Configuration

Every setting reportd reads, by its path in the config file. A setting comes from, last one winning: its default, the config file (--config, $REPORTD_CONFIG or config.yaml), the settings an administrator saved (dataDir/settings.yaml), and the environment. Docker and compose says how variables are named and read; lists of objects and maps are set in the file only. Settings says which ones an administrator can change in the studio.

The defaults are what reportd runs with when nothing sets the setting. reportd init-config writes a starting file, and reportd config show --origin prints the settings a running reportd has, and where each came from.

Top level

Setting	Description
listen string, default 127.0.0.1:43123 REPORTD_LISTEN
publicURL string REPORTD_PUBLICURL	PublicURL is where people reach reportd (https://reports.example.com): exported documents' report() links point there, and rendered HTML's policy names its font route there. "" takes it from each request.
dataDir string, default data REPORTD_DATADIR
connections list of objects file only	Connection is an operator-defined data connection. DSNs and URLs are secret: references, per environment. Connections are always read-only.
licence string REPORTD_LICENCE	Licence is a licence's text block, or a secret: reference to it (secret:file:licence for Helm). It wins over a licence installed in the studio, through the API or with reportd licence install, which can't then change it (docs/operations/licence.md).
extensions map file only	Extensions maps an environment ("*" for every one) to the RFML extension namespaces (§23) its renders may run, written as the engine lists them in /v1/info features: "x-acme". An extension that isn't listed renders as a placeholder with ref/unknown-extension.

renderer

Renderer says where renderd is: started by reportd (Command, listening on Listen), one instance at URL, or several, which reportd spreads renders over (URLs, or Discover).

Setting	Description
renderer.command string REPORTD_RENDERER_COMMAND
renderer.listen string, default 127.0.0.1:43124 REPORTD_RENDERER_LISTEN
renderer.unix string REPORTD_RENDERER_UNIX
renderer.url string, default http://127.0.0.1:43124 REPORTD_RENDERER_URL	URL is the one renderd reportd sends renders to: the one it starts (Command), or another, such as a container beside it.
renderer.urls list of strings REPORTD_RENDERER_URLS	URLs are several instances, for compose or a fixed set of servers.
renderer.discover string REPORTD_RENDERER_DISCOVER	Discover "dns" looks DiscoverName (host:port, such as a Kubernetes headless Service) up every 5 seconds, and every address behind it is an instance.
renderer.discoverName string REPORTD_RENDERER_DISCOVERNAME	DiscoverName is the host:port discovery looks up, such as a Kubernetes headless Service: renderd.reports.svc:43124.
renderer.token string REPORTD_RENDERER_TOKEN	Token is a secret: reference to the token renderd on its own requires (renderd --token-file); reportd sends it to every instance.
renderer.workers number REPORTD_RENDERER_WORKERS	Workers is how many renders the renderd reportd starts (Command) runs at once; 0 uses one per processor.
renderer.queue number REPORTD_RENDERER_QUEUE	Queue is how many renders may wait for a worker there before it answers 503; 0 uses four for each worker.
renderer.maxBodyBytes number REPORTD_RENDERER_MAXBODYBYTES	MaxBodyBytes caps a request to it; 0 uses 256 MB.

templateStore

Setting	Description
templateStore.driver string, default file REPORTD_TEMPLATESTORE_DRIVER
templateStore.path string, default data/templates REPORTD_TEMPLATESTORE_PATH
templateStore.retentionDays number REPORTD_TEMPLATESTORE_RETENTIONDAYS	RetentionDays is how long a stored item is kept; 0 keeps it for ever.

reportStore

Setting	Description
reportStore.driver string, default file REPORTD_REPORTSTORE_DRIVER
reportStore.path string, default data/reports REPORTD_REPORTSTORE_PATH
reportStore.retentionDays number REPORTD_REPORTSTORE_RETENTIONDAYS	RetentionDays is how long a stored item is kept; 0 keeps it for ever.

sourceControl

Setting	Description
sourceControl.driver string, default git REPORTD_SOURCECONTROL_DRIVER
sourceControl.path string, default data/repo REPORTD_SOURCECONTROL_PATH
sourceControl.remote string REPORTD_SOURCECONTROL_REMOTE	Remote is the Git repository the environment branches are fetched from and pushed to; empty keeps them here only.
sourceControl.environments list of strings, default ["dev","test","uat","prod"] REPORTD_SOURCECONTROL_ENVIRONMENTS
sourceControl.promotion string, default commit REPORTD_SOURCECONTROL_PROMOTION
sourceControl.pushOnPublish boolean REPORTD_SOURCECONTROL_PUSHONPUBLISH	PushOnPublish pushes the environment branch to Remote after each publish.

