loginAttemptCount:5# lock user account after 5 tries; when using e.g. Fail2Ban you can deactivate the function with -1
loginResetTimeMinutes:120# lock account for 2 hours after x attempts
loginMethod:all# Accepts values like 'all' and 'normal'(only Login with Username/Password), 'oauth2'(only Login with OAuth2) or 'saml2'(only Login with SAML2)
scopes:openid, profile, email# scopes for Keycloak OAuth2
useAsUsername:preferred_username# field to use as the username for Keycloak OAuth2. Available options are: [email | name | given_name | family_name | preferred_name]
autoCreateUser:true# set to 'true' to allow auto-creation of non-existing users
blockRegistration:false# set to 'true' to deny login with SSO without prior registration by an admin
registrationId:stirling# The name of your Service Provider (SP) app name. Should match the name in the path for your SSO & SLO URLs
idpMetadataUri:https://dev-XXXXXXXX.okta.com/app/externalKey/sso/saml/metadata# The uri for your Provider's metadata
idpSingleLoginUrl:https://dev-XXXXXXXX.okta.com/app/dev-XXXXXXXX_stirlingpdf_1/externalKey/sso/saml# The URL for initiating SSO. Provided by your Provider
idpSingleLogoutUrl:https://dev-XXXXXXXX.okta.com/app/dev-XXXXXXXX_stirlingpdf_1/externalKey/slo/saml# The URL for initiating SLO. Provided by your Provider
# IMPORTANT: For SAML setup, download your SP metadata from the BACKEND URL: http://localhost:8080/saml2/service-provider-metadata/{registrationId}
# Do NOT use the frontend dev server URL (localhost:5173) as it will generate incorrect ACS URLs. Always use the backend URL (localhost:8080) for SAML configuration.
xFrameOptions:DENY# X-Frame-Options header value. Options: 'DENY' (default, prevents all framing), 'SAMEORIGIN' (allows framing from same domain), 'DISABLED' (no X-Frame-Options header sent). Note: automatically set to DISABLED when login is disabled
enabled:true# Enable audit logging for security and compliance tracking
level:2# Audit logging level: 0=OFF, 1=BASIC (compress/split/merge/etc and settings), 2=STANDARD (BASIC + user actions, excludes polling), 3=VERBOSE (everything including polling).
retentionDays:90# Number of days to retain audit logs (0 or negative = infinite retention)
captureFileHash:false# Capture SHA-256 hash of uploaded/processed files. Warning: adds 50-200ms per file depending on size. Only enabled independently of audit level.
capturePdfAuthor:false# Capture author metadata from PDF documents. Warning: requires PDF parsing which increases processing time. Only enabled independently of audit level.
captureOperationResults:false# Capture operation return values and responses in audit log. Warning: not recommended, significantly increases log volume and disk usage. Use only for debugging.
termsAndConditions:https://www.stirlingpdf.com/terms# URL to the terms and conditions of your application (e.g. https://example.com/terms). Empty string to disable or filename to load from local file in static folder
privacyPolicy:https://www.stirlingpdf.com/privacy-policy# URL to the privacy policy of your application (e.g. https://example.com/privacy). Empty string to disable or filename to load from local file in static folder
accessibilityStatement:""# URL to the accessibility statement of your application (e.g. https://example.com/accessibility). Empty string to disable or filename to load from local file in static folder
cookiePolicy:""# URL to the cookie policy of your application (e.g. https://example.com/cookie). Empty string to disable or filename to load from local file in static folder
impressum:""# URL to the impressum of your application (e.g. https://example.com/impressum). Empty string to disable or filename to load from local file in static folder
defaultLocale:en-US# set the default language (e.g. 'de-DE', 'fr-FR', etc)
googlevisibility:false# 'true' to allow Google visibility (via robots.txt), 'false' to disallow
enableAlphaFunctionality:false# set to enable functionality which might need more testing before it fully goes live (this feature might make no changes)
showUpdate:false# see when a new update is available
showUpdateOnlyAdmin:false# only admins can see when a new update is available, depending on showUpdate it must be set to 'true'
customHTMLFiles:false# enable to have files placed in /customFiles/templates override the existing template HTML files
tessdataDir:/usr/share/tessdata# path to the directory containing the Tessdata files. This setting is relevant for Windows systems. For Windows users, this path should be adjusted to point to the appropriate directory where the Tessdata files are stored.
