Server Settings

Settings → Server Settings shows and changes the settings the installation reads at start: ports and addresses, who serves HTTPS, script and report limits, how long records are kept, the cluster, the System Health thresholds. These are the installation’s settings, not a space’s: one process, one port and one certificate answer for every space.

Who may open it

Permission	What it allows
`VIEW_SERVER_SETTINGS`	Opening the page, and seeing the Server update card
`UPDATE_SERVER_SETTINGS`	Saving, replacing the certificate, running the cluster check, restarting the service, downloading and installing an update on the Server update card (Updates)

Both are installation-wide and held by the default space’s administrator role. A tenant space’s administrator does not see this page.

Where someone outside the installation owns the settings (a hosted service, say), the page may be switched off; a sentence saying so then shows in place of the settings.

Reading the page

Every setting is shown with the value it runs with, beside what the settings file holds for it:

Tag	Meaning
Restart pending	Saved in the file, but the service has not started with it yet. The notice at the top counts them: “N setting(s) will change at the next restart.”
Locked	The value comes from somewhere that outranks the settings file: a service parameter (`-D...`) or an environment variable. The tag says which (for example “Set by the environment variable INS_RABBIT_HOST, which outranks the settings file.”). It cannot be changed here; change it in the service configuration, or remove it there and let the page own it.
Default	Nothing sets it; the product’s own default runs.

In the edit drawer (Edit) each field shows the setting’s key under it (for example server.port), the name it takes in a service configuration too. Use default takes the setting out of the file, so it falls back to the next source down — usually the product’s default. A secret such as a password is never shown back: the field only says Set — type to replace or Not set.

The tabs

Each section is a card in the view and a tab in the edit drawer, in this order.

General

What an installation sets for itself, then the System Health thresholds and the Retention periods.

Setting	Key	Description
Update check	`ins.update.enabled`	Asks the release feed once a day whether a newer release is out, and shows it under the version; on by default. Turn it off for a site without internet access. The feed’s address (`ins.update.url`) is not on the page: it is set with `INS_UPDATE_URL` or in a configuration file — see Updates.
Script time limit	`ins.script.execution-timeout`	A script running longer than this is stopped (such as `300s`, `10m`).
Script statement limit	`ins.script.max-statement-count`	The most statements one script run may execute. Raising it moves the limit further out; it does not remove it.
PDF browser path	`ins.report.html.pdf.browser-path`	The browser that turns HTML reports into PDF. Empty looks for Edge, then Chrome, then Chromium.
PDF browser arguments	`ins.report.html.pdf.extra-arguments`	Extra flags for that browser, space-separated.
PDF conversion time limit (ms)	`ins.report.html.pdf.timeout-ms`	The whole time a report has to become a PDF, waiting for its turn included.
PDF conversions at once	`ins.report.html.pdf.max-concurrent`	Each conversion runs a browser of its own (~200 MB of memory); raise it only on a machine with the memory for it.
Report printer (IPP)	`ins.report.print.ipp-uri`	The printer or print server scheduled reports print on, as an `ipp://` or `ipps://` address. Empty uses this machine’s CUPS default; Windows has no CUPS, so a Windows installation that prints reports must fill it in.
Device browse time limit (ms)	`ins.connection.browse.max-duration-ms`	The longest a device browse (SNMP, OPC UA, IEC 61850, S7, OPC DA/XML) may run, ten minutes at most. A leader hand-over in a cluster waits while a browse runs; keep it modest.
Monitoring user / Monitoring password	`spring.security.actuator.username` / `password`	The account a monitoring tool reads the health details with. The status line is served without it — see Watching it from outside. The password is best given in the environment.

Under the System Health heading, the machine’s thresholds. System Health reads these at start, so a change takes effect at the next restart.

Setting	Key	Default	Description
Disk full threshold	`management.health.diskspace.threshold`	`5GB`	Below this much free space the disk is practically full: the Disk space check is Down, mail goes out and an outside monitor alarms. A size above zero (`5GB`, `500MB`). On a disk smaller than about 50 GB, lower it so it does not come before the free disk warning.
Free disk warning (%)	`ins.health.machine.disk-free-warning-percent`	`10`	Free disk space warns when the free space falls below this share of the disk. 1–99.
Memory in use warning (%)	`ins.health.machine.memory-in-use-warning-percent`	`90`	Warns when the machine’s memory in use stays above this share for the warning window. 1–99.
CPU warning (%)	`ins.health.machine.system-cpu-warning-percent`	`90`	Warns when the machine’s CPU load stays above this share for the warning window. 1–99.
Warning window	`ins.health.machine.warning-window`	`15m`	How long memory or CPU must stay above its threshold before a warning; from 1 minute to 24 hours.