mcp

Setting	Description
mcp.enabled boolean, default true REPORTD_MCP_ENABLED	Enabled serves the MCP server, through which agents read and edit reports with an agent key.
mcp.path string, default /mcp REPORTD_MCP_PATH
mcp.rateLimitPerMinute number, default 120 REPORTD_MCP_RATELIMITPERMINUTE	RateLimitPerMinute caps tool calls per principal; 0 is unlimited.

studio

Setting	Description
studio.bundle string, default vue REPORTD_STUDIO_BUNDLE
studio.dir string, default web/apps/designer/dist REPORTD_STUDIO_DIR

admin

Admin is the administrator reportd creates when its user store has no user of that name. Without a password, a reportd with no users starts in setup mode instead, and setup creates the administrator.

Setting	Description
admin.username string, default admin REPORTD_ADMIN_USERNAME
admin.password string REPORTD_ADMIN_PASSWORD	Password is the first password: a secret: reference ("secret:env:REPORTD_ADMIN_PASSWORD") or, on a workstation, a literal.
admin.mustChangePassword boolean REPORTD_ADMIN_MUSTCHANGEPASSWORD	MustChangePassword makes the administrator choose a new password at the first sign-in. Unset, it is true for a literal password and false for a secret: reference.

auth

Auth configures how people sign in.