enableAnalytics:true# Master toggle for analytics: set to 'true' to enable all analytics, 'false' to disable all analytics, or leave as 'null' to prompt admin on first launch
enablePosthog:null# Enable PostHog analytics (open-source product analytics): set to 'true' to enable, 'false' to disable, or 'null' to enable by default when analytics is enabled
enableScarf:null# Enable Scarf tracking pixel: set to 'true' to enable, 'false' to disable, or 'null' to enable by default when analytics is enabled
corsAllowedOrigins:[]# List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS. For local development with frontend on port 5173, add 'http://localhost:5173'
backendUrl:""# Backend base URL for SAML/OAuth/API callbacks (e.g. 'http://localhost:8080' for dev, 'https://api.example.com' for production). REQUIRED for SSO authentication to work correctly. This is where your IdP will send SAML responses and OAuth callbacks. Leave empty to default to 'http://localhost:8080' in development.
frontendUrl:""# Frontend URL for invite email links (e.g. 'https://app.example.com'). Optional - if not set, will use backendUrl. This is the URL users click in invite emails.
enableMobileScanner:true# Enable mobile phone QR code upload feature. Requires frontendUrl to be configured.
mobileScannerSettings:
convertToPdf:true# Automatically convert uploaded images to PDF format. If false, images are kept as-is.
imageResolution:full# Image resolution for mobile uploads: 'full' (original size) or 'reduced' (max 1200px on longest side). Only applies when convertToPdf is true.
pageFormat:A4# Page format for converted PDFs: 'keep' (original image dimensions), 'A4' (A4 page size), or 'letter' (US Letter page size). Only applies when convertToPdf is true.
stretchToFit:false# Whether to stretch images to fill the entire page (may distort aspect ratio). If false, images are centered with preserved aspect ratio. Only applies when convertToPdf is true.
customDatabaseUrl:""# eg jdbc:postgresql://localhost:5432/postgres, set the url for your own custom database connection. If provided, the type, hostName, port and name are not necessary and will not be used
type:postgresql# the type of the database to set (e.g. 'h2', 'postgresql')
hostName:localhost# the host name to use for the database url. Set to 'localhost' when running the app locally. Set to match the name of the container name of your database container when running the app on a server (Docker configuration)
port:5432# set the port number of the database. Ensure this matches the port the database is listening to
name:postgres# set the name of your database. Should match the name of the database you create
weasyprint:""# Defaults to /opt/venv/bin/weasyprint
unoconvert:""# Defaults to /opt/venv/bin/unoconvert
calibre:""# Defaults to /usr/bin/ebook-convert
ocrmypdf:""# Defaults to /usr/bin/ocrmypdf
soffice:""# Defaults to /usr/bin/soffice
fileUploadLimit:""# Defaults to "". No limit when string is empty. Set a number, between 0 and 999, followed by one of the following strings to set a limit. "KB", "MB", "GB".
languages:[]# If empty, all languages are enabled. To restrict to specific languages, use a whitelist like ["de_DE", "pl_PL", "sv_SE"]. Empty list or not restricting any languages will enable all available languages.
defaultHideUnavailableTools:false# Default user preference: hide disabled tools instead of greying them out
defaultHideUnavailableConversions:false# Default user preference: hide disabled conversion options instead of greying them out
hideDisabledTools:
googleDrive:false# Hide Google Drive button when not enabled
mobileQRScanner:false# Hide mobile QR scanner button when not enabled
