# FeatherWings config.yml reference

> All 191 FeatherWings configuration keys with type, default and description, generated from the Wings source (config.go).

Source: https://featherpanel.com/docs/wings/config-reference/

## About the file

-   Location: `/etc/featherpanel/config.yml`. Override it with `featherwings --config <path>`.
-   You normally do not write it by hand. `featherwings configure --join-data …` writes it from the panel (see [Configuration](https://featherpanel.com/docs/wings/configuration/)), and the panel can push changes to a running node unless `ignore_panel_config_updates` is true.
-   Keys are YAML, nested with dots below. A few keys keep their Go spelling (`BlockBaseDirMount`, `Search`); write them exactly as shown.
-   Defaults come from the `default:` struct tags. An empty default means the Go zero value (false, 0 or empty).
-   Error reporting (`sentry`) is enabled by default and sends crash reports to MythicalSystems' GlitchTip. Set `sentry.enabled: false` to turn it off.
-   With `api.docs.enabled` (default true) Wings serves Swagger UI at `/api/docs` and the spec at `/api/docs/openapi.json`.

## Keys

### Top-level keys

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `debug` | `bool` |  | Determines if wings should be running in debug mode. This value is ignored if the debug flag is passed through the command line arguments. |
| `quiet` | `bool` |  | Determines if wings should run with minimal logging output. This value is ignored if debug mode is enabled. |
| `app_name` | `string` | `FeatherPanel` |  |
| `uuid` | `string` |  | A unique identifier for this node in the Panel. |
| `token_id` | `string` |  | An identifier for the token which must be included in any requests to the panel so that the token can be looked up correctly. |
| `token` | `string` |  | The token used when performing operations. Requests to this instance must validate against it. |
| `remote` | `string` |  | The location where the panel is running that this daemon should connect to to collect data and send events. |
| `allowed_mounts` | `[]string` |  | AllowedMounts is a list of allowed host-system mount points. This is required to have the "Server Mounts" feature work properly. |
| `BlockBaseDirMount` | `bool` | `true` | BlockBaseDirMount indicates whether mounting to /home/container is blocked. If true, mounting to /home/container is blocked. If false, mounting to /home/container is allowed. |
| `allowed_origins` | `[]string` |  | AllowedOrigins is a list of allowed request origins. The Panel URL is automatically allowed, this is only needed for adding additional origins. |
| `allow_cors_private_network` | `bool` |  | AllowCORSPrivateNetwork sets the \`Access-Control-Request-Private-Network\` header which allows client browsers to make requests to internal IP addresses over HTTP. This setting is only required by users running Wings without SSL certificates and using internal IP addresses in order to connect. Most users should NOT enable this setting. |
| `ignore_panel_config_updates` | `bool` |  | IgnorePanelConfigUpdates causes confiuration updates that are sent by the panel to be ignored. |

### `api`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `api` | `object` |  | ApiConfiguration defines the configuration for the internal API that is exposed by the Wings webserver. |
| `api.host` | `string` | `0.0.0.0` | The interface that the internal webserver should bind to. |
| `api.port` | `int` | `8080` | The port that the internal webserver should bind to. |
| `api.docs` | `object` |  | Docs controls whether the auto-generated Swagger/OpenAPI documentation is served. |
| `api.docs.enabled` | `bool` | `true` |  |
| `api.ssl` | `object` |  | SSL configuration for the daemon. |
| `api.ssl.enabled` | `bool` |  |  |
| `api.ssl.cert` | `string` |  |  |
| `api.ssl.key` | `string` |  |  |
| `api.disable_remote_download` | `bool` |  | Determines if functionality for allowing remote download of files into server directories is enabled on this instance. If set to "true" remote downloads will not be possible for servers. |
| `api.remote_download` | `object` |  | RemoteDownload defines settings specific to server remote file downloads. |