Setting	Description
auth.passwords boolean REPORTD_AUTH_PASSWORDS	Passwords lets users sign in with a password; on unless false. With false only admin.username may, as the way back in (break-glass).
auth.oidc.providers list of objects file only	Providers are the OpenID Connect providers people may sign in through (docs/operations/sso.md): Entra ID, Okta, Google Workspace, Keycloak. Client secrets are secret: references; a literal is refused. OIDCProvider is one OpenID Connect provider (docs/operations/sso.md). Its redirect URL is <publicURL>/v1/auth/oidc/<id>/callback.
auth.oidc.providers[].id string file only	ID is [a-z0-9-], used in URLs and the audit log.
auth.oidc.providers[].name string file only	Name is the sign-in button's label.
auth.oidc.providers[].issuer string file only	Issuer is the provider's issuer URL, exactly as its ID tokens say.
auth.oidc.providers[].clientId string file only
auth.oidc.providers[].clientSecret string file only	ClientSecret is a secret: reference; a literal is refused.
auth.oidc.providers[].scopes list of strings file only	Scopes are asked for; openid is added if missing. Empty asks for openid, email and profile.
auth.oidc.providers[].allowedDomains list of strings file only	AllowedDomains, when set, are the only email domains (for Google Workspace, hd claims) that may sign in.
auth.oidc.providers[].trustEmail boolean file only	TrustEmail says the provider owns its users' addresses, so invites bind by email even without email_verified.
auth.oidc.providers[].jit boolean file only	JIT creates a user at their first sign-in.
auth.oidc.providers[].prompt string file only	Prompt, when set, is sent as the prompt parameter (login, select_account, consent).
auth.oidc.providers[].domainHint string file only	DomainHint, when set, is sent as hd (Google) or domain_hint (others), to skip the provider's account picker.
auth.oidc.providers[].roles.claim string file only	Claim holds the values: roles (Entra App Roles), groups (Okta).
auth.oidc.providers[].roles.rules list of objects file only	RoleRule gives Role in Environments to a user whose claim or attribute has Value.
auth.oidc.providers[].roles.rules[].value string file only
auth.oidc.providers[].roles.rules[].role string file only
auth.oidc.providers[].roles.rules[].environments list of strings file only
auth.oidc.providers[].roles.default list of objects file only	Default are the assignments of a user no rule matches. RoleGrant is a role in environments ("*" for all).
auth.oidc.providers[].roles.default[].role string file only
auth.oidc.providers[].roles.default[].environments list of strings file only
auth.saml.key string REPORTD_AUTH_SAML_KEY	Key is reportd's key pair as a service provider, for signing requests and decrypting assertions: a secret: reference to a PEM RSA private key and its certificate. Unset, reportd makes one and keeps it in <dataDir>/saml-sp.pem (mode 0600), which backups leave out.
auth.saml.providers list of objects file only	Providers are the SAML 2.0 identity providers people may sign in through, such as ADFS (docs/operations/sso.md). SAMLProvider is one SAML identity provider. Its metadata is at <publicURL>/v1/auth/saml/<id>/metadata and its assertion consumer service at <publicURL>/v1/auth/saml/<id>/acs.
auth.saml.providers[].id string file only	ID is [a-z0-9-], unique across auth.oidc and auth.saml.
auth.saml.providers[].name string file only	Name is the sign-in button's label.
auth.saml.providers[].metadataURL string file only	The IdP's metadata: exactly one of a URL (https, or http on a loopback host), a file, or the XML itself.
auth.saml.providers[].metadataFile string file only
auth.saml.providers[].metadata string file only
auth.saml.providers[].entityID string file only	EntityID is reportd's entity ID with this IdP; default <publicURL>/v1/auth/saml/<id>/metadata.
auth.saml.providers[].subject string file only	Subject is who signed in: "nameid" (the default) or "attribute:<name>".
auth.saml.providers[].attributes.email string file only
auth.saml.providers[].attributes.name string file only
auth.saml.providers[].allowedDomains list of strings file only	AllowedDomains, when set, are the only email domains that may sign in. The email counts only with TrustEmail.
auth.saml.providers[].trustEmail boolean file only	TrustEmail says the IdP owns its users' addresses, so invites bind by email. SAML has no email_verified; this is the only way.
auth.saml.providers[].jit boolean file only	JIT creates a user at their first sign-in.
auth.saml.providers[].forceAuthn boolean file only	ForceAuthn asks the IdP to sign the user in again.
auth.saml.providers[].nameIDFormat string file only	NameIDFormat, when set, asks the IdP for that NameID format (persistent, emailAddress or unspecified) in the request's NameIDPolicy. Unset, the request has none, and the IdP sends what it is set up to send.
auth.saml.providers[].signRequests boolean file only	SignRequests signs AuthnRequests; on unless false.
auth.saml.providers[].allowSHA1 boolean file only	AllowSHA1 accepts SHA-1 signatures, for an old ADFS.
auth.saml.providers[].roles.attribute string file only	Attribute holds the values: the role claim (Entra, ADFS), groups (Okta, Keycloak, Google Workspace).
auth.saml.providers[].roles.rules list of objects file only	RoleRule gives Role in Environments to a user whose claim or attribute has Value.
auth.saml.providers[].roles.rules[].value string file only
auth.saml.providers[].roles.rules[].role string file only
auth.saml.providers[].roles.rules[].environments list of strings file only
auth.saml.providers[].roles.default list of objects file only	Default are the assignments of a user no rule matches. RoleGrant is a role in environments ("*" for all).
auth.saml.providers[].roles.default[].role string file only
auth.saml.providers[].roles.default[].environments list of strings file only
auth.mfa string REPORTD_AUTH_MFA	MFA says who must have a second factor for password sign-in: "optional" (the default), "admins" (anyone who holds user.manage, and admin.username) or "required" (every password user).
auth.mfaKey string REPORTD_AUTH_MFAKEY	MFAKey seals the users' TOTP secrets: a secret: reference to at least 32 bytes. Unset, reportd makes a key and keeps it in <dataDir>/mfa.key (mode 0600), which backups leave out.
auth.sessions.lifetime duration REPORTD_AUTH_SESSIONS_LIFETIME	Lifetime is how long a session lasts from sign-in, whatever happens meanwhile (default 24h).
auth.sessions.idleTimeout duration REPORTD_AUTH_SESSIONS_IDLETIMEOUT	IdleTimeout, when set, ends a session that has had no request for this long (default 0: off). It is checked to the minute.

limits

Setting	Description
limits.maxBodyBytes number, default 20971520 REPORTD_LIMITS_MAXBODYBYTES	MaxBodyBytes caps a request's body (default 20 MB).
limits.timeoutSec number, default 30 REPORTD_LIMITS_TIMEOUTSEC	TimeoutSec bounds one request, and an engine call when engine.timeoutSec is 0 (default 30).
limits.rate map, default {"assistant":{"perMinute":30,"burst":10},"public":{"perMinute":300,"burst":100},"read":{"perMinute":1200,"burst":300},"render":{"perMinute":120,"burst":30},"signin":{"perMinute":60,"burst":20},"write":{"perMinute":900,"burst":120}} file only	Rate is each request class's rate per minute and burst (docs/operations/rate-limits.md). A class left out keeps its default (DefaultRates), and so does a burst left out; perMinute 0 turns a class off.
limits.rate.<name>.perMinute number file only
limits.rate.<name>.burst number file only

engine

Engine configures the client for renderd's /v1 API. The process itself is still started and addressed through Renderer.

