From 004c2ea4e1682bec2ec2fd5b8e53608b3c1ee5c6 Mon Sep 17 00:00:00 2001 From: Eric Rodrigues Pires Date: Fri, 17 Jul 2026 08:37:30 -0300 Subject: [PATCH] Update nix pins --- .tack/pins.lock.json | 12 +- book/src/advanced_options.md | 8 +- book/src/cli.md | 349 ++++++++++++++--------------------- book/src/nixos.md | 4 +- book/src/nixos_options.md | 32 ++++ justfile | 2 +- 6 files changed, 188 insertions(+), 219 deletions(-) diff --git a/.tack/pins.lock.json b/.tack/pins.lock.json index 7e7f721..fc075bb 100644 --- a/.tack/pins.lock.json +++ b/.tack/pins.lock.json @@ -3,16 +3,16 @@ "type": "github", "owner": "NixOS", "repo": "nixpkgs", - "rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee", - "narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=", - "lastModified": 1783915482 + "rev": "35d3407a3816f3b341d8cf1d60abaf2b7b8166ac", + "narHash": "sha256-BoYPdqk6jlKXy+DyUzyGV/CtRGfAhk2MmIgBhsemTGI=", + "lastModified": 1784115452 }, "rust-overlay": { "type": "github", "owner": "oxalica", "repo": "rust-overlay", - "rev": "a794b72f1297136a654424de0348d32e76a9f14e", - "narHash": "sha256-5Dk8H/H9fqjr7kS4MKqdBOzVsTK5r1/PMjC6eQuXd54=", - "lastModified": 1784004965 + "rev": "1f69c7203034a4a974d7a4eac0f19b54af30804d", + "narHash": "sha256-bvaxxdk7mmMQ88AuXQGTUtk+PcUujHpgxqpryqTWvTU=", + "lastModified": 1784216271 } } diff --git a/book/src/advanced_options.md b/book/src/advanced_options.md index 9ea29c7..a985fec 100644 --- a/book/src/advanced_options.md +++ b/book/src/advanced_options.md @@ -15,7 +15,7 @@ ssh -p 2222 -R my.tunnel:3000:localhost:2000 sandhole.com.br allowed-fingerprint This option forces proxied HTTP requests to be redirected to HTTPS. ```bash -ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br force-https +ssh -p 2222 -R website.com:80:localhost:8080 sandhole.com.br force-https ``` ## `host` @@ -23,7 +23,7 @@ ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br force-https This option tells Sandhole to modify the `Host` header in proxied HTTP requests to use the provided host. ```bash -ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br host=some.host +ssh -p 2222 -R website.com:80:localhost:8080 sandhole.com.br host=some.host ``` ## `http2` @@ -31,7 +31,7 @@ ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br host=some.host This option tells Sandhole to serve HTTP/2 instead of HTTP/1.1 for your service. This option only works over HTTPS, so you may want to also set `force-https`. ```bash -ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br http2 force-https +ssh -p 2222 -R website.com:80:localhost:8080 sandhole.com.br http2 force-https ``` ## `ip-allowlist` / `ip-blocklist` @@ -55,7 +55,7 @@ ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br pool=16 This option tells Sandhole that it should use your provided TLS backend. This guarantees that Sandhole cannot see unencrypted traffic. This option only works over HTTPS, so you may want to also set `force-https`. ```bash -ssh -p 2222 -R my.tunnel:80:localhost:8080 sandhole.com.br sni-proxy force-https +ssh -p 2222 -R website.com:80:localhost:8080 sandhole.com.br sni-proxy force-https ``` ## `tcp-alias` diff --git a/book/src/cli.md b/book/src/cli.md index 4e035b4..48c9ca6 100644 --- a/book/src/cli.md +++ b/book/src/cli.md @@ -4,92 +4,82 @@ Sandhole exposes several options, which you can see by running `sandhole --help` --- -
+
 Expose HTTP/SSH/TCP services through SSH port forwarding.
 
 Usage: sandhole [OPTIONS] <--domain <DOMAIN>|--no-domain|--completions <COMPLETIONS>>
 
-
 Options:
       --domain <DOMAIN>
           The root domain of the application
 
       --no-domain
           Whether to run Sandhole without a root domain.
-
+          
           This option disables subdomains.
 