| `api.remote_download.max_redirects` | `int` | `10` | MaxRedirects specifies the maximum number of HTTP redirects to follow during a remote file download. Defaults to 10. |
| `api.remote_download_allowlist` | `[]string` |  | RemoteDownloadAllowlist allows remote downloads of files into server directories to connect to otherwise blocked private/internal destinations. Entries may be hostnames, IP addresses, or CIDR ranges. |
| `api.upload_limit` | `int64` | `100` | The maximum size for files uploaded through the Panel in MiB. |
| `api.trusted_proxies` | `[]string` |  | A list of IP address of proxies that may send a X-Forwarded-For header to set the true clients IP |
| `api.ignore_certificate_errors` | `bool` |  | If set to true, TLS certificate verification errors will be ignored when making API calls to the Panel. This is useful for development environments with self-signed certificates. The command line flag --ignore-certificate-errors takes precedence. |

### `system`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `system` | `object` |  | SystemConfiguration defines basic system configuration settings. |
| `system.check_install_exit_code` | `bool` | `false` | CheckInstallExitCode marks a server installation as failed when the install script exits with a non-zero code, or the container wait reports an error. It is disabled by default to keep the historic behaviour, where every installation that ran to completion was reported to the Panel as successful. |
| `system.root_directory` | `string` | `/var/lib/featherpanel` | The root directory where all of the featherpanel data is stored at. |
| `system.log_directory` | `string` | `/var/log/featherpanel` | Directory where logs for server installations and other wings events are logged. |
| `system.data` | `string` | `/var/lib/featherpanel/volumes` | Directory where the server data is stored at. |
| `system.archive_directory` | `string` | `/var/lib/featherpanel/archives` | Directory where server archives for transferring will be stored. |
| `system.backup_directory` | `string` | `/var/lib/featherpanel/backups` | Directory where local backups will be stored on the machine. |
| `system.node_backup_directory` | `string` | `/var/lib/featherpanel/wings_backup` | Directory where whole-node Wings backups are stored (outside volumes so they are not exposed over SFTP). |
| `system.diffs_directory` | `string` | `/var/lib/featherpanel/diffs` | Directory where per-server file revision databases are stored. |
| `system.tmp_directory` | `string` | `/tmp/featherpanel` | TmpDirectory specifies where temporary files for featherpanel installation processes should be created. This supports environments running docker-in-docker. |
| `system.username` | `string` | `featherpanel` | The user that should own all of the server files, and be used for containers. |
| `system.timezone` | `string` |  | The timezone for this Wings instance. This is detected by Wings automatically if possible, and falls back to UTC if not able to be detected. If you need to set this manually, that can also be done. This timezone value is passed into all containers created by Wings. |
| `system.user` | `object` |  | Definitions for the user that gets created to ensure that we can quickly access this information without constantly having to do a system lookup. |
| `system.user.rootless` | `struct` |  | Rootless controls settings related to rootless container daemons. |
| `system.user.uid` | `int` |  |  |
| `system.user.gid` | `int` |  |  |
| `system.user.mount_passwd` | `bool` | `true` | Passwd controls weather a passwd file is mounted in the container at /etc/passwd to resolve missing user issues |
| `system.user.passwd_file` | `string` | `/etc/featherpanel/passwd` |  |
| `system.machine_id` | `object` |  | MachineID controls the mounting of a generated \`/etc/machine-id\` file into containers started by Wings. |
| `system.machine_id.enabled` | `bool` | `true` | Enable controls whether a generated machine-id file should be mounted into containers. By default this option is enabled and Wings will mount an additional machine-id file into containers. |