Setting	Description
engine.timeoutSec number REPORTD_ENGINE_TIMEOUTSEC	TimeoutSec bounds one engine call; 0 uses Limits.TimeoutSec.
engine.minVersion string REPORTD_ENGINE_MINVERSION	MinVersion is the oldest engine version reportd accepts; empty accepts any.

rfml

RFML holds language settings passed to the engine.

Setting	Description
rfml.limits.expressionSteps number REPORTD_RFML_LIMITS_EXPRESSIONSTEPS	ExpressionSteps caps the steps expressions may take in one render; 0 keeps the engine's limit.
rfml.limits.nodes number REPORTD_RFML_LIMITS_NODES	Nodes caps the layout nodes of one render; 0 keeps the engine's limit.
rfml.limits.pages number REPORTD_RFML_LIMITS_PAGES	Pages caps the pages of one report; 0 keeps the engine's limit.
rfml.limits.timeMs number REPORTD_RFML_LIMITS_TIMEMS	TimeMs bounds one render's time; 0 keeps the engine's limit.
rfml.limits.dataBytes number REPORTD_RFML_LIMITS_DATABYTES	DataBytes caps the data one render reads; 0 keeps the engine's limit.
rfml.limits.imageMegapixels number REPORTD_RFML_LIMITS_IMAGEMEGAPIXELS	ImageMegapixels caps one image's size once decoded; 0 keeps the engine's limit.
rfml.limits.imageBytes number REPORTD_RFML_LIMITS_IMAGEBYTES	ImageBytes caps one image file; 0 keeps the engine's limit.
rfml.limits.subreportDepth number REPORTD_RFML_LIMITS_SUBREPORTDEPTH	SubreportDepth caps how deep subreports nest; 0 keeps the engine's limit.
rfml.limits.layoutPasses number REPORTD_RFML_LIMITS_LAYOUTPASSES	LayoutPasses caps the passes layout takes to settle page numbers and totals; 0 keeps the engine's limit.

agents

Agents is the policy for agent keys.

Setting	Description
agents.publish string, default approval REPORTD_AGENTS_PUBLISH	Publish is "allow", "approval" (a person approves each publish, promote and rollback an agent asks for) or "deny". Empty means "approval".
agents.liveData boolean REPORTD_AGENTS_LIVEDATA	LiveData lets agents preview against live sources; by default they see samples only.
agents.maxOpsPerMinute number, default 120 REPORTD_AGENTS_MAXOPSPERMINUTE	MaxOpsPerMinute rate-limits agent edit batches; 0 is unlimited.
agents.assistant.provider string REPORTD_AGENTS_ASSISTANT_PROVIDER	Provider is "" (off), "anthropic" (Claude, through the Anthropic Messages API), "http" (relay to URL, which answers newline-delimited JSON events) or "file" (the events in File, canned for demonstrations and tests).
agents.assistant.agent string, default assistant REPORTD_AGENTS_ASSISTANT_AGENT	Agent is the name accepted proposals are attributed to in the edit log, acting for the author. Default "assistant".
agents.assistant.url string REPORTD_AGENTS_ASSISTANT_URL	URL is the relay the http provider sends requests to.
agents.assistant.token string REPORTD_AGENTS_ASSISTANT_TOKEN	Token is a bearer token for URL, or a secret: reference to one.
agents.assistant.file string REPORTD_AGENTS_ASSISTANT_FILE
agents.assistant.apiKey string REPORTD_AGENTS_ASSISTANT_APIKEY	APIKey is the Anthropic API key as a secret: reference (secret:env:NAME or secret:file:NAME); a literal key is refused.
agents.assistant.model string REPORTD_AGENTS_ASSISTANT_MODEL	Model is the Claude model. Default claude-opus-5-5.
agents.assistant.baseURL string REPORTD_AGENTS_ASSISTANT_BASEURL	BaseURL replaces https://api.anthropic.com (a proxy or gateway that speaks the Messages API).
agents.assistant.workspaceId string REPORTD_AGENTS_ASSISTANT_WORKSPACEID	WorkspaceID is the Anthropic workspace (wrkspc_…) requests run in, sent as the anthropic-workspace-id header. Needed when the API key isn't scoped to a workspace; empty sends no header.
agents.assistant.maxTokens number REPORTD_AGENTS_ASSISTANT_MAXTOKENS	MaxTokens bounds one Claude response. Default 32000.
agents.assistant.effort string REPORTD_AGENTS_ASSISTANT_EFFORT	Effort is Claude's effort level (low, medium, high, xhigh, max); empty leaves the model's default.
agents.assistant.fallbacks string REPORTD_AGENTS_ASSISTANT_FALLBACKS	Fallbacks is "default" (a request Claude declines is served by Anthropic's fallback model), "off", or empty: on for the models that take it.
agents.assistant.timeoutSec number, default 120 REPORTD_AGENTS_ASSISTANT_TIMEOUTSEC	TimeoutSec bounds one request. Default 120.
agents.assistant.maxProposals number, default 20 REPORTD_AGENTS_ASSISTANT_MAXPROPOSALS	MaxProposals caps the proposals of one request. Default 20.