Under the Retention heading, nine day counts: the event log, fired alarms, sign-in attempts, the configuration / manual operation / fired alarm audit trails, sent e-mails, sent SMS and chat messages. Each is 1–36500 days; empty keeps them forever.

Access and HTTPS

The addresses a browser opens the application at, who serves HTTPS, then the ports with their listen addresses.

Setting	Key	Description
Application address	`ins.app.url`	The address browsers open the application at. The link in notification mails is built from it too.
Sandbox address	`ins.sandbox.url`	The application address with the sandbox port; custom HTML and animations load from it.
HTTPS	`server.ssl.enabled`	Three choices: This application serves HTTPS, A proxy in front ends HTTPS, A proxy in front, HTTPS to this server too.
Trusted proxies	`ins.http.trusted-proxies`	The proxies in front, as IP addresses or CIDR ranges. A forwarded client address is believed only from them.
Application listen address	`server.address`	The address the main port binds to; empty is every interface. Behind a proxy on the same machine, `127.0.0.1`.
Application port	`server.port`	The application’s port.
Sandbox listen address / Sandbox port	`server.sandbox.address` / `server.sandbox.port`	The sandbox connector’s address and port.
Iframe origins	`ins.iframe.allowed-hosts`	Origins, beyond the application’s own addresses, that may embed it and that it may embed.
Allowed host pattern	`ins.allowed-hosts`	Replaces the defaults localhost, 127.x and 10.66.66.x; include them if they are still used.

Under the settings, three tools that work even when the settings do not load:

Certificate — the certificate the server serves now, and the one a browser is shown at the Application address (whether browsers trust it, whether it names the address, how many days are left). Replace uploads a PKCS#12 (.p12, .pfx) or JKS file; it is checked first and, if usable, takes effect at once, with no restart (open sessions reconnect). The previous file is kept as a backup.
Proxy test — how your own request reached the server: through which proxy, whether it is trusted, and over what.
Proxy examples — Caddy, nginx and IIS configurations filled in from the values on this page, taken with Copy.

Security

Who must sign and how long a sign-in lasts, then what scripts and connections may reach.

Setting	Key	Description
Operations that require a signature	`ins.auth.esign.required-operations`	The operations refused without an electronic signature; *All ()** is every one.
Sign-in lifetime (days)	`ins.auth.refresh-token-duration-days`	How long a sign-in lasts before the password is asked for again.
Failed sign-ins before lockout	`ins.auth.attempt.max-auth-attempts`	Wrong passwords in a row before the account is locked.
Lockout duration (minutes)	`ins.auth.attempt.lockout-duration-mins`	How long a locked account waits.
Directory (LDAP) sign-in	`ins.ldap.enabled`	While off, no sign-in reaches the directory; the connection itself is on the LDAP screen. Local accounts keep signing in with their own password.
Script debugger	`ins.script.debugger.enabled`	Lets holders of the Debug Script permission step through a saved script in a dry run, where writes are not made.
Hosts scripts may call	`ins.rest.allowed-hosts`	Where `ins.rest(...)` calls may go.
Methods scripts may call with	`ins.rest.allowed-methods`	Empty means no method may be used.
Hosts datasources may connect to	`ins.datasource.allowed-hosts`
Hosts scripts may ping / Ports scripts may ping	`ins.ping.allowed-hosts` / `ins.ping.allowed-ports`	Empty means no host / port may be pinged.
Hosts broadcasts may be sent to	`ins.broadcast.allowed-hosts`
Hosts OPC XML-DA may connect to	`ins.opcxml.allowed-hosts`
Mail OAuth token hosts	`ins.mail.oauth.allowed-hosts`	The hosts a mail account’s OAuth2 token endpoint may be on.

Content policies

The content security policy of custom HTML pages (script-src, style-src, font-src, connect-src, img-src; keys ins.custom-html.csp.*) and the image sources animation and faceplate element frames may show (Element image sources, ins.element.csp.img-src). Sources are space-separated.

The custom HTML editor’s Localize external resources can download a CDN file only from a host written in full (https://cdn.jsdelivr.net); a wildcard such as *.gstatic.com works for the page itself but is not opened for downloading. Google Fonts needs two hosts: fonts.googleapis.com and fonts.gstatic.com.

Cluster

In three parts: Nodes, Broker, Redis. What each setting means is on the Redundant Architecture page.