| `system.machine_id.directory` | `string` | `/run/wings/machine-id` | Directory is the directory on disk where the generated machine-id files will be stored. This directory may be temporary as it will be re-created whenever Wings is started. This path \*\*WILL\*\* be both written to by Wings and mounted into containers created by Wings. If you are running Wings itself in a container, this path will need to be mounted into the Wings container as the exact path on the host, which should match the value specified here. If you are using SELinux, you will need to make sure this file has the correct SELinux context in order for containers to use it. |
| `system.disk_check_interval` | `int64` | `150` | The amount of time in seconds that can elapse before a server's disk space calculation is considered stale and a re-check should occur. DANGER: setting this value too low can seriously impact system performance and cause massive I/O bottlenecks and high CPU usage for the Wings process. Set to 0 to disable disk checking entirely. This will always return 0 for the disk space used by a server and should only be set in extreme scenarios where performance is critical and disk usage is not a concern. |
| `system.quotas` | `object` |  | Quotas define is quota management is enabled on the Data directory |
| `system.quotas.enabled` | `bool` | `false` |  |
| `system.activity_send_interval` | `int` | `60` | ActivitySendInterval is the amount of time that should ellapse between aggregated server activity being sent to the Panel. By default this will send activity collected over the last minute. Keep in mind that only a fixed number of activity log entries, defined by ActivitySendCount, will be sent in each run. |
| `system.activity_send_count` | `int` | `100` | ActivitySendCount is the number of activity events to send per batch. |
| `system.status_sync_interval` | `int` | `300` | StatusSyncInterval is how often (in seconds) Wings re-reports each server's power state to the Panel. This keeps the Panel database accurate if a transition push was missed (daemon restart, temporary Panel outage, etc). Set to 0 to disable. Defaults to 300 (5 minutes). |
| `system.check_permissions_on_boot` | `bool` | `true` | If set to true, file ownership for a server will be synced to the Wings user when the process is booted (recursive chown). On large trees this can still take noticeable time; chown is skipped for files that already match the configured uid/gid. Set false if external tools do not modify ownership, or use a dedicated repair action when needed. |
| `system.enable_log_rotate` | `bool` | `true` | If set to false Wings will not attempt to write a log rotate configuration to the disk when it boots and one is not detected. |
| `system.websocket_log_count` | `int` | `150` | The number of lines to send when a server connects to the websocket. |
| `system.file_collaboration` | `object` |  | FileCollaboration controls real-time collaborative file editing over the server websocket (Yjs CRDT), compatible with Calagopus-style clients. |
| `system.file_collaboration.enabled` | `bool` | `true` | Enabled turns collaborative editing on or off for this node. |
| `system.file_collaboration.file_size_cap` | `uint64` | `1048576` | FileSizeCap is the maximum file size in bytes that can be collaboratively edited. |
| `system.file_collaboration.max_sessions_per_server` | `uint64` | `16` | MaxSessionsPerServer limits concurrent collab sessions (files) per server. |
| `system.file_collaboration.max_sessions_per_connection` | `uint64` | `8` | MaxSessionsPerConnection limits how many files one websocket may edit at once. |
| `system.file_collaboration.max_editors_per_session` | `uint64` | `32` | MaxEditorsPerSession limits editor tabs for the same file on one connection. |
| `system.file_collaboration.max_cursors_per_connection` | `uint64` | `64` | MaxCursorsPerConnection limits awareness cursors tracked per connection. |
| `system.file_collaboration.session_grace_period` | `uint64` | `30` | SessionGracePeriod is how long (seconds) an empty session is kept before teardown. |
| `system.file_history` | `object` |  | FileHistory controls Calagopus-compatible file revision snapshots. |
| `system.file_history.enabled` | `bool` | `true` |  |
| `system.file_history.zstd_level` | `int` | `3` |  |
| `system.file_history.anchor_interval` | `uint64` | `4` |  |
| `system.file_history.keep_chains` | `uint64` | `5` |  |
| `system.file_history.file_size_cap` | `uint64` | `1048576` |  |