       --completions <COMPLETIONS>
           Generate shell completions for Sandhole
-
+          
           [possible values: bash, elvish, fish, powershell, zsh]
 
       --domain-redirect <URL>
           Where to redirect requests to the root domain
-
+          
           [default: https://github.com/EpicEric/sandhole]
 
       --user-keys-directory <DIRECTORY>
-          Directory containing public keys of authorized users. Each file must
-          contain at least one key
-
+          Directory containing public keys of authorized users. Each file must contain at least one key
+          
           [default: ./deploy/user_keys/]
 
       --admin-keys-directory <DIRECTORY>
-          Directory containing public keys of admin users. Each file must contain
-          at least one key
-
+          Directory containing public keys of admin users. Each file must contain at least one key
+          
           [default: ./deploy/admin_keys/]
 
       --certificates-directory <DIRECTORY>
-          Directory containing SSL certificates and keys. Each sub-directory
-          inside of this one must contain a certificate chain in a fullchain.pem
-          file and its private key in a privkey.pem file
-
+          Directory containing SSL certificates and keys. Each sub-directory inside of this one must contain a certificate chain in a fullchain.pem file and its private key in a privkey.pem file
+          
           [default: ./deploy/certificates/]
 
       --acme-cache-directory <DIRECTORY>
-          Directory to use as a cache for Let's Encrypt's account and
-          certificates. This will automatically be created for you.
-
+          Directory to use as a cache for Let's Encrypt's account and certificates. This will automatically be created for you.
+          
           Note that this setting ignores the --disable-directory-creation flag.
-
+          
           [default: ./deploy/acme_cache/]
 
       --private-key-file <FILE>
-          File path to the server's secret key. If missing, it will be
-          created for you
-
+          File path to the server's secret key. If missing, it will be created for you
+          
           [default: ./deploy/server_keys/ssh]
 
       --disable-directory-creation
-          If set, disables automatic creation of the directories expected by the
-          application. This may result in application errors if the directories
-          are missing
+          If set, disables automatic creation of the directories expected by the application. This may result in application errors if the directories are missing
 
       --listen-address <ADDRESS>
           Address to listen for all client connections
-
+          
           [default: ::]
 
       --ssh-port <PORT>
           Port to listen for SSH connections
-
+          
           [default: 2222]
 
       --http-port <PORT>
           Port to listen for HTTP connections
-
+          
           [default: 80]
 
       --https-port <PORT>
           Port to listen for HTTPS connections
-
+          
           [default: 443]
 
       --connect-ssh-on-https-port
-          Allow connecting to SSH via the HTTPS port as well. This can be useful
-          in networks that block binding to other ports
+          Allow connecting to SSH via the HTTPS port as well. This can be useful in networks that block binding to other ports
 
       --force-https
           Always redirect HTTP requests to HTTPS
@@ -100,96 +90,80 @@ Expose HTTP/SSH/TCP services through SSH port forwarding.
       --disable-tcp-logs
           Disable sending TCP/proxy logs to clients
 
-      --acme-contact-email <EMAIL>
-          Contact e-mail to use with Let's Encrypt. If set, enables ACME for
-          HTTPS certificates.
+      --disable-udp-logs
+          Disable sending UDP logs to clients
 
-          By providing your e-mail, you agree to the Let's Encrypt Subscriber
-          Agreement.
+      --acme-contact-email <EMAIL>
+          Contact e-mail to use with Let's Encrypt. If set, enables ACME for HTTPS certificates.
+          
+          By providing your e-mail, you agree to the Let's Encrypt Subscriber Agreement.
 
       --acme-use-staging
-          Controls whether to use the staging directory for Let's Encrypt
-          certificates (default is production). Only set this option for testing
+          Controls whether to use the staging directory for Let's Encrypt certificates (default is production). Only set this option for testing
 
       --password-authentication-url <URL>
-          If set, defines a URL which password authentication requests will be
-          validated against. This is done by sending the following JSON payload
-          via a POST request:
-
+          If set, defines a URL which password authentication requests will be validated against. This is done by sending the following JSON payload via a POST request:
+          
           {"user": "...", "password": "...", "remote_address": "..."}
-
+          
           Any 2xx response indicates that the credentials are authorized.
 
       --bind-hostnames <POLICY>
           Policy on whether to allow binding specific hostnames.
-
+          
           Beware that this can lead to domain takeovers if misused!
 
