<?xml version="1.0" encoding="utf-8"?>
<refentry xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
xml:id="sec-conf-file"
version="5">
<refmeta>
<refentrytitle>nix.conf</refentrytitle>
<manvolnum>5</manvolnum>
<refmiscinfo class="source">Nix</refmiscinfo>
<refmiscinfo class="version"><xi:include href="../version.txt" parse="text"/></refmiscinfo>
</refmeta>
<refnamediv>
<refname>nix.conf</refname>
<refpurpose>Nix configuration file</refpurpose>
</refnamediv>
<refsection><title>Description</title>
<para>Nix reads settings from two configuration files:</para>
<itemizedlist>
<listitem>
<para>The system-wide configuration file
<filename><replaceable>sysconfdir</replaceable>/nix/nix.conf</filename>
(i.e. <filename>/etc/nix/nix.conf</filename> on most systems), or
<filename>$NIX_CONF_DIR/nix.conf</filename> if
<envar>NIX_CONF_DIR</envar> is set.</para>
</listitem>
<listitem>
<para>The user configuration file
<filename>$XDG_CONFIG_HOME/nix/nix.conf</filename>, or
<filename>~/.config/nix/nix.conf</filename> if
<envar>XDG_CONFIG_HOME</envar> is not set.</para>
</listitem>
</itemizedlist>
<para>The configuration files consist of
<literal><replaceable>name</replaceable> =
<replaceable>value</replaceable></literal> pairs, one per line. Other
files can be included with a line like <literal>include
<replaceable>path</replaceable></literal>, where
<replaceable>path</replaceable> is interpreted relative to the current
conf file and a missing file is an error unless
<literal>!include</literal> is used instead.
Comments start with a <literal>#</literal> character. Here is an
example configuration file:</para>
<programlisting>
keep-outputs = true # Nice for developers
keep-derivations = true # Idem
</programlisting>
<para>You can override settings on the command line using the
<option>--option</option> flag, e.g. <literal>--option keep-outputs
false</literal>.</para>
<para>The following settings are currently available:
<variablelist>
<varlistentry xml:id="conf-allowed-uris"><term><literal>allowed-uris</literal></term>
<listitem>
<para>A list of URI prefixes to which access is allowed in
restricted evaluation mode. For example, when set to
<literal>https://github.com/NixOS</literal>, builtin functions
such as <function>fetchGit</function> are allowed to access
<literal>https://github.com/NixOS/patchelf.git</literal>.</para>
</listitem>
</varlistentry>
<varlistentry xml:id="conf-allow-import-from-derivation"><term><literal>allow-import-from-derivation</literal></term>
<listitem><para>By default, Nix allows you to <function>import</function> from a derivation,
allowing building at evaluation time. With this option set to false, Nix will throw an error
when evaluating an expression that uses this feature, allowing users to ensure their evaluation
will not require any builds to take place.</para></listitem>
</varlistentry>
<varlistentry xml:id="conf-allow-new-privileges"><term><literal>allow-new-privileges</literal></term>
<listitem><para>(Linux-specific.) By default, builders on Linux
cannot acquire new privileges by calling setuid/setgid programs or
programs that have file capabilities. For example, programs such
as <command>sudo</command> or <command>ping</command> will
fail. (Note that in sandbox builds, no such programs are available
unless you bind-mount them into the sandbox via the
<option>sandbox-paths</option> option.) You can allow the
use of such programs by enabling this option. This is impure and
usually undesirable, but may be useful in certain scenarios
(e.g. to spin up containers or set up userspace network interfaces
in tests).</para></listitem>
</varlistentry>
<varlistentry xml:id="conf-allowed-users"><term><literal>allowed-users</literal></term>
<listitem>
<para>A list of names of users (separated by whitespace) that
are allowed to connect to the Nix daemon. As with the
<option>trusted-users</option> option, you can specify groups by
prefixing them with <literal>@</literal>. Also, you can allow
all users by specifying <literal>*</literal>. The default is
<literal>*</literal>.</para>
<para>Note that trusted users are always allowed to connect.</para>
</listitem>
</varlistentry>
<varlistentry xml:id="conf-auto-optimise-store"><term><literal>auto-optimise-store</literal></term>
<listitem><para>If set to <literal>true</literal>, Nix
automatically detects files in the store that have identical
contents, and replaces them with hard links to a single copy.
This saves disk