| `system.file_history.per_file_disk_budget` | `uint64` | `5242880` |  |
| `system.file_history.per_server_disk_budget` | `uint64` | `209715200` |  |
| `system.file_history.maintenance_interval` | `uint64` | `3600` |  |
| `system.sftp` | `object` |  | SftpConfiguration defines the configuration of the internal SFTP server. |
| `system.sftp.bind_address` | `string` | `0.0.0.0` | The bind address of the SFTP server. |
| `system.sftp.bind_port` | `int` | `2022` | The bind port of the SFTP server. |
| `system.sftp.read_only` | `bool` | `false` | If set to true, no write actions will be allowed on the SFTP server. |
| `system.sftp.max_connections_per_user` | `int` |  | The maximum number of connections a single user may have open at once, or zero to use the default of 32. |
| `system.sftp.max_authenticating_connections_per_ip` | `int` |  | The maximum number of connections from a single IP address, or IPv6 /64 network, that may be authenticating at once, or zero to use the default of 16. Raise this if clients connect through a proxy, since they then all appear to come from the address of the proxy. |
| `system.sftp.key_only` | `bool` | `false` | If set to true users won't be able to login using their password. |
| `system.sftp.allow_console_shell` | `bool` | `true` | AllowConsoleShell permits interactive SSH (shell/PTY) access to the game console for anyone who successfully authenticates on this listener. When false, the panel must include "control.console" in SFTP validation permissions (file-only subusers cannot open a shell). |
| `system.fastdl` | `object` |  |  |
| `system.fastdl.enabled` | `bool` | `false` | Enabled controls whether FastDL is enabled. When enabled, nginx configuration will be generated for servers that have FastDL enabled. Requires nginx to be installed. |
| `system.fastdl.bind_port` | `int` | `80` | The bind port for the nginx FastDL server. |
| `system.fastdl.public_hostname` | `string` |  | PublicHostname is the hostname clients use in sv\_downloadurl (node FQDN). When empty, falls back to extracting a host from PanelLocation (legacy). |
| `system.fastdl.nginx_config_path` | `string` | `/etc/nginx/sites-available/featherwings-fastdl` | NginxConfigPath is the path where nginx config files will be written. Defaults to /etc/nginx/sites-available/featherwings-fastdl |
| `system.crash_detection` | `object` |  |  |
| `system.crash_detection.enabled` | `bool` | `true` | CrashDetectionEnabled sets if crash detection is enabled globally for all servers on this node. |
| `system.crash_detection.detect_clean_exit_as_crash` | `bool` | `true` | Determines if Wings should detect a server that stops with a normal exit code of "0" as being crashed if the process stopped without any Wings interaction. E.g. the user did not press the stop button, but the process stopped cleanly. |
| `system.crash_detection.timeout` | `int` | `60` | Timeout specifies the timeout between crashes that will not cause the server to be automatically restarted, this value is used to prevent servers from becoming stuck in a boot-loop after multiple consecutive crashes. |
| `system.crash_detection.max_restarts` | `int` | `0` | MaxRestarts specifies how many times a server may be automatically restarted after a crash before Wings stops attempting to recover it. The counter resets when the server is manually started. A value of 0 disables this limit. |
| `system.crash_detection_activity_lines` | `int` | `2` | The ammount of lines the activity logs should log on server crash |
| `system.host_terminal` | `object` |  | HostTerminal controls interactive shell access to the host over websockets. |
| `system.host_terminal.enabled` | `bool` | `true` | Enabled toggles whether the host terminal websocket is available. |
| `system.host_terminal.shell` | `string` | `/bin/bash` | Shell specifies the shell executable to launch for terminal sessions. |
| `system.host_terminal.disabled_commands` | `[]string` |  | DisabledCommands is a list of commands (full command or executable name) that cannot be executed. |
| `system.backups` | `object` |  |  |