Test connections checks the values in the form — unsaved ones included — the way the next start will, and saves nothing: “The next start would be accepted.”, or the reasons it would not start clustered. Live cluster state under the section shows what runs now.

Information cards

At the bottom of the page, read-only:

Data stores — the database address and user, the Redis host and port, the InfluxDB address and database, as the process runs with them. They are not changed from this page: the application cannot start without them, and a wrong address saved here would leave no page to correct it from. The database password is never shown.
Settings file — the path of the file the page writes (config/application.yml).

What saving does

Every value is checked first. An invalid value, a locked setting, or a cluster change the next start would not come up clustered with refuses the whole save: nothing is written, so a half-applied form never reaches the file. The field at fault is marked in red.
The previous file is kept (config/application.yml.bak), then the new one is written. Settings the page does not own are kept, but comments in the file are not.
It is signed and audited. Each save is one audit row with the old and new values (a secret as “set / new value”, never its value). It asks for an electronic signature when Operations that require a signature includes it.
It takes effect at the next restart. The rows it changed show Restart pending until then.
It arms the start guard (below).

Some settings are deliberately not on the page: the database connection, INS_MASTER_KEY and the other start-up secrets, the JVM options (heap, time zone), and quota (it has its own screen: Quota Policies).

Restart now

The pending-changes notice carries a Restart now button when the service manager can be shown to start the service again. The button makes a clean shutdown — requests in flight finish, connections stop through their own stop path, writes are not cut in half — and leaves the start to the service manager. The page reconnects once the service answers again and says how it went:

“The service restarted with the new values.”
“The service restarted, but not with the new values…” — the new values stopped it from starting and the previous settings file was restored (the start guard).
If the service does not answer for a long time, you are told to check it on the server.

While it restarts, signed-in users and device communication are interrupted briefly. On a cluster only the node that answered the request restarts; the others are not touched. A restart is signed and audited like a save.

Where it is offered

Installation	When the button shows
Windows, the installer’s service	The service the installer sets up (NSSM) qualifies as it is: it is installed to start the service again when it exits.
Linux, systemd	When the service was started directly by a systemd unit and the unit restarts it on exit. `Restart=on-failure` or `Restart=always` in the `[Service]` section is enough (with `RestartSec=5`, say). `ExecStart` has to start Java itself (or a script that `exec`s it); a wrapper script that runs Java as a child does not qualify.
Docker, a manual `java -jar`, any other service manager	Not offered: restart the service on the server as usual.

[Service]
Restart=on-failure
RestartSec=5

When the button is not offered the page says why — for example “systemd would not start … again after this process exits; the unit needs Restart=on-failure or Restart=always.” — and “Restart the service on the server for them to take effect.” The check runs again when the button is pressed.

The start guard

A value the page accepts can still stop the next start: a port another program holds, a mistyped cluster address, a listen address the machine does not have. The service manager then starts the service again and again, and every attempt fails the same way.

The start guard undoes such a change by itself:

A save arms it. A start that reaches ready with those settings proves the change, and the guard stands down.
The start after three failed ones — if the file is still the one the page wrote — restores the previous settings file and starts with the settings that last worked.
The page shows it until the next save: “On … the service could not start with the saved settings after N attempt(s), so the previous settings file was restored.” with Rolled back: and the settings’ names. Correct the value and save again.

The guard only ever undoes what the page saved; it does not touch a hand edit, or a value coming from a -D or an environment variable. It only counts starts: a service that fails to start three times in a row for a reason unrelated to the change (the database down, say) also rolls the change back — the page and the log say so, and the change is one save away.

A settings file that cannot be read

If config/application.yml was edited by hand and broken, the page still opens, but a red notice names the file, the line, the column and the reason; Edit is disabled and a save is refused, so a hand-written file is never overwritten. Correct the file by hand (or put application.yml.bak back) — before the next restart: the service does not start on a file it cannot read.

Values out of range

Number and duration settings are checked by the product too, whether they come from the page, a -D, an environment variable or a hand edit. A value out of range does not stop the start: a safe value is used instead — for a retention period keep forever (nothing is deleted), for everything else the product’s default — and one ERROR line is written at start:

Setting ins.retention.event-log-days=0 is outside its valid range (1..36500); it is ignored and keep forever (nothing is deleted) is used instead.

After a deployment, search the start log for is outside its valid range; a clean start prints none.

System Health — what the thresholds warn about, and outside monitoring
Configuration — the master key, secrets and the service configuration
Redundant Architecture — what the cluster settings mean
App Email — the account notifications are sent through