Skip to main content
config.yaml is the operator-managed configuration source.

​
Application and paths

  • app.name, app.version, app.dashboard_url
  • app.environment: development or production
  • paths.docker_compose and paths.docker_compose_dev
  • generated environment, DNS secret, Traefik, storage, log, campaign, and certificate paths
Relative paths resolve from the repository root.

​
Docker

docker.images defines each image’s tag, build context, enabled state, and either one Dockerfile or optional architecture-specific Dockerfiles. The shipped Selkies image uses one multi-architecture Dockerfile. docker.compose_images lists images built by Compose. docker.socket and docker.timeout configure host tooling.

​
TLS and DNS

ssl.auto_generate controls local certificate provisioning. Certificate identity fields and validity_days apply to generated local certificates. The shipped configuration uses placeholders for certificate identity. Replace them before running setup when automatic local certificate generation is enabled:
In production, also set ssl.acme_email to an operator-controlled address for ACME certificate notifications. Do not use a maintainer’s personal address. ssl.dns_challenge contains:
  • provider: Traefik/lego provider name;
  • credentials: required secret variable names;
  • environment: non-secret provider variables.
For production deployments, replace the shipped placeholders before running setup:
credentials must contain the environment-variable names required by the selected provider, not their values. During setup, the CLI securely prompts for those values and stores them as separate local secret files. See Traefik’s ACME DNS challenge provider reference for supported provider names and required environment variables. Credential values must not be stored in config.yaml.

​
Administration and sessions

admin defines the bootstrap username/email and admin session limits. sessions defines active-session capacity, token TTL, startup/handshake timeouts, and admission rate limits.

​
Networks, cleanup, and CLI

network controls IP detection and named Docker networks. containers defines application naming patterns. cleanup defines policy defaults. cli.confirm_destructive controls confirmation prompts; keep it enabled for interactive deployments. Run python3 p-bitm.py setup after changing values that generate runtime state.
Last modified on September 10, 2026