For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/operations/configuration.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Configuration

    JumpServer reads its runtime settings from a single environment-style file, /opt/jumpserver/config/config.txt. The installer generates the file from config-example.txt, then the containers read the values at start time. This page explains the file, the main groups of settings, and how to change them safely. The complete parameter list is outside the scope of this page; the installer's config-example.txt documents every option.

    Configuration file

    The default location is:

    /opt/jumpserver/config/config.txt

    Settings use the KEY=VALUE form, one per line. The file controls the database and cache connection, exposed ports, session cookies, logging, component switches, object storage, and account vault integration. TLS certificate files referenced by these settings are stored under /opt/jumpserver/config/certs and /opt/jumpserver/config/nginx/cert.

    Apply changes

    Configuration is not hot-reloaded. Back up the file, edit it, then restart the services:

    cp /opt/jumpserver/config/config.txt /opt/jumpserver/config/config.txt.bak.$(date +%F)
vi /opt/jumpserver/config/config.txt
./jmsctl.sh restart

    For changes that affect database or cache connectivity, stop the services first so that components do not reconnect to a half-written configuration:

    ./jmsctl.sh stop
./jmsctl.sh start

    The installer also provides a guided editor: ./jmsctl.sh config --help lists the ntp, init, port, ssl, and env subcommands. See Command-Line Tools.

    Main setting groups

    AreaRepresentative settingsNotes
    PersistenceVOLUME_DIRRoot of recordings, logs, and database backups. Confirm it before installation; moving it later requires migrating the data.
    SecretsSECRET_KEY, BOOTSTRAP_TOKEN, CHAT_AI_DELEGATION_SECRETGenerated at installation. Keep them identical across nodes and when restoring an environment.
    Database and cacheDB_ENGINE, DB_HOST, DB_PORT, DB_USE_SSL, REDIS_HOST, REDIS_PORT, REDIS_PASSWORD, REDIS_USE_SSL, REDIS_SENTINEL_*Use external services in production. TLS requires the CA file under config/certs.
    AccessHTTP_PORT, HTTPS_PORT, SERVER_NAME, DOMAINSDOMAINS is the trusted-host allowlist; access is rejected with 400/403 when it does not match.
    ComponentsCORE_ENABLED, KOKO_ENABLED, CHEN_ENABLED, WEB_ENABLED, and similarSet a component to 0 to disable it on this host.
    LoggingLOG_LEVEL, SYSLOG_ADDR, SYSLOG_FACILITY, SYSLOG_SOCKTYPEForward component logs to an external Syslog server.
    SessionsSESSION_COOKIE_AGE, SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURECookie lifetime and transport security. Enable the secure flags when HTTPS is used.
    RecordingsSERVER_REPLAY_STORAGE, OPERATE_LOG_ELASTICSEARCH_CONFIGObject storage for replays and Elasticsearch for operation log changes.

    Example: switch to an external database

    1. Stop the services with ./jmsctl.sh stop.
    2. Edit DB_ENGINE, DB_HOST, DB_PORT, DB_NAME, DB_USER, and DB_PASSWORD in config.txt.
    3. Start the services with ./jmsctl.sh start.
    4. Run ./jmsctl.sh status and open http://<jumpserver-host>/api/health/ to confirm that Core is healthy.
    Warning

    Changing the database after data exists does not migrate the records. Move the data first, or use the restore procedure in Backup & Restore.