Settings reference

Generated for pachifast 0.15.0.

Every setting can be given as a key of pachifast.yaml (case-insensitive), as an environment variable PACHIFAST_<NAME> or in .env; see Configuration for the priority between sources. A JSON Schema of the file is available for editors.

Setting	Type	Default	Description
access_token_expire_minutes	integer	30	Lifetime of an access token, in minutes.
activity_log_enabled	boolean	false	Record POST/PUT/PATCH/DELETE requests in the activity log and expose it.
activity_log_exclude_paths	string	refresh-token	Comma-separated path fragments that are never logged.
activity_log_retention_days	integer	0	Days of activity log that pachifast audit purge keeps; 0 needs --days.
activity_log_table	string		Name of the activity log table (empty: table_prefix + activity_log).
algorithm	HS256 | HS384 | HS512	HS256	JWT signing algorithm.
api_v1_prefix	string		Prefix added to every API route.
app_name	string	PachiFast	Name of the application, shown in the OpenAPI documentation.
auth_database_url	string		SQLAlchemy URL of the authentication database (users, groups, permissions). Prefer the environment variable or the .env file: do not commit it.
auth_rate_limit	integer	0	Requests per client address and window on login, registration and MFA check; 0 is no limit.
auth_rate_window_seconds	integer	60	Length of the window of auth_rate_limit, in seconds.
auto_create_auth_schema	boolean	false	Create the auth tables at startup instead of using Alembic migrations.
cache_max_entries	integer	10000	Maximum entries of the in-process cache.
cache_prefix	string	pachifast:	Prefix of the cache keys, to share one Redis between applications.
cache_url	string		Empty: in-process cache. redis://, rediss:// or unix:// URL: shared Redis (needs pachifast[redis]).
database_url	string		SQLAlchemy URL of the main database (async driver, e.g. postgresql+asyncpg://...). Prefer the environment variable or the .env file: do not commit it.
db_max_overflow	integer	10	Extra connections allowed above db_pool_size under load, per process.
db_pool_recycle	integer	1800	Seconds after which a connection is replaced; -1 never.
db_pool_size	integer	5	Connections a server database (PostgreSQL) keeps open, per process.
db_pool_timeout	integer	30	Seconds a request waits for a free connection before it