Skip to content

Feature reference

Each feature is a sub-mold of FeaturesMold paired with a rune. The full cast visits features in the order below and deploys the ones whose is_active is true.

prepare and base are not features - they always run first.

Feature Rune Default Active when
DNS dns on (Blocky) mode != "none"
Users users on manage = true
Network security netsec on install = true
Shell profiles profiles on (root only) for_root or for_user
Cloudflare WARP warp off install = true
Zero Trust Tunnel zerotrust off install = true
Containers containers off install = true
Monitoring monitoring off install = true
HAProxy haproxy off install = true
Xray xray off install = true
Tor tor off install = true
Telemt telemt off install = true

Turning a default-on feature off is a one-line layer:

merge_features(BASE_FEATURES, {"dns": {"mode": "none"}, "profiles": {"for_root": False}})

Every page in this section documents the feature's behaviour, its configuration fields with defaults, and an inventory fragment to start from.