/usr/bin/homectl

> homectl [OPTION…] COMMAND …

Create, manipulate or inspect home directories.

Basic User Manipulation Commands:
  [list]                   List home areas
  inspect USER…            Inspect a home area
  create USER              Create a home area
  update USER              Update a home area
  passwd USER              Change password of a home area
  resize USER SIZE         Resize a home area
  remove USER…             Remove a home area

Advanced User Manipulation Commands:
  activate USER…           Activate a home area
  deactivate USER…         Deactivate a home area
  deactivate-all           Deactivate all active home areas
  with USER [COMMAND…]     Run shell or command with access to a home area
  authenticate USER…       Authenticate a home area

User Migration Commands:
  adopt PATH…              Add an existing home area on this system
  register PATH…           Register a user record locally
  unregister USER…         Unregister a user record locally

Signing Keys Commands:
  list-signing-keys        List home signing keys
  get-signing-key [NAME…]  Get a named home signing key
  add-signing-key FILE…    Add home signing key
  remove-signing-key NAME… Remove home signing key

Lock/Unlock Commands:
  lock USER…               Temporarily lock an active home area
  unlock USER…             Unlock a temporarily locked home area
  lock-all                 Lock all suitable home areas

Other Commands:
  rebalance                Rebalance free space between home areas
  firstboot                Run first-boot home area creation wizard

Options:
  -h --help                              Show this help
     --version                           Show package version
     --offline                           Don't update record embedded in home directory
  -H --host=[USER@]HOST                  Operate on remote host
  -M --machine=CONTAINER                 Operate on local container
  -I --identity=PATH                     Read JSON identity from file
     --json=FORMAT                       Generate JSON output (pretty, short, or off)
  -j                                     Equivalent to --json=pretty (on TTY) or --json=short
                                         (otherwise)
     --export-format=FORMAT              Strip JSON inspection data (full, stripped, minimal)
  -E                                     Same as -j --export-format=stripped
  -EE                                    Same as -j --export-format=minimal
     --key-name=NAME                     Key name when adding a signing key
     --seize=BOOL                        Whether to strip existing signatures of user record when
                                         creating
     --prompt-new-user                   firstboot: Query user interactively for user to create
     --prompt-groups=BOOL                In first-boot mode, don't prompt for auxiliary group
                                         memberships
     --prompt-shell=BOOL                 In first-boot mode, don't prompt for shells
     --chrome=BOOL                       In first-boot mode, don't show colour bar at top and bottom
                                         of terminal
     --mute-console=BOOL                 In first-boot mode, tell kernel/PID 1 to not write to the
                                         console while running
     --no-pager                          Do not start a pager
     --no-legend                         Do not show headers and footers
     --no-ask-password                   Do not prompt for password

General User Record Properties:
  -c --real-name=REALNAME                Real name for user
     --realm=REALM                       Realm to create user in
     --alias=ALIAS                       Define alias usernames for this account
     --email-address=EMAIL               Email address for user
     --location=LOCATION                 Set location of user on earth
     --birth-date[=DATE]                 Set user birth date (YYYY-MM-DD)
     --icon-name=NAME                    Icon name for user
  -d --home-dir=PATH                     Home directory
  -u --uid=UID                           Numeric UID for user
  -G --member-of=GROUP                   Add user to group
     --capability-bounding-set=CAPS      Bounding POSIX capability set
     --capability-ambient-set=CAPS       Ambient POSIX capability set
     --access-mode=MODE                  User home directory access mode
     --umask=MODE                        Umask for user when logging in
  -k --skel=PATH                         Skeleton directory to use
  -s --shell=PATH                        Shell for account
     --setenv=VARIABLE[=VALUE]           Set an environment variable at log-in
     --timezone=TIMEZONE                 Set a time-zone
     --language=LOCALE                   Set preferred languages
     --default-area=AREA                 Select default area

Authentication User Record Properties:
     --ssh-authorized-keys=KEYS          Specify SSH public keys
     --pkcs11-token-uri=URI              URI to PKCS#11 security token containing private key and
                                         matching X.509 certificate
     --fido2-device=PATH                 Path to FIDO2 hidraw device with hmac-secret extension
     --fido2-with-client-pin=BOOL        Whether to require entering a PIN to unlock the account
     --fido2-with-user-presence=BOOL     Whether to require user presence to unlock the account
     --fido2-with-user-verification=BOOL Whether to require user verification to unlock the account
     --recovery-key=BOOL                 Add a recovery key
     --recovery-key-file=PATH            Write the generated recovery key to a file