           Possible values:
-          - all:   Allow any hostnames unconditionally, including the
-                   main domain
-          - cname: Allow any hostnames with a CNAME record pointing to
-                   the main domain
-          - txt:   Allow any hostnames with a TXT record containing a
-                   fingerprint, including the main domain
-          - none:  Don't allow user-provided hostnames, enforce
-                   subdomains
-
+          - all:   Allow any hostnames unconditionally, including the main domain
+          - cname: Allow any hostnames with a CNAME record pointing to the main domain
+          - txt:   Allow any hostnames with a TXT record containing a fingerprint, including the main domain
+          - none:  Don't allow user-provided hostnames, enforce subdomains
+          
           [default: txt]
 
       --load-balancing <STRATEGY>
-          Strategy for load-balancing when multiple services request the same
-          hostname/port.
-
-          By default, traffic towards matching hostnames/ports will be
-          load-balanced.
+          Strategy for load-balancing when multiple services request the same hostname/port.
+          
+          By default, traffic towards matching hostnames/ports will be load-balanced.
 
           Possible values:
           - allow:   Load-balance with all available handlers
-          - replace: Don't load-balance; When adding a new handler,
-                     replace the existing one
-          - deny:    Don't load-balance; Deny the new handler if
-                     there's an existing one
-
+          - replace: Don't load-balance; When adding a new handler, replace the existing one
+          - deny:    Don't load-balance; Deny the new handler if there's an existing one
+          
           [default: allow]
 
       --load-balancing-algorithm <ALGORITHM>
           Algorithm to use for service selection when load-balancing.
-
+          
           By default, traffic will be randomly distributed between services.
 
           Possible values:
           - random:      Choose randomly
           - round-robin: Round robin
           - ip-hash:     Choose based on IP hash
-
+          
           [default: random]
 
       --txt-record-prefix <PREFIX>
-          Prefix for TXT DNS records containing key fingerprints, for
-          authorization to bind under a specific domain.
-
+          Prefix for TXT DNS records containing key fingerprints, for authorization to bind under a specific domain.
+          
           In other words, valid records will be of the form:
-
+          
           TXT <PREFIX>.<DOMAIN> SHA256:...
-
+          
           [default: _sandhole]
 
       --allow-requested-subdomains
-          Allow user-requested subdomains. By default, subdomains are always
-          random
+          Allow user-requested subdomains. By default, subdomains are always random
 
       --allow-requested-ports
           Allow user-requested ports. By default, ports are always random
 
       --authenticate-any-key-as-user
-          Any non-admin key that authenticates will have user privileges,
-          being able to forward services. This effectively turns Sandhole
-          into a public reverse proxy.
-
-          ANYONE that can reach your server's SSH port will be able to
-          create new keys and proxy services under your instance. Be sure
-          that you know what you're doing before enabling this option.
+          Any non-admin key that authenticates will have user privileges, being able to forward services. This effectively turns Sandhole into a public reverse proxy.
+          
+          ANYONE that can reach your server's SSH port will be able to create new keys and proxy services under your instance. Be sure that you know what you're doing before enabling this option.
 
       --disable-http
           Disable all HTTP tunneling. By default, this is enabled globally
@@ -201,79 +175,63 @@ Expose HTTP/SSH/TCP services through SSH port forwarding.
           Disable SNI proxy tunneling. By default, this is enabled globally
 
       --disable-tcp
-          Disable all TCP port tunneling except HTTP. By default, this is
-          enabled globally
+          Disable all TCP port tunneling except HTTP. By default, this is enabled globally
+
+      --disable-udp
+          Disable all UDP port tunneling. By default, this is enabled globally
 
       --disable-aliasing
-          Disable all aliasing (i.e. local forwarding). By default, this is
-          enabled globally
+          Disable all aliasing (i.e. local forwarding). By default, this is enabled globally
 
       --disable-prometheus
-          Disable the admin-only alias for the Prometheus exporter. By default,
-          it is enabled
+          Disable the admin-only alias for the Prometheus exporter. By default, it is enabled
 
       --quota-per-user <MAX>
-          How many services can be exposed for a single user at once. Doesn't
-          apply to admin users.
-
-          Each user is distinguished by their key fingerprint or, in the case of
-          API logins, by their username.
-
+          How many services can be exposed for a single user at once. Doesn't apply to admin users.
+          
+          Each user is distinguished by their key fingerprint or, in the case of API logins, by their username.
+          
           By default, no limit is set.
 