| `system.backups.write_limit` | `int` | `0` | WriteLimit imposes a Disk I/O write limit on backups to the disk, this affects all backup drivers as the archiver must first write the file to the disk in order to upload it to any external storage provider. If the value is less than 1, the write speed is unlimited, if the value is greater than 0, the write speed is the value in MiB/s. Defaults to 0 (unlimited) |
| `system.backups.compression_level` | `string` | `best_speed` | CompressionLevel determines how much backups created by wings should be compressed. "none" -> no compression will be applied "best\_speed" -> uses gzip level 1 for fast speed "best\_compression" -> uses gzip level 9 for minimal disk space useage Defaults to "best\_speed" (level 1) |
| `system.backups.restore_host_allowlist` | `[]string` |  | RestoreHostAllowlist allows backup restore downloads to connect to otherwise blocked private/internal destinations. Entries may be hostnames, IP addresses, or CIDR ranges. |
| `system.backups.remove_backups_on_server_delete` | `bool` | `true` | RemoveBackupsOnServerDelete deletes backups associated with a server when the server is deleted |
| `system.backups.pbs` | `object` |  | PBS configures the optional Proxmox Backup Server destination. When enabled, the panel may request adapter "pbs" so server files are streamed with proxmox-backup-client (pxar) instead of writing local tar.gz archives. |
| `system.backups.pbs.enabled` | `bool` | `false` | Enabled marks this node as capable of using PBS as a backup destination. The panel reads this via Wings config to choose adapter "pbs" automatically. |
| `system.backups.pbs.repository` | `string` |  | Repository is the PBS repository string, e.g. "backup@pbs!token@pbs.example.com:datastore". Alternative component fields below may be used instead. |
| `system.backups.pbs.server` | `string` |  | Server, Port, Datastore, and AuthID are optional alternatives to Repository. |
| `system.backups.pbs.port` | `int` |  |  |
| `system.backups.pbs.datastore` | `string` |  |  |
| `system.backups.pbs.auth_id` | `string` |  |  |
| `system.backups.pbs.password` | `string` |  | Password is the PBS user password or API token secret (PBS\_PASSWORD). |
| `system.backups.pbs.fingerprint` | `string` |  | Fingerprint is an optional TLS certificate pin (PBS\_FINGERPRINT). Leave empty when the PBS cert is issued by a trusted CA (e.g. Let's Encrypt / ACME); proxmox-backup-client does not require it then, and pinning breaks on renewal. Set only for self-signed or otherwise untrusted certificates. |
| `system.backups.pbs.namespace` | `string` | `featherpanel` | Namespace is the PBS namespace for FeatherPanel backups (default "featherpanel"). |
| `system.backups.pbs.binary` | `string` | `proxmox-backup-client` | Binary is the proxmox-backup-client executable path/name. |
| `system.backups.pbs.archive_name` | `string` | `root.pxar` | ArchiveName is the pxar archive name inside each snapshot (without path). Defaults to root.pxar so PBS file browser matches PVE CT backups (root.pxar.didx). |
| `system.backups.pbs.change_detection_mode` | `string` | `metadata` | ChangeDetectionMode is passed to proxmox-backup-client (--change-detection-mode). "metadata" is recommended so unchanged files are not re-read when possible. |
| `system.backups.pbs.keyfile` | `string` |  | KeyFile is an optional client-side encryption key file path. |
| `system.backups.pbs.encryption_password` | `string` |  | EncryptionPassword unlocks KeyFile when set (PBS\_ENCRYPTION\_PASSWORD). |
| `system.transfers` | `object` |  |  |
| `system.transfers.download_limit` | `int` | `0` | DownloadLimit imposes a Network I/O read limit when downloading a transfer archive. If the value is less than 1, the write speed is unlimited, if the value is greater than 0, the write speed is the value in MiB/s. Defaults to 0 (unlimited) |
| `system.transfers.perform_checksum_checks` | `bool` | `false` | PerformChecksumChecks controls whether incoming transfer archives are validated against the provided SHA-256 checksum. If set to false, the destination node will not enforce checksum verification; the archive will be extracted as received and the checksum part (if present) is ignored. This can be useful for trusted networks or debugging, but reduces protection against corrupted or tampered archives. Defaults to false; set to true to enforce checksum validation. |
