> ## Documentation Index
> Fetch the complete documentation index at: https://p-bitm-2269ecee.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration reference

> Reference for the operator-managed config.yaml contract.

`config.yaml` is the operator-managed configuration source.

## Application and paths

* `app.name`, `app.version`, `app.dashboard_url`
* `app.environment`: `development` or `production`
* `paths.docker_compose` and `paths.docker_compose_dev`
* generated environment, DNS secret, Traefik, storage, log, campaign, and
  certificate paths

Relative paths resolve from the repository root.

## Docker

`docker.images` defines each image's tag, build context, enabled state, and
either one Dockerfile or optional architecture-specific Dockerfiles. The
shipped Selkies image uses one multi-architecture Dockerfile.
`docker.compose_images` lists images built by Compose. `docker.socket` and
`docker.timeout` configure host tooling.

## TLS and DNS

`ssl.auto_generate` controls local certificate provisioning. Certificate
identity fields and `validity_days` apply to generated local certificates.

The shipped configuration uses placeholders for certificate identity. Replace
them before running `setup` when automatic local certificate generation is
enabled:

```yaml theme={"system"}
ssl:
  country: "<COUNTRY_CODE>" # ISO 3166-1 alpha-2 code, for example "US"
  state: "<STATE_OR_PROVINCE>"
  city: "<CITY>"
  organization: "<ORGANIZATION>"
  common_name: "<COMMON_NAME>"
  validity_days: 365
```

In production, also set `ssl.acme_email` to an operator-controlled address for
ACME certificate notifications. Do not use a maintainer's personal address.

`ssl.dns_challenge` contains:

* `provider`: Traefik/lego provider name;
* `credentials`: required secret variable names;
* `environment`: non-secret provider variables.

For production deployments, replace the shipped placeholders before running
`setup`:

```yaml theme={"system"}
ssl:
  # Required in production for ACME certificate notifications.
  acme_email: "<ACME_EMAIL>"

  dns_challenge:
    # Traefik/lego provider name.
    provider: "<DNS_PROVIDER>"

    # Required environment-variable names, not secret values.
    credentials:
      - "<PROVIDER_REQUIRED_ENV_VAR>"

    # Optional non-secret provider variables, for example AWS_REGION.
    environment: {}
```

`credentials` must contain the environment-variable names required by the
selected provider, not their values. During `setup`, the CLI securely prompts
for those values and stores them as separate local secret files.

See Traefik's [ACME DNS challenge provider reference](https://doc.traefik.io/traefik/https/acme/#providers)
for supported provider names and required environment variables. Credential values must
not be stored in `config.yaml`.

## Administration and sessions

`admin` defines the bootstrap username/email and admin session limits.
`sessions` defines active-session capacity, token TTL, startup/handshake
timeouts, and admission rate limits.

## Networks, cleanup, and CLI

`network` controls IP detection and named Docker networks. `containers`
defines application naming patterns. `cleanup` defines policy defaults.
`cli.confirm_destructive` controls confirmation prompts; keep it enabled for
interactive deployments.

Run `python3 p-bitm.py setup` after changing values that generate runtime
state.