       --rate-limit-per-user <RATE>
-          How many bytes per second a single user's services can transmit at
-          once. Doesn't apply to admin users.
-
-          Each user is distinguished by their key fingerprint or, in the case of
-          API logins, by their username.
-
-          By default, no rate limit is set. For better results, this should be a
-          multiple of `--buffer-size`.
+          How many bytes per second a single user's services can transmit at once. Doesn't apply to admin users.
+          
+          Each user is distinguished by their key fingerprint or, in the case of API logins, by their username.
+          
+          By default, no rate limit is set. For better results, this should be a multiple of `--buffer-size`.
 
       --random-subdomain-value <VALUE>
-          Set a U64 value for random subdomains for use in conjunction with
-          `--random-subdomain-seed` to allow binding to the same random address
-          between Sandhole restarts.
-
+          Set a U64 value for random subdomains for use in conjunction with `--random-subdomain-seed` to allow binding to the same random address between Sandhole restarts.
+          
           Beware that this can lead to collisions if misused!
-
-          If this and `--random-subdomain-value-file` are unset, defaults to a
-          random value.
+          
+          If this and `--random-subdomain-value-file` are unset, defaults to a random value.
 
       --random-subdomain-value-file <FILE>
-          Set a file containing a U64 value for random subdomains for use in
-          conjunction with `--random-subdomain-seed` to allow binding to the
-          same random address between Sandhole restarts.
-
+          Set a file containing a U64 value for random subdomains for use in conjunction with `--random-subdomain-seed` to allow binding to the same random address between Sandhole restarts.
+          
           Beware that this can lead to collisions if misused!
-
-          If this and `--random-subdomain-value` are unset, defaults to a random
-          value.
-
+          
+          If this and `--random-subdomain-value` are unset, defaults to a random value.
+          
           This option takes priority over `--random-subdomain-value`.
 
       --random-subdomain-seed <SEED>
-          Which value to seed with when generating random subdomains, for
-          determinism. This allows binding to the same random address until
-          Sandhole is restarted.
-
+          Which value to seed with when generating random subdomains, for determinism. This allows binding to the same random address until Sandhole is restarted.
+          
           Beware that this can lead to collisions if misused!
-
+          
           If unset, defaults to a random seed.
 
           Possible values:
-          - ip-and-user: From IP address, SSH user, and requested address.
-                         Recommended if unsure
+          - ip-and-user: From IP address, SSH user, and requested address. Recommended if unsure
           - user:        From SSH user and requested address
-          - fingerprint: From SSH user, key fingerprint, and requested
-                         address
-          - address:     From SSH connection socket (address + port) and
-                         requested address
+          - fingerprint: From SSH user, key fingerprint, and requested address
+          - address:     From SSH connection socket (address + port) and requested address
 
       --random-subdomain-length <LENGTH>
           The length of the string appended to the start of random subdomains
-
+          
           [default: 6]
 
       --random-subdomain-filter-profanities
@@ -281,12 +239,12 @@ Expose HTTP/SSH/TCP services through SSH port forwarding.
 
       --requested-domain-filter-profanities
           Prevents user-requested domains from containing profanities.
-
+          
           Beware that this can lead to false positives being blocked!
 
       --requested-subdomain-filter-profanities
           Prevents user-requested subdomains from containing profanities.
-
+          
           Beware that this can lead to false positives being blocked!
 
       --log-format <FORMAT>
@@ -296,162 +254,139 @@ Expose HTTP/SSH/TCP services through SSH port forwarding.
           - default: Default (compact, ANSI-formatted, single-line)
           - json:    JSON format
           - duper:   Duper format
-
+          
           [default: default]
 
       --ip-allowlist <CIDR>
-          Comma-separated list of IP networks to allow. Setting this will block
-          unknown IPs from connecting
+          Comma-separated list of IP networks to allow. Setting this will block unknown IPs from connecting
 
       --ip-blocklist <CIDR>
-          Comma-separated list of IP networks to block. Setting this will allow
-          unknown IPs to connect, unless --ip-allowlist is set
+          Comma-separated list of IP networks to block. Setting this will allow unknown IPs to connect, unless --ip-allowlist is set
 