| `system.transfers.storage_pool` | `object` |  | StoragePool configures whether this node participates in a shared storage pool. |
| `system.transfers.storage_pool.enabled` | `bool` | `false` | Enabled signals that this node shares a common data volume with other nodes. |
| `system.transfers.storage_pool.pool_name` | `string` |  | PoolName is a per-node identifier used to compare shared storage pool membership across nodes. |
| `system.openat_mode` | `string` | `auto` |  |
| `system.updates` | `object` |  | Updates controls runtime update capabilities. |
| `system.updates.enable_url` | `bool` | `true` | EnableURL controls whether URL driven self-updates are permitted. |
| `system.updates.allow_api` | `bool` | `true` | AllowAPI controls whether the HTTP API may invoke self-updates. |
| `system.updates.disable_checksum` | `bool` | `true` | DisableChecksum skips checksum verification for all self-updates. |
| `system.updates.restart_command` | `string` | `systemctl restart featherwings` | RestartCommand, when set, is executed after a successful self-update. |
| `system.updates.repo_owner` | `string` | `mythicalltd` | RepoOwner defines the default GitHub repository owner used for self-updates. |
| `system.updates.repo_name` | `string` | `featherwings` | RepoName defines the default GitHub repository name used for self-updates. |
| `system.updates.github_binary_template` | `string` | `wings_linux_{arch}` | GitHubBinaryTemplate defines the asset name template (supports {arch} placeholder). |
| `system.updates.default_url` | `string` |  | DefaultURL, when set, is used as the fallback direct download source for URL based updates. |
| `system.updates.default_sha256` | `string` |  | DefaultSHA256 optionally provides a checksum for DefaultURL. |

### `docker`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `docker` | `object` |  | DockerConfiguration defines the docker configuration used by the daemon when interacting with containers and networks on the system. |
| `docker.network` | `object` |  | Network configuration that should be used when creating a new network for containers run through the daemon. |
| `docker.network.interface` | `string` | `172.19.0.1` | The interface that should be used to create the network. Must not conflict with any other interfaces in use by Docker or on the system. |
| `docker.network.dns` | `[]string` | `["1.1.1.1", "1.0.0.1"]` | Dns is the list of DNS servers for containers. When empty or omitted, Docker uses its embedded resolver (127.0.0.11), which forwards to the host's resolvers and avoids resolution failures when custom DNS IPs are unreachable from the bridge (e.g. firewall, or api.minecraftservices.com / Yggdrasil auth failing). Set explicitly if you need containers to use specific resolvers (e.g. 8.8.8.8). |
| `docker.network.name` | `string` | `featherpanel_nw` | The name of the network to use. If this network already exists it will not be created. If it is not found, a new network will be created using the interface defined. |
| `docker.network.ispn` | `bool` | `false` |  |
| `docker.network.IPv6` | `bool` | `true` |  |
| `docker.network.driver` | `string` | `bridge` |  |
| `docker.network.network_mode` | `string` | `featherpanel_nw` |  |
| `docker.network.is_internal` | `bool` | `false` | IsInternal, when true, creates an internal-only network: containers cannot reach the internet (e.g. Minecraft auth to api.minecraftservices.com will fail). Leave false for game servers that need outbound access. |
| `docker.network.enable_icc` | `bool` | `true` |  |
| `docker.network.network_mtu` | `int64` | `1500` |  |
| `docker.network.interfaces` | `dockerNetworkInterfaces` |  |  |
| `docker.domainname` | `string` |  | Domainname is the Docker domainname for all containers. |
| `docker.registries` | `map[string]RegistryConfiguration` |  | Registries . |
| `docker.tmpfs_size` | `uint` | `100` | TmpfsSize specifies the size for the /tmp directory mounted into containers. Please be aware that Docker utilizes the host's system memory for this value, and that we do not keep track of the space used there, so avoid allocating too much to a server. |
| `docker.container_pid_limit` | `int64` | `512` | ContainerPidLimit sets the total number of processes that can be active in a container at any given moment. This is a security concern in shared-hosting environments where a malicious process could create enough processes to cause the host node to run out of available pids and crash. |