Blob Directory User Record Properties:
  -b --blob=[FILENAME=]PATH              Path to a replacement blob directory, or replace an
                                         individual files in the blob directory
     --avatar=PATH                       Path to user avatar picture
     --login-background=PATH             Path to user login background picture

Account Management User Record Properties:
     --locked=BOOL                       Set locked account state
     --not-before=TIMESTAMP              Do not allow logins before
     --not-after=TIMESTAMP               Do not allow logins after
     --rate-limit-interval=SECS          Login rate-limit interval in seconds
     --rate-limit-burst=NUMBER           Login rate-limit attempts per interval

Password Policy User Record Properties:
     --password-hint=HINT                Set Password hint
     --enforce-password-policy=BOOL      Control whether to enforce system's password policy for
                                         this user
  -P                                     Same as --enforce-password-policy=no
     --password-change-now=BOOL          Require the password to be changed on next login
     --password-change-min=TIME          Require minimum time between password changes
     --password-change-max=TIME          Require maximum time between password changes
     --password-change-warn=TIME         How much time to warn before password expiry
     --password-change-inactive=TIME     How much time to block password after expiry

Resource Management User Record Properties:
     --disk-size=BYTES                   Size to assign the user on disk
     --nice=NICE                         Nice level for user
     --rlimit=LIMIT=VALUE[:VALUE]        Set resource limits
     --tasks-max=MAX                     Set maximum number of per-user tasks
     --memory-high=BYTES                 Set high memory threshold in bytes
     --memory-max=BYTES                  Set maximum memory limit
     --cpu-weight=WEIGHT                 Set CPU weight
     --io-weight=WEIGHT                  Set IO weight
     --tmp-limit=BYTES|PERCENT           Set limit on /tmp/
     --dev-shm-limit=BYTES|PERCENT       Set limit on /dev/shm/

Storage User Record Properties:
     --storage=STORAGE                   Storage type to use (luks, fscrypt, directory, subvolume,
                                         cifs)
     --image-path=PATH                   Path to image file/directory
     --drop-caches=BOOL                  Whether to automatically drop caches on logout

LUKS Storage User Record Properties:
     --fs-type=TYPE                      File system type to use in case of luks storage (btrfs,
                                         ext4, xfs)
     --luks-discard=BOOL                 Whether to use 'discard' feature of file system when
                                         activated (mounted)
     --luks-offline-discard=BOOL         Whether to trim file on logout
     --luks-cipher=CIPHER                Cipher to use for LUKS encryption
     --luks-cipher-mode=MODE             Cipher mode to use for LUKS encryption
     --luks-volume-key-size=BITS         Volume key size to use for LUKS encryption
     --luks-pbkdf-type=TYPE              Password-based Key Derivation Function to use
     --luks-pbkdf-hash-algorithm=ALG     PBKDF hash algorithm to use
     --luks-pbkdf-time-cost=SECS         Time cost for PBKDF in seconds
     --luks-pbkdf-memory-cost=BYTES      Memory cost for PBKDF in bytes
     --luks-pbkdf-parallel-threads=N     Number of parallel threads for PKBDF
     --luks-sector-size=BYTES            Sector size for LUKS encryption in bytes
     --luks-extra-mount-options=…        LUKS extra mount options
     --auto-resize-mode=MODE             Automatically grow/shrink home on login/logout
     --rebalance-weight=WEIGHT           Weight while rebalancing

Mounting User Record Properties:
     --nosuid=BOOL                       Control the 'nosuid' flag of the home mount
     --nodev=BOOL                        Control the 'nodev' flag of the home mount
     --noexec=BOOL                       Control the 'noexec' flag of the home mount

CIFS User Record Properties:
     --cifs-domain=DOMAIN                CIFS (Windows) domain
     --cifs-user-name=USER               CIFS (Windows) user name
     --cifs-service=SERVICE              CIFS (Windows) service to mount as home area
     --cifs-extra-mount-options=…        CIFS (Windows) extra mount options

Login Behaviour User Record Properties:
     --stop-delay=SECS                   How long to leave user services running after logout
     --kill-processes=BOOL               Whether to kill user processes when sessions terminate
     --auto-login=BOOL                   Try to log this user in automatically
     --session-launcher=LAUNCHER         Preferred session launcher file
     --session-type=TYPE                 Preferred session type

See the homectl(1) man page for details.