       --buffer-size <SIZE>
           Size to use for bidirectional buffers.
-
+          
           A higher value will lead to higher memory consumption.
-
+          
           [default: 32768B]
 
       --pool-size <SIZE>
-          Maximum pool size for simultaneous connections per proxied service.
-          The maximum is 536870911.
-
-          A high value may cause disruption on services, while a low value may
-          lead to denial-of-service.
-
+          Maximum pool size for simultaneous connections per proxied service. The maximum is 536870911.
+          
+          A high value may cause disruption on services, while a low value may lead to denial-of-service.
+          
           [default: 65536]
 
       --pool-timeout <DURATION>
-          How long to wait for a connection to be available in the pool before
-          being timed out.
-
-          By default, connections are immediately timed out when the pool is
-          exhausted.
+          How long to wait for a connection to be available in the pool before being timed out.
+          
+          By default, connections are immediately timed out when the pool is exhausted.
 
       --http-pool-size <SIZE>
           Maximum size for each HTTP connection pool (per unique client).
-
-          Controls how many keep-alive HTTP connections are cached per unique
-          client. Lower values reduce memory usage, higher values improve
-          performance.
-
+          
+          Controls how many keep-alive HTTP connections are cached per unique client. Lower values reduce memory usage, higher values improve performance.
+          
           [default: 16]
 
       --http-pool-max-idle-time <DURATION>
           Maximum idle time for HTTP pooled connections.
-
+          
           Connections idle longer than this will be evicted from the pool.
-
+          
           [default: 60s]
 
       --http-pool-max-reuse <COUNT>
           Maximum number of times an HTTP connection can be reused.
-
-          Prevents connections with accumulated state from persisting
-          indefinitely.
-
+          
+          Prevents connections with accumulated state from persisting indefinitely.
+          
           [default: 1000]
 
       --max-simultaneous-connections-per-ip <SIZE>
-          Maximum number of simultaneous connections per IP to a proxied
-          service. The maximum is 65535.
-
-          A low value may lead to client side disruptions, while a high value
-          may lead to denial-of-service.
-
+          Maximum number of simultaneous connections per IP to a proxied service. The maximum is 65535.
+          
+          A low value may lead to client side disruptions, while a high value may lead to denial-of-service.
+          
           [default: 64]
 
       --channel-open-timeout <DURATION>
           How long to wait for SSH clients to confirm a forwarded channel open
-
+          
           [default: 15s]
 
       --ssh-keepalive-interval <DURATION>
-          How long to wait between each keepalive message that is sent to an
-          unresponsive SSH connection
-
+          How long to wait between each keepalive message that is sent to an unresponsive SSH connection
+          
           [default: 15s]
 
       --ssh-keepalive-max <VALUE>
-          How many keepalive messages are sent to an unresponsive SSH connection
-          before it is dropped.
-
+          How many keepalive messages are sent to an unresponsive SSH connection before it is dropped.
+          
           A value of zero disables timeouts.
-
-          The timeout is equal to this value plus one, times
-          `--ssh-keepalive-interval`.
-
+          
+          The timeout is equal to this value plus one, times `--ssh-keepalive-interval`.
+          
           [default: 3]
 
       --directory-poll-interval <DURATION>
           How long to poll certificates and keys directories for new changes.
-
+          
           A low value may consume too many resources on large file trees.
-
+          
           [default: 15s]
 
       --idle-connection-timeout <DURATION>
-          Grace period for dangling/unauthenticated connections before they are
-          forcefully disconnected.
-
+          Grace period for dangling/unauthenticated connections before they are forcefully disconnected.
+          
           A low value may cause valid connections to be erroneously removed.
-
+          
           [default: 2s]
 
       --unproxied-connection-timeout <DURATION>
-          Grace period for unauthenticated SSH connections after closing the
-          last proxy tunnel before they are forcefully disconnected.
-
-          A low value may cause valid proxy/tunnel connections to be erroneously
-          removed.
-
+          Grace period for unauthenticated SSH connections after closing the last proxy tunnel before they are forcefully disconnected.
+          
+          A low value may cause valid proxy/tunnel connections to be erroneously removed.
+          
           If unset, this defaults to the value set by --idle-connection-timeout
 
       --authentication-request-timeout <DURATION>
-          Time until a user+password authentication request is canceled. Any
-          timed out requests will not authenticate the user
-
+          Time until a user+password authentication request is canceled. Any timed out requests will not authenticate the user
+          
           [default: 5s]
 
       --http-request-timeout <DURATION>
           Time until an outgoing HTTP request is automatically canceled.
-
+          
           By default, outgoing requests are not terminated by Sandhole.
 