| `docker.installer_limits` | `object` |  | InstallerLimits defines the limits on the installer containers that prevents a server's installation process from unintentionally consuming more resources than expected. This is used in conjunction with the server's defined limits. Whichever value is higher will take precedence in the installer containers. |
| `docker.installer_limits.memory` | `int64` | `1024` |  |
| `docker.installer_limits.cpu` | `int64` | `100` |  |
| `docker.cpu_shares` | `int64` | `1024` | CpuShares is the relative CFS weight given to server containers that have a CPU limit, used when the host is fully saturated; it limits nothing on an idle host. It defaults to 1024, which is what Wings has always set. Set it to 0 to leave containers at the engine default: cgroup v2 turns 1024 shares into less than half of its default weight, so 0 gives servers more weight than host system services. |
| `docker.overhead` | `object` |  | Overhead controls the memory overhead given to all containers to circumvent certain software such as the JVM not staying below the maximum memory limit. |
| `docker.overhead.override` | `bool` | `false` | Override controls if the overhead limits should be overridden by the values in the config file. |
| `docker.overhead.default_multiplier` | `float64` | `1.05` | DefaultMultiplier sets the default multiplier for if no Multipliers are able to be applied. |
| `docker.overhead.multipliers` | `map[int]float64` |  | Multipliers allows overriding DefaultMultiplier depending on the amount of memory configured for a server. Default values (used if Override is \`false\`) - Less than 2048 MB of memory, multiplier of 1.15 (15%) - Less than 4096 MB of memory, multiplier of 1.10 (10%) - Otherwise, multiplier of 1.05 (5%) - specified in DefaultMultiplier If the defaults were specified in the config they would look like: \`\`\`yaml multipliers: 2048: 1.15 4096: 1.10 \`\`\` |
| `docker.use_performant_inspect` | `bool` | `true` |  |
| `docker.runtime_reconciliation` | `object` |  | RuntimeReconciliation periodically verifies Docker runtime state against the process state Wings tracks, recovering servers stuck in starting/stopping when Docker and containerd become desynchronized or Docker API calls hang. |
| `docker.runtime_reconciliation.enabled` | `bool` | `true` | Enabled turns on the periodic runtime reconciliation cron. Defaults to true. |
| `docker.runtime_reconciliation.interval_seconds` | `int` | `30` | IntervalSeconds is how often each server is checked. Defaults to 30s. |
| `docker.runtime_reconciliation.inspect_timeout_seconds` | `int` | `5` | InspectTimeoutSeconds bounds ContainerInspect / IsRunning probes used by reconciliation. If Docker hangs past this, the runtime is treated as unresponsive. |
| `docker.runtime_reconciliation.stuck_stopping_seconds` | `int` | `720` | StuckStoppingSeconds is how long a server may remain in "stopping" before Wings forces recovery. Should exceed the normal power stop wait (10m). |
| `docker.runtime_reconciliation.stuck_starting_seconds` | `int` | `300` | StuckStartingSeconds is how long a server may remain in "starting" while Docker is unresponsive before Wings marks it as a runtime error. Responsive Docker with a long boot is ignored; slow games are normal. |
| `docker.runtime_reconciliation.unresponsive_threshold` | `int` | `2` | UnresponsiveThreshold is consecutive inspect failures required before a server is marked as a runtime error and recovered. |
| `docker.runtime_reconciliation.recovery_cooldown_seconds` | `int` | `300` | RecoveryCooldownSeconds is the minimum time between automatic recoverRuntime attempts for a server. Prevents terminate/destroy storms when Docker stays hung. Force-reconcile ignores this. Defaults to 300s (5 minutes). |
| `docker.userns_mode` | `string` |  | Sets the user namespace mode for the container when user namespace remapping option is enabled. If the value is blank, the daemon's user namespace remapping configuration is used, if the value is "host", then the featherpanel containers are started with user namespace remapping disabled |