sync

Sync configures live co-editing through renderd sync.

Setting	Description
sync.enabled boolean REPORTD_SYNC_ENABLED
sync.url string REPORTD_SYNC_URL
sync.ticketTTLSec number REPORTD_SYNC_TICKETTTLSEC	TicketTTLSec is how long a WebSocket ticket is valid; 0 uses 60.

secrets

Secrets configures where secret: references are resolved.

Setting	Description
secrets.providers list of strings REPORTD_SECRETS_PROVIDERS	Providers enabled, from "env" and "file". Empty allows none.
secrets.dir string REPORTD_SECRETS_DIR	Dir is the directory file: references are read from.

data

Data is the policy for data sources at render time.

Setting	Description
data.suppliedData string, default allow REPORTD_DATA_SUPPLIEDDATA	SuppliedData is "allow" (the default): a caller with report.render may send data for a sourced dataset, and its source isn't called; or "deny": sourced datasets always come from their source or sample.
data.maxBytes number REPORTD_DATA_MAXBYTES	MaxBytes caps all live fetches of one render together; 0 uses rfml.limits.dataBytes, or the engine's default.
data.parallel number REPORTD_DATA_PARALLEL	Parallel is how many fetches of one render run at once; 0 uses 4.

viewer

Viewer configures the interactive report viewer (RFML §17.6): view sessions, which fetch a report's data once and render it again for each view state, and the signed links report() targets become. Zero values take the defaults named on each field.

Setting	Description
viewer.enabled boolean REPORTD_VIEWER_ENABLED	Enabled serves /v1/view/sessions and /l/{token}. Off by default.
viewer.sessionTTLSec number REPORTD_VIEWER_SESSIONTTLSEC	SessionTTLSec is how long a session lives without being used; its data is wiped then. 0 uses 1800.
viewer.maxBytes number REPORTD_VIEWER_MAXBYTES	MaxBytes caps one session's data; 0 uses 50 MB. It never exceeds the render data limit (rfml.limits.dataBytes, or the engine's).
viewer.memoryBytes number REPORTD_VIEWER_MEMORYBYTES	MemoryBytes is how much session data stays in memory, across sessions. Past it, the least recently used sessions' data is spilled to SpillDir, encrypted with a key that exists only in memory. 0 uses 256 MB.
viewer.maxTotalBytes number REPORTD_VIEWER_MAXTOTALBYTES	MaxTotalBytes caps the data of all sessions, in memory and spilled; new sessions are refused (503) past it. 0 uses 1 GB.
viewer.spillDir string REPORTD_VIEWER_SPILLDIR	SpillDir holds spilled session data; "" uses <dataDir>/viewer. It is emptied at start-up.
viewer.maxViewStateBytes number REPORTD_VIEWER_MAXVIEWSTATEBYTES	MaxViewStateBytes caps view state carried in the URL; 0 uses 8 KB.
viewer.viewStateParams boolean REPORTD_VIEWER_VIEWSTATEPARAMS	ViewStateParams lets view state carry parameter values (RFML §17.6.1 leaves it to the host). Off: parameters change only through setParams.
viewer.path string REPORTD_VIEWER_PATH	Path is where the viewer app shows a session, as Path + session id; "" uses /view/. GET /l/{token} redirects there.
viewer.signInPath string REPORTD_VIEWER_SIGNINPATH	SignInPath is the studio's sign-in page; "" uses /login. A browser that follows a link signed out is sent there with ?next=/l/<token>, and the studio returns it to that path after signing in.
viewer.dir string REPORTD_VIEWER_DIR	Dir holds the built viewer app (web/apps/viewer/dist), served at Path: its files, and index.html for any other path under it. "" uses web/apps/viewer/dist.
viewer.linkSecret string REPORTD_VIEWER_LINKSECRET	LinkSecret signs report() link tokens: a secret: reference to at least 32 bytes. Empty uses a key reportd makes on first start and keeps in <dataDir>/viewer-link.key (mode 0600). Backups leave that file out, like every secret.
viewer.linkTTLSec number REPORTD_VIEWER_LINKTTLSEC	LinkTTLSec is how long a link token is valid; 0 uses 7 days.

