# All settings

<!-- Generated by tools/config-reference/generate.py from flow.service.workflow 5.0.0-beta.39. Don't edit by hand. -->

# All settings

This page lists every setting Flow seeds at `5.0.0-beta.39`: 52 settings in 9 groups, in the order **Admin › Settings** lists the groups. An admin changes them in **Admin › Settings**, or with `PATCH /api/v2/settings` and a body of `{"<group>": {"<key>": value}}`, using the group key and key below. See [Admin](https://www.useboomerang.io/docs/flow/main/webapp/administer#settings).

- **Restart:** none needed. A saved setting applies without a restart. The exceptions:
  - **Audit › Retention Days** applies within about a minute, on every instance.
  - **Features › Workspace creation by users** applies to sessions signed in after the change.
  - **Run limits › Activity Retention (days)** applies at the next hourly purge pass, which reads it.
  - **Tasks › Default Image Path**, **Deletion Policy** and **Maximum task duration** apply when a run is queued: a run already queued keeps the value it was queued with.
- **Default:** the value on a new install. An upgraded install keeps the values it had. A toggle's default is On or Off; the API reads it as `true` or `false`.
- **Secured:** a secured value is stored encrypted and never shown: the webapp shows **Set** when it holds one, and the API returns `*****`. Its default here is "Not shown".

Deployment configuration, read at start, is in properties instead: see [All properties](https://www.useboomerang.io/docs/flow/main/hosting/properties-reference).

## Artifacts

Files that upload tasks attach to a run, and the task logs dispatchers store. A file is deleted when it expires; nothing is deleted to make room. Group key: `artifacts`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Default Retention (days)** | `retention.default.days` | Number | 30 | Days an artifact is kept after upload when neither its workspace nor its upload task sets a retention. |
| **Maximum Retention (days)** | `retention.max.days` | Number | 90 | The longest any workspace or upload task may keep an artifact, in days. |
| **Largest Artifact (MB)** | `max.artifact.size` | Number | 1024 | The largest file an upload task may store, in MB. A bigger upload fails its task. |
| **Store Task Logs** | `logs.enabled` | Toggle | On | Store the finished log a dispatcher sends for each task and serve it ahead of the dispatcher's live log. Off tells dispatchers their logs are not stored; logs already stored are served until they expire.<br>**Note:** Logs are stored only while the artifact store is on (`flow.artifacts.enabled`). |
| **Task Log Retention (days)** | `logs.retention.days` | Number | 7 | Days a stored task log is kept. Independent of artifact retention; a log never counts toward artifact storage. |

## Audit

Control the capture and retention of the audit trail. Group key: `audit`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Enabled** | `enabled` | Toggle | On | Capture an audit event for every audited operation. Disabling stops capture immediately; nothing is captured retroactively when re-enabled. |
| **Level** | `level` | Text | `WRITE` | Capture verbosity: DESTRUCTIVE records deletes only, WRITE records all mutations, ALL adds sensitive reads and exports. |
| **Retention Days** | `retentionDays` | Number | 365 | Days audit events are retained before expiry. Applied to the TTL index at startup and within about a minute of a change, on every instance; floored at 60 days because monthly quota counting needs at least one month of events. |

## Authentication

The identity provider that signs people in, and how their tokens are exchanged. Group key: `auth`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **OIDC Issuer** | `oidc.issuer` | Text | blank | The issuer URL of the single trusted OIDC provider (e.g. local IDPZero) accepted for the direct id\_token login path of the sign-in exchange. Empty disables that path entirely.<br>**Note:** Seeded at start from the property `flow.auth.oidc.issuer` while blank. A value set here is never overwritten by the property. See [Sign in with OpenID Connect](https://www.useboomerang.io/docs/flow/main/hosting/sign-in#sign-in-with-openid-connect). |
| **OIDC Client ID** | `oidc.clientId` | Text | blank | The OAuth2 client id (public client, no secret) the id\_token's aud claim must match.<br>**Note:** Seeded at start from the property `flow.auth.oidc.client-id` while blank, as **OIDC Issuer** is. |

