App Settings
The DB-backed, admin-editable settings defined in SettingService.static.DEFAULTS.
On this page
App Settings
These live in SettingService.static.DEFAULTS, are seeded on boot by preFlightCheck(), cached with a 2-hour TTL, and editable at /settings by anyone with the settings:write (or settings:admin) permission — see Configuration.
Authentication & registration
| Setting | Purpose |
|---|---|
cbLoginLayout | Layout used for auth pages (AuthSplit by default; choose AuthCenter or AuthSplit) |
cbAllowRegistration | Enables/disables self-service registration |
cbAllowForgotPassword | Enables/disables the forgot-password flow |
cbAllowRememberMe | Enables/disables the "remember me" cookie |
cbRememberMeDays | How long a remember-me token stays valid (default: 14) |
cbRequirePasskey | Forces passkey enrollment before reaching the admin area |
Login layout selection
The Settings page exposes cbLoginLayout as a selector:
| Value | Layout | Appearance |
|---|---|---|
AuthSplit | app/layouts/AuthSplit.bxm | Two-panel login: branding/features on the left and the form on the right. On small screens it collapses to the form with compact branding. This is the default. |
AuthCenter | app/layouts/AuthCenter.bxm | Centered authentication card with the logo, form, and authentication footer. |
Select Auth Center or Auth Split at /settings, save the settings, and reload the authentication page. The handler calls event.setLayout( prc.settings.cbLoginLayout ), so the selected layout applies to login, registration, invitation activation, and password-recovery pages. You may also set the value in the database or add a custom layout name under app/layouts/ if your application supplies that layout.
Password & token policy
| Setting | Purpose |
|---|---|
cbMinPasswordLength | Minimum password length (default: 8). SettingService.isValidPassword() also requires an uppercase letter, a lowercase letter, a digit, and a special character, and every server-side path that sets a password (registration, invitation activation, reset, and profile change) runs it |
cbPasswordResetExpiration | Reset-token validity, in minutes (default: 60) |
cbInvitationExpiration | Invitation-token validity, in days (default: 7) |
cbRegistrationVerificationExpiration | Registration-verification-token validity, in hours (default: 24) |
cbApiTokenMaxValidityMonths | Maximum lifetime an API token can be issued for (default: 12) |
cbAuditLogRetentionDays | Age, in days, at which the daily scheduled task hard-deletes audit log entries (default: 90). 0 disables the purge - see Scheduled Tasks |
cbRateLimitMaxAttempts | Attempts allowed per IP, per endpoint, before the AppThrottle middleware blocks login/registration/password-reset (default: 5) - see Rate limiting |
cbRateLimitWindowSeconds | Rate limit window, in seconds (default: 300). Range 1 to 86400. To switch limiting off, use the emergency stop. |
cbRateLimitAutoBlock | Whether an IP that keeps getting throttled is blocked automatically (default: true) - see Blocked IPs |
cbRateLimitAutoBlockWindows / cbRateLimitAutoBlockPeriodMinutes / cbRateLimitAutoBlockHours | The automatic rule: block an IP after this many throttled windows (1 to 100, default 3) within this many minutes (1 to 1440, default 60), for this many hours (1 to 8760, default 24) |
cbRateLimitHistoryRetentionDays | Days the rate limit history (hourly blocked-request totals) is kept before the daily purge deletes it (default: 30, 1 to 365) - see History |
cbServerCeilingPerMinute | The most requests one counted IP may make per minute to the whole site, whatever the route (default: 120, 30 to 600). Only the RATE_LIMITING_ENABLED environment override bypasses it - see Server ceiling |
cbServerCeilingLockdown | When true, every counted IP is held to the minimum of 30 requests a minute until an admin turns it off (default: false) |
cbRateLimitPausedUntil / cbRateLimitPausedBy / cbRateLimitPausedAt | The emergency-stop state: empty when rate limiting is on, indefinite or the epoch second the pause ends, who paused it, and when. Managed by RateLimitControlService, not meant to be edited by hand - see Emergency stop |
cbTrustProxyHeaders | Whether AppThrottle, the audit trail, and security emails trust the X-Forwarded-For/X-Cluster-Client-IP headers for the caller's IP (default: true, since this app is typically deployed behind a reverse proxy or load balancer). Turn this off only if the app is directly internet-facing with nothing in front of it - see Deployment behind a proxy |
cbEncryptionKey / cbSaltingKey | Encryption/salting keys used by the security layer |
Branding & appearance
| Setting | Purpose |
|---|---|
cbAppName | Application display name |
cbAppLogo | Logo shown in the admin sidebar. Either a manually-entered URL, or /branding/logo/lg after an upload via Settings — see Avatars & branding logo |
cbAppTagline | Tagline shown alongside the logo |
cbAppBrandTagline | Short branding label shown in the sidebar brand area |
cbCopyrightNotice | Copyright text rendered by the application footer |
cbDefaultTheme | Default light/dark theme for new visitors |
| Setting | Purpose |
|---|---|
cbDefaultEmail | Default "from" address for outgoing mail |
cbMailHost / cbMailPort | SMTP host/port |
cbMailUsername / cbMailPassword | SMTP credentials |
cbMailTLS / cbMailSSL | Transport security flags |
Audit log
| Setting | Purpose |
|---|---|
cbAuditLogRetentionDays | Number of days audit records are retained by the scheduled purge. Set to 0 to disable automatic purging (default: 90). |
Secrets and encryption
| Setting | Purpose |
|---|---|
cbEncryptionKey | AES encryption secret used by the security/storage layer. Replace the generated development value with a stable secret in production. |
cbSaltingKey | Salt used by security operations. Keep it stable and secret in production. |