[General]
# Instance name can be used to distinguish between different instances using backend api.getInstanceName()
instanceName=

# set to true to allow using Trilium without authentication (makes sense for server build only, desktop build doesn't need password)
noAuthentication=false

# set to true to disable backups (e.g. because of limited space on server)
noBackup=false

[Network]
# host setting is relevant only for web deployments - set the host on which the server will listen
# host=0.0.0.0
# port setting is relevant only for web deployments, desktop builds run on a fixed port (changeable with TRILIUM_PORT environment variable)
port=8080
# true for TLS/SSL/HTTPS (secure), false for HTTP (insecure).
https=false
# path to certificate (run "bash bin/generate-cert.sh" to generate self-signed certificate). Relevant only if https=true
certPath=
keyPath=
# comma-separated list of the IPs the reverse proxy connects from (CIDR notation is permitted), used to read the real IPs of clients from X-Forwarded-For.
# expressjs shortcuts are supported: loopback(127.0.0.1/8, ::1/128), linklocal(169.254.0.0/16, fe80::/10), uniquelocal(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7)
# 'true' uses the leftmost IP in X-Forwarded-For, which clients can forge to get around the login rate limit unless the proxy overwrites the header.
trustedReverseProxy=false

# setting the CORS headers for cross-origin requests
# corsAllowOrigin='*'
# corsAllowMethods='GET,POST,PUT,DELETE,PATCH'
# corsAllowHeaders='Content-Type,Authorization'


[Session]
# Use this setting to set a custom value for the "Max-Age" Attribute of the session cookie.
# This controls how long your session will be valid, before it expires and you need to log in again, when you use the "Remember Me" option.
# Value needs to be entered in Seconds.
# Default value is 1814400 Seconds, which is 21 Days.
cookieMaxAge=1814400

[Sync]
#syncServerHost=
#syncServerTimeout=
#syncServerProxy=

[MultiFactorAuthentication]
# Set the base URL for OAuth/OpenID authentication
# This is the URL of the service that will be used to verify the user's identity
oauthBaseUrl=

# Set the client ID for OAuth/OpenID authentication
# This is the ID of the client that will be used to verify the user's identity
oauthClientId=

# Set the client secret for OAuth/OpenID authentication
# This is the secret of the client that will be used to verify the user's identity
oauthClientSecret=

# Set the issuer base URL for OAuth/OpenID authentication
# This is the base URL of the service that will be used to verify the user's identity
oauthIssuerBaseUrl=

# Set the issuer name for OAuth/OpenID authentication
# This is the name of the service that will be used to verify the user's identity
oauthIssuerName=

# Set the issuer icon for OAuth/OpenID authentication
# This is the icon of the service that will be used to verify the user's identity
oauthIssuerIcon=

# Timeout in milliseconds for OAuth/OpenID HTTP requests (discovery, token exchange, userinfo).
# The library default is 5000ms, which cold-start identity providers can exceed and cause a
# spurious "have to log in twice" experience. Raised here to 30000ms. Minimum accepted value is 500.
oauthHttpTimeout=30000

# Space-separated list of OIDC scopes requested at login. 'openid' is required and prepended
# automatically if omitted. Add 'offline_access' here if your provider needs it to issue a
# refresh token. Default: openid profile email
oauthScope=openid profile email

# How Trilium authenticates to the provider's token endpoint: client_secret_basic or
# client_secret_post. Leave empty to auto-detect (client_secret_post for GitLab and Google,
# client_secret_basic otherwise). Set client_secret_post if login fails with a
# WWW-Authenticate / invalid_client error and your credentials contain any of - _ . ! ~ * ' ( ),
# e.g. on a self-hosted GitLab. Must match the method your client is registered with.
oauthClientAuthMethod=

# The algorithm the provider signs ID tokens with, e.g. RS256, EdDSA or ES256. Leave empty to
# detect it from the provider's discovery document (RS256 is used whenever the provider offers it).
# Set this only if sign-in fails with "unexpected JWT alg received", which means the provider signs
# with an algorithm other than the one it advertises first.
oauthIdTokenSigningAlg=

[Security]
# Enable backend script execution. WARNING: Backend scripts have full server access including
# filesystem, network, and OS commands via require('child_process'). Only enable if you trust
# all users with admin-level access to the server.
# Frontend scripts are always allowed (they run in a sandboxed browser context).
# On desktop builds this is managed through the Security settings page instead of this file.
backendScriptingEnabled=false

# Enable the SQL console (allows raw SQL execution against the database)
sqlConsoleEnabled=false