       --tcp-connection-timeout <DURATION>
-          How long until TCP connections (including Websockets and local
-          forwardings) are automatically garbage-collected.
-
+          How long until TCP connections (including Websockets and local forwardings) are automatically garbage-collected.
+          
           By default, these connections are not terminated by Sandhole.
 
       --disable-tcp-keepalive
-          Disable TCP keepalive on SSH, HTTP, HTTPS and TCP connections.
-          By default, it is enabled.
-
-          Disabling TCP keepalive may lead to "connection reset by peer"
-          errors on socket reuse.
+          Disable TCP keepalive on SSH, HTTP, HTTPS and TCP connections. By default, it is enabled.
+          
+          Disabling TCP keepalive may lead to "connection reset by peer" errors on socket reuse.
 
       --tcp-keepalive-time <DURATION>
           Time to send the first TCP keepalive probe after the set idle time.
-
+          
           Only applies when `--disable-tcp-keepalive` is unset.
-
+          
           [default: 20s]
 
       --tcp-keepalive-interval <DURATION>
-          Interval between TCP keepalive probes once `--tcp-keepalive-time`
-          has elapsed.
-
+          Interval between TCP keepalive probes once `--tcp-keepalive-time` has elapsed.
+          
           Only applies when `--disable-tcp-keepalive` is unset.
-
+          
           [default: 10s]
 
       --udp-timeout <DURATION>
-          How long until SSH channels from UDP sockets are automatically
-          garbage-collected
-
+          How long until SSH channels from UDP sockets are automatically garbage-collected
+          
           [default: 60s]
 
   -h, --help
diff --git a/book/src/nixos.md b/book/src/nixos.md
index 9456073..89024f7 100644
--- a/book/src/nixos.md
+++ b/book/src/nixos.md
@@ -1,6 +1,6 @@
 # NixOS
 
-Sandhole is available as a flake, containing an overlay and a NixOS service.
+Sandhole is available as a NixOS module, which runs it as a systemd service.
 
 ## Setup
 
@@ -267,10 +267,12 @@ In order to avoid re-building Sandhole for each update, you can use either of Sa
 
   nix.settings = {
     substituters = [
+      # ...
       "https://cache.eric.dev.br"
       "https://sandhole.cachix.org"
     ];
     trusted-public-keys = [
+      # ...
       "cache.eric.dev.br-1:szEyq5LCjxDCUHYSRaSFU5HdHmR7QlT+FRG3tB9QtpE="
       "sandhole.cachix.org-1:cZadr6kgjQcRvsr++Nv9kgtMOrbLahiZBpuI9WpIXvA="
     ];
diff --git a/book/src/nixos_options.md b/book/src/nixos_options.md
index 1f45391..6bbe26b 100644
--- a/book/src/nixos_options.md
+++ b/book/src/nixos_options.md
@@ -237,6 +237,38 @@ true
 
 
 
+## services\.sandhole\.settings\.disable-udp
+
+
+
+Disable all UDP port tunneling\. By default, this is enabled globally\.
+
+**Warning:** If this option is false or unset and ` services.sandhole.openFirewall ` is true,
+all unprivileged UDP ports (i\.e\. >= 1024) will be opened\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+
+```nix
+false
+```
+
+
+
+*Example:*
+
+```nix
+true
+```
+
+
+
 ## services\.sandhole\.settings\.domain
 
 
diff --git a/justfile b/justfile
index 22bc7f8..f0724dd 100644
--- a/justfile
+++ b/justfile
@@ -18,7 +18,7 @@ cli:
     echo "" >> book/src/cli.md
     echo "---" >> book/src/cli.md
     echo "" >> book/src/cli.md
-    cat result/cli.html >> book/src/cli.md
+    sed 's/class="terminal"/style="white-space:pre-wrap;word-break:keep-all;"/' result/cli.html >> book/src/cli.md
 
 nixos-docs:
     nix-build ./nix -A packages._docs
-- 
2.51.2