security

Security configures protections of the HTTP API.

Setting	Description
security.trustedOrigins list of strings REPORTD_SECURITY_TRUSTEDORIGINS	TrustedOrigins are other origins ("https://portal.example.com") whose pages may send state-changing requests with a user's session cookie. Same-origin requests and requests without browser headers always may.
security.trustedProxies list of strings REPORTD_SECURITY_TRUSTEDPROXIES	TrustedProxies are the proxies (CIDRs or single addresses) whose ClientAddressHeader names the client, and whose X-Forwarded-Proto says the client came over HTTPS. Empty: the client is the TCP peer.
security.clientAddressHeader string REPORTD_SECURITY_CLIENTADDRESSHEADER	ClientAddressHeader is X-Forwarded-For (empty), Forwarded or X-Real-IP.

logging

Logging configures reportd's log, written to standard error.

Setting	Description
logging.format string REPORTD_LOGGING_FORMAT	Format is "text" (key=value, the default) or "json" (one object a line).
logging.level string REPORTD_LOGGING_LEVEL	Level is the least severe level written: debug, info (the default), warn or error.
logging.access boolean REPORTD_LOGGING_ACCESS	Access logs each request (method, path, status, bytes, duration and request id); on unless false. Static files and health probes are logged at debug.

jobs

Jobs configures the batch-render queue (POST /v1/jobs). Zero (or less) takes the default.

Setting	Description
jobs.workers number REPORTD_JOBS_WORKERS	Workers is how many jobs render at once (default 2).
jobs.maxAttempts number REPORTD_JOBS_MAXATTEMPTS	MaxAttempts is how often a job is tried before a failure that may pass later (the engine down, a timeout, a 5xx) ends it (default 3).
jobs.retentionHours number REPORTD_JOBS_RETENTIONHOURS	RetentionHours is how long a finished job is kept (default 168). Its reports follow the report store's retentionDays instead.
jobs.queueTimeoutHours number REPORTD_JOBS_QUEUETIMEOUTHOURS	QueueTimeoutHours is how long a job may wait to start (default 24).
jobs.maxRuns number REPORTD_JOBS_MAXRUNS	MaxRuns caps the renders in one job (default 1000).
jobs.maxQueued number REPORTD_JOBS_MAXQUEUED	MaxQueued caps one owner's unfinished jobs (default 20).
jobs.webhooks.endpoints list of objects file only	WebhookEndpoint is one receiver of job callbacks.
jobs.webhooks.endpoints[].origin string file only	Origin is https://erp.example.com, https://*.example.com (subdomains) or http://host:8080; an entry without a scheme means https.
jobs.webhooks.endpoints[].secret string file only	Secret signs the deliveries: a secret: reference to a whsec_<base64> key (Standard Webhooks) or any other string, used as its bytes.
jobs.webhooks.endpoints[].allowPrivate boolean file only	AllowPrivate lets deliveries reach loopback, private and link-local addresses, for a receiver inside the network.
jobs.webhooks.maxAttempts number REPORTD_JOBS_WEBHOOKS_MAXATTEMPTS	MaxAttempts is how often a delivery is tried before it fails (default 6).
jobs.webhooks.timeoutSec number REPORTD_JOBS_WEBHOOKS_TIMEOUTSEC	TimeoutSec bounds one delivery (default 10).

migrations

Migrations configures how reportd upgrades its stored data to a newer format.

