Application Configuration

Learn how to tune and customize AllSafeX settings via config.yml, environment variables, and public endpoint parameters.

Section: Configuration Config path: /opt/allsafex/config/config.yml

Configuration Architecture

AllSafeX reads its runtime parameters from two locations:

Environment variables: Set in .env and read by Docker Compose for container-level variables (e.g. database passwords).
Application configuration file: Stored in /opt/allsafex/config/config.yml for application-level parameters (e.g. token timeouts, SMTP, and proxy ports).

The config.yml File

Below is a production-grade config.yml template:

# AllSafeX Production Configuration
version: 1.0

# Security and Secret Keys
SECRET_KEY: "${SECRET_KEY}"
BOOTSTRAP_TOKEN: "${BOOTSTRAP_TOKEN}"

# Public Domain and Endpoints
SITE_URL: "https://pam.company.com"
SSH_PUBLIC_HOST: "pam.company.com"
SSH_PUBLIC_PORT: 2222

# Session Security Parameters
SESSION_COOKIE_AGE: 86400           # 24 hours in seconds
TOKEN_EXPIRATION_TIME: 3600         # Temporary token expiry (1 hour)
MAX_IDLE_TIMEOUT: 1800              # Terminate idle sessions after 30 min

# Password and Account Policies
SECURITY_PASSWORD_MIN_LENGTH: 12
SECURITY_MFA_AUTH: true             # Enforce MFA for all users
SECURITY_MAX_LOGIN_ATTEMPTS: 5      # Lock account after 5 failed attempts
SECURITY_LOCKOUT_DURATION: 900      # 15 minutes lockout

# Audit Recording Storage
TERMINAL_LOG_STORAGE: "/opt/allsafex/data/recordings"
RECORDING_COMPRESSION: "gzip"

Database Settings

Configure the PostgreSQL connection string inside config.yml or environment variables:

DB_ENGINE: "postgresql"
DB_HOST: "postgres"
DB_PORT: 5432
DB_NAME: "allsafex"
DB_USER: "allsafex"
DB_PASSWORD: "${DB_PASSWORD}"
DB_CONN_MAX_AGE: 60                 # Enable persistent connections (seconds)

Redis & Cache Tuning

Redis handles active session state, Celery worker task queues, and token cache:

REDIS_HOST: "redis"
REDIS_PORT: 6379
REDIS_PASSWORD: ""                  # Set if Redis authentication is enabled
REDIS_DB_CACHE: 1
REDIS_DB_BROKER: 2

SMTP Alert Notifications

To enable email password resets and high-risk command security alerts, configure an SMTP relay:

EMAIL_ENABLED: true
EMAIL_HOST: "smtp.mailgun.org"
EMAIL_PORT: 587
EMAIL_USE_TLS: true
EMAIL_HOST_USER: "postmaster@pam.company.com"
EMAIL_HOST_PASSWORD: "your-smtp-password"
EMAIL_SUBJECT_PREFIX: "[AllSafeX Security] "

Applying Configuration Changes

After modifying config.yml, restart the dependent backend containers:

cd /opt/allsafex
docker compose restart core gateway web