## Customization

The name, logo and links this instance shows its users. Group key: `customizations`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **App Name** | `appName` | Text | `Flow` | The name to appear in the header (and throughout the App) that appears to the right of the Platform Name or Logo. |
| **Platform Name** | `platformName` | Text | `Boomerang` | The overall platform name. This only appears if the logo is set to not appear. |
| **Display Platform Logo** | `displayLogo` | Toggle | On | Whether to display the platforms Logo or use the Platform Name. |
| **Logo URL** | `logoURL` | Text | blank | A URL for retrieving the Platform Logo. |

## Features

Turn parts of the product on or off for everyone. Group key: `features`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Activity** | `activity` | Toggle | On | Allow users to access and interact with Activity |
| **Insights** | `insights` | Toggle | On | Allow users to access and view Insights |
| **Workspace Quotas** | `workspaceQuotas` | Toggle | On | Enforce Workspace level quotas<br>**Note:** The only switch for quotas: no property turns them off. See [Turn quotas off](https://www.useboomerang.io/docs/flow/main/webapp/quotas#turn-quotas-off). |
| **Workflow Triggers** | `workflowTriggers` | Toggle | On | Enable Workflow Triggers to be visible on the Workflows Configuration |
| **Workflow Tokens** | `workflowTokens` | Toggle | On | Enable Workflow Tokens to be visible on the Workflows Configuration<br>**Note:** Has no effect while Flow runs with security off (`flow.security.enabled=false`). |
| **Workspace Parameters** | `workspaceParameters` | Toggle | On | Enable users to access and create Workspace Parameters |
| **Global Parameters** | `globalParameters` | Toggle | On | Enable users to access and create Global Parameters |
| **Workspace Management** | `workspaceManagement` | Toggle | On | Allow management and editing of Workspaces. The Workspaces screen will always be visible but if disabled will be in view only mode<br>**Note:** Off, whatever its value, while `flow.workspace.single` is `true`. |
| **Workspace creation by users** | `workspaceCreate` | Toggle | On | Let any signed-in user create a workspace and become its owner. Admins and operators always can; a change applies to sessions signed in afterwards.<br>**Note:** Off, whatever its value, while `flow.workspace.single` is `true`. |
| **Auto-Create Users** | `autoCreateUsers` | Toggle | On | Create a user account the first time someone signs in. When off, a person who isn't a user yet can sign in only if an admin has added them to a workspace or the admin claim admits them. Existing users are unaffected. |
| **User Management** | `userManagement` | Toggle | On | Allow management and editing of Users. The Users screen will always be visible but if disabled will be in view only mode<br>**Note:** Off, whatever its value, while `flow.workspace.single` is `true`. |
| **Workspace Tasks** | `workspaceTasks` | Toggle | On | Allow users to access and create Workspace Tasks |

## Integrations

Credentials and endpoints for the systems Flow connects to. Group key: `integration`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Slack Auth Token** | `slack.token` | Secured | Not shown | The default auth token for authenticating as a Slack app. Only used if installing into a single workspace and not a distributed app. |
| **Slack App ID** | `slack.appId` | Text | blank | The App ID from your Slack apps credentials. |
| **Slack Client ID** | `slack.clientId` | Text | blank | The Client ID from your Slack apps credentials.<br>**Note:** The Integrations page lists Slack once **Slack Client ID** and **Slack Client Secret** are set. |
| **Slack Client Secret** | `slack.clientSecret` | Secured | Not shown | The Client Secret from your Slack apps credentials. |
| **Slack Signing Secret** | `slack.signingSecret` | Secured | Not shown | The Signing Secret from your Slack apps credentials.<br>**Note:** With none set, Flow refuses every request to its Slack commands, interactivity and events routes. |
| **GitHub App ID** | `github.appId` | Text | blank | The GitHub App ID |
| **GitHub Private Key** | `github.jwt` | Secured | Not shown | Private key used to sign access token requests |
| **GitHub App Name** | `github.appName` | Text | blank | The GitHub App Name |
| **GitHub Client ID** | `github.clientId` | Text | blank | The Client ID from your GitHub App credentials. |
| **GitHub Client Secret** | `github.clientSecret` | Secured | Not shown | The Client Secret from your GitHub App credentials. |
| **GitHub Webhook Secret** | `github.webhookSecret` | Secured | Not shown | The Webhook Secret configured on your GitHub App, used to verify the X-Hub-Signature-256 header on incoming webhook payloads.<br>**Note:** With none set, Flow refuses every GitHub event with `401`. |