Setting	Description
migrations.auto boolean REPORTD_MIGRATIONS_AUTO	Auto (the default) migrates at start, after writing a backup to dataDir/backups/. With false, reportd refuses to start until reportd migrate has run.

trash

Trash configures the trash that deleted templates and folders go to (docs/operations/trash.md).

Setting	Description
trash.retentionDays number REPORTD_TRASH_RETENTIONDAYS	RetentionDays is how long an item is kept before it is purged (default 30). 0 keeps items until they're purged by hand.

audit

Audit configures the audit log's rotation and retention, and Usage the usage records and daily totals (docs/operations/admin.md).

Setting	Description
audit.maxSizeMB number REPORTD_AUDIT_MAXSIZEMB	MaxSizeMB is the size at which the log is rotated (default 64).
audit.retentionDays number REPORTD_AUDIT_RETENTIONDAYS	RetentionDays is how long rotated logs, and the shared state's events, are kept. 0 (the default) keeps them for ever.

usage

Usage configures what is counted of renders, jobs, webhooks, sign-ins and requests: a record of each, and each UTC day's totals.

Setting	Description
usage.detailDays number REPORTD_USAGE_DETAILDAYS	DetailDays is how long the records are kept (default 7).
usage.retentionDays number REPORTD_USAGE_RETENTIONDAYS	RetentionDays is how long the daily totals are kept. 0 (the default) keeps them for ever.

state

State is where users, keys, sessions and the short-lived sign-in state are kept (docs/operations/state.md).

Setting	Description
state.driver string, default file REPORTD_STATE_DRIVER	Driver is "file" (the default: auth.json in dataDir, the rest in memory) or "postgres", which several reportd nodes can share.
state.postgres.url string REPORTD_STATE_POSTGRES_URL	URL is a secret: reference to the connection URL; a literal is refused, since it holds the database's password.
state.postgres.schema string, default reportd REPORTD_STATE_POSTGRES_SCHEMA	Schema holds reportd's tables (default reportd).
state.postgres.maxConns number, default 10 REPORTD_STATE_POSTGRES_MAXCONNS	MaxConns caps the pool (default 10).

tests

Tests configures documents' embedded tests (RFML §20).

Setting	Description
tests.publishGate string, default block REPORTD_TESTS_PUBLISHGATE	PublishGate is "block" (the default: a failing test, or a snapshot that differs from its approved baseline, blocks the publish), "warn" (publish goes ahead and the reply lists the failures) or "off" (tests don't run at publish).

assets

Assets configures remote assets (RFML §25.3).

Setting	Description
assets.remote map file only	Remote maps an environment to its remote-asset policy. Remote assets are fetched only at publish, only in environments listed here, and stored in the bundle under assets/remote/ so renders never fetch. RemoteAssets is one environment's remote-asset policy.
assets.remote.<name>.allow list of strings file only	Allow lists the origins assets may come from: https://cdn.example.com, https://*.example.com (subdomains), http://host:8080. An entry without a scheme means https.
assets.remote.<name>.maxBytes number file only	MaxBytes caps one asset; 0 uses 10 MB.
assets.remote.<name>.maxTotalBytes number file only	MaxTotalBytes caps every asset of one publish together; 0 uses 32 MB.
assets.remote.<name>.timeoutSec number file only	TimeoutSec bounds one fetch; 0 uses 20.
assets.remote.<name>.allowPrivate boolean file only	AllowPrivate lets fetches reach loopback, private and link-local addresses. Leave it off unless the asset host is inside the network.

examples

Examples is the example gallery people copy reports from.

Setting	Description
examples.gallery string, default https://raw.githubusercontent.com/frontforge-corporation/report-server-releases/main/gallery/ REPORTD_EXAMPLES_GALLERY	Gallery is where the gallery is read: DefaultGallery, another http(s) address of a published gallery, a local folder holding one (for a machine without internet access) or the repository's examples/, or "off".

updates

Updates is the version check (docs/operations/updates.md).

Setting	Description
updates.check boolean, default true REPORTD_UPDATES_CHECK	Check asks updates.releases for the latest release once a day, and the studio tells administrators when it is newer. On by default.
updates.releases string, default https://api.github.com/repos/frontforge-corporation/report-server-releases/releases/latest REPORTD_UPDATES_RELEASES	Releases is the address it asks: by default GitHub's API for the public repository, or another that answers as GitHub's latest-release API does.