Configuration
The generator writes a complete, working config.json. This page is a map of what
you might deliberately change. Edit the file in your install kit and restart the
appliance to apply.
TLS
Three modes, chosen at setup and encoded in your Caddyfile:
byo(the default posture): you supply the certificate and key for your hostname; corporate PKI fits here.acme: the server obtains and renews its certificate automatically. This requires the hostname to be publicly reachable on the standard ports.internal: an internally minted TLS certificate. Browsers and products must trust your internal CA. Suited to lab and fully internal deployments.
TLS here is transport security only. License trust comes from the certificate hierarchy, never from TLS.
smtp mode sends mail (team invitations, notifications) through your relay. log
mode writes would-be emails to the server log, which is fine for evaluation and is
why a fresh install needs no mail server.
The database
The embedded database lives in the appliance's data volume and needs nothing from you except backups. Supplying an external MongoDB URI at setup parks the embedded engine automatically and runs the appliance app-only against your database estate. This is the posture the hardened topology uses, and the answer when procurement wants the database under existing management.
Secrets and posture
config.jsonandsws.envare written mode 0600. Keep them that way; they carry your session keys, SMTP credentials, payment secrets, and the PKI passphrase.- The generator defaults to production posture: no test hooks, and payment verification pinned to the production processors. There is nothing to flip for production; evaluation and production run the same posture.
- Every secret in the kit is minted for that install (session cookie keys, generated passphrases). Kits are not reusable across installs, so run the generator per environment instead of copying files.
What you don't configure
Plans, metering, and billing caps do not exist here. A Licensing Server tenant is unlimited by design. The service's internal wiring (ports, roles, schedulers) is owned by the generated kit; change topology by re-running the generator, not by hand-editing.