## Quotas

The limits every workspace starts with; a workspace can override them. Group key: `quotas`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Maximum Concurrent Workflows** | `max.workflowrun.concurrent` | Number | 4 | The number of workflows that can be running at the same time |
| **Maximum Number of Workflows** | `max.workflow.count` | Number | 10 | The total number of workflows that a team can have |
| **Max WorkflowRuns per month** | `max.workflowrun.monthly` | Number | 20 | The number of workflow executions per month |
| **Max WorkflowRun Duration** | `max.workflowrun.duration` | Number | 30 | The maximum time that a workflow can be executing for in minutes |
| **Max Workspace Storage** | `max.workspace.storage` | Text | `2Gi` | Maximum size of the shared workspace a run may declare<br>**Note:** Also the size a run workspace gets when its workflow leaves the size blank, lowered to the workspace's own storage quota when that's smaller. |
| **Max Artifact Storage** | `max.artifact.storage` | Text | `5Gi` | Maximum storage the workspace's unexpired artifacts may hold |

## Run limits

How deep a run may nest child workflows, how many items a for-each may fan out to, and how long finished runs are kept. Group key: `workflowrun`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Maximum Child Workflow Nesting Depth** | `max.nesting.depth` | Number | 5 | How many levels of child workflows a run may nest. A runworkflow task at the cap fails instead of submitting another child. |
| **Maximum For-Each Items** | `max.foreach.items` | Number | 256 | How many items a for-each task may run. A task whose items resolve to more fails instead of running any. |
| **Finally Timeout (minutes)** | `finally.timeout` | Number | 5 | Minutes the finally tasks of a run may take once its graph has ended. Each finally task's own timeout is capped by it; when it passes, the run completes and any finally task still running is ended. |
| **Activity Retention (days)** | `retention.days` | Number | 365 | Days a finished run and its task runs, actions, artifacts and logs are kept. Floored at 60 so monthly quota counts stay complete.<br>**Note:** Applies at the next hourly purge pass, which reads it. |

## Tasks

How task containers run: images, worker clean-up, timeouts. Group key: `task`.

| Label | Key | Type | Default | Description |
| --- | --- | --- | --- | --- |
| **Enable Debug** | `debug` | Toggle | On | Enable Debug logging for worker logs |
| **Default Image Path** | `default.image` | Text | `boomerangio/task-flow:3.3.0` | Default container image to be used by the Worker including version<br>**Note:** A `template` or `script` task without an image of its own runs on it. See [Set the task image](https://www.useboomerang.io/docs/flow/main/hosting/configuring#set-the-task-image).<br>**Note:** Applies when a run is queued: a run already queued keeps the value it was queued with. |
| **Deletion Policy** | `deletion.policy` | Select | **Never (keep until the retention period)** (`Never`) | When a finished task's worker (its Kubernetes Job or Tekton TaskRun) is removed. A task's logs are read from its worker, so they go with it, and a run's storage is only freed once no worker still holds it. Always: at task end. On Success: at task end if the task succeeded; a failed task's worker stays for its logs. Never: not at task end; the worker, its logs and any storage it holds stay until the retention period (kube.task.ttlDays, 7 days by default) removes it.<br>Options: **Never (keep until the retention period)** (`Never`), **On Success (remove when a task succeeds)** (`OnSuccess`), **Always (remove when a task ends)** (`Always`).<br>**Note:** Applies when a run is queued: a run already queued keeps the value it was queued with. |
| **Enable Verified Tasks to be edited** | `edit.verified` | Toggle | Off | When enabled, verified tasks can be edited in the task manager |
| **Maximum task duration** | `default.timeout` | Number | 0 | Maximum minutes any single task may run, whatever its run allows. Set to 0 to let tasks inherit the run's timeout.<br>**Note:** Applies when a run is queued: a run already queued keeps the value it was queued with. |

## Next steps

- [Admin](https://www.useboomerang.io/docs/flow/main/webapp/administer#settings): where an admin changes these settings.
- [Quotas](https://www.useboomerang.io/docs/flow/main/webapp/quotas): how the quota settings and a workspace's own quotas combine.
- [All properties](https://www.useboomerang.io/docs/flow/main/hosting/properties-reference): the deployment configuration each service reads at start.