console (kgx) or Ghostty (ghostty).

Type: one of “kgx”, “ghostty”

Default:

"kgx"

Declared by:

• system/desktop/gnome

localization.dates

Locale for the calendar and clock (LC_TIME). This category also decides the language of weekday and month names, so set it to an English locale (e.g. en_GB) to keep the calendar English while formats stays regional. Defaults to formats.

Type: null or string

Default:

config.localization.formats

Example:

"en_GB"

Declared by:

• system/base/localization.nix

localization.formats

Locale for regional formatting — numbers, currency, paper size, measurement, address and telephone conventions. Independent of language; left null these follow language. The charset defaults to UTF-8, so give the bare locale (e.g. de_CH).

Type: null or string

Default:

null

Example:

"de_CH"

Declared by:

• system/base/localization.nix

localization.keyboardLayouts

Keyboard layouts, shared by the X server (and the login greeter), the virtual console, and — through osConfig — each user’s desktop input sources. A user may override their own layouts via user.keyboardLayouts. Left empty the keyboard stays as NixOS configures it.

Type: list of string

Default:

[ ]

Example:

[
  "ch"
  "at"
]

Declared by:

• system/base/localization.nix

localization.language

Locale for the interface and terminal language (LC_MESSAGES, set as i18n.defaultLocale). Keep this English so command output and error messages stay English. The charset defaults to UTF-8, so give the bare locale (e.g. en_US).

Type: string

Default:

"en_US"

Example:

"en_US"

Declared by:

• system/base/localization.nix

localization.timeZone

System time zone (time.timeZone). Unlike the locale categories it is not derived from language or formats, so it is set here directly; left null the time zone stays as NixOS configures it (UTC).

Type: null or string

Default:

null

Example:

"Europe/Zurich"

Declared by:

• system/base/localization.nix

office.enable

Whether to enable the applications of the chosen desktop, which the office concept switches on.

Type: boolean

Default:

false

Example:

true

Declared by:

• system/software/office.nix

passwords.secrets

sops file mapping each username to its password hash (from mkpasswd). A user it lists takes that hash as their hashedPasswordFile; entries for users not present on the host are ignored.

Type: null or absolute path

Default:

null

Declared by:

• system/base/passwords.nix

wifi.secrets

sops file with a wifi list; each entry becomes a NetworkManager connection named after its SSID. Two entry shapes are supported:

WPA-PSK: { ssid, password } WPA-EAP: { ssid, eap, identity, password, anonymous_identity?, phase2_auth?, domain_suffix_match?, ca_cert? }

WPA-EAP servers are validated against the system CA trust store by default. Set domain_suffix_match to the RADIUS server’s domain to additionally pin it, or ca_cert (PEM contents) to validate against a specific CA instead of the system store — needed when the server’s CA is not publicly trusted.

The secret is the only source of truth: a connection whose settings drifted from its entry is recreated, so changes made outside it do not survive.

Type: null or absolute path

Default:

null

Declared by:

• system/base/wifi.nix