| `docker.system_ips` | `[]string` | `[]` | Sets the IPS that the user is able to bind to |
| `docker.enable_native_kvm` | `bool` |  | EnableNativeKVM enables native KVM support for containers. This allows containers to access /dev/kvm for hardware-accelerated virtualization. The default value is automatically set to true if KVM is available on the host system, otherwise false. |
| `docker.log_config` | `object` |  |  |
| `docker.log_config.type` | `string` | `local` |  |
| `docker.log_config.config` | `map[string]string` | `{"max-size":"5m","max-file":"1","compress":"false","mode":"non-blocking"}` |  |

### `sentry`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `sentry` | `object` |  | Sentry configures GlitchTip / Sentry-compatible error reporting. |
| `sentry.enabled` | `bool` | `true` | Enabled controls whether the SDK is initialized. When false, no events are sent. |
| `sentry.dsn` | `string` | `https://293bbc3bca1d4f7b92d27e04fdda3fa8@error.mythical.systems/4` | Dsn is the Sentry/GlitchTip project DSN. An empty value disables reporting even when Enabled is true. |
| `sentry.environment` | `string` | `production` | Environment is attached to every event (for example production or staging). |
| `sentry.traces_sample_rate` | `float64` | `0.01` | TracesSampleRate is the fraction of transactions sent (0.0 to 1.0). Keep this low in production to limit storage on self-hosted GlitchTip. |

### `throttles`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `throttles` | `object` |  | Defines internal throttling configurations for server processes to prevent someone from running an endless loop that spams data to logs. |
| `throttles.enabled` | `bool` | `true` | Whether or not the throttler is enabled for this instance. |
| `throttles.lines` | `uint64` | `2000` | The total number of lines that can be output in a given Period period before a warning is triggered and counted against the server. |
| `throttles.line_reset_interval` | `uint64` | `100` | The amount of time after which the number of lines processed is reset to 0. This runs in a constant loop and is not affected by the current console output volumes. By default, this will reset the processed line count back to 0 every 100ms. |

### `remote_query`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `remote_query` | `object` |  | RemoteQueryConfiguration defines the configuration settings for remote requests from Wings to the Panel. |
| `remote_query.timeout` | `int` | `30` | The amount of time in seconds that Wings should allow for a request to the Panel API to complete. If this time passes the request will be marked as failed. If your requests are taking longer than 30 seconds to complete it is likely a performance issue that should be resolved on the Panel, and not something that should be resolved by upping this number. |
| `remote_query.boot_servers_per_page` | `int` | `50` | The number of servers to load in a single request to the Panel API when booting the Wings instance. A single request is initially made to the Panel to get this number of servers, and then the pagination status is checked and additional requests are fired off in parallel to request the remaining pages. It is not recommended to change this from the default as you will likely encounter memory limits on your Panel instance. In the grand scheme of things 4 requests for 50 servers is likely just as quick as two for 100 or one for 400, and will certainly be less likely to cause performance issues on the Panel. |
| `remote_query.custom_headers` | `map[string]string` |  | CustomHeaders is a map of custom headers that will be included in all requests made to the Panel API. This is useful for authentication with services like Cloudflare Access using service tokens (e.g., CF-Access-Client-Id and CF-Access-Client-Secret). |

### `Search`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `Search` | `object` |  | SearchRecursion holds the configuration for directory search recursion settings. |
| `Search.blacklisted_dirs` | `[]string` | `["node_modules", ".git", ".wine", "appcache", "depotcache", "vendor"]` | BlacklistedDirs is a list of directory names that should be excluded from the recursion. |
| `Search.max_recursion_depth` | `int` | `8` | MaxRecursionDepth specifies the maximum depth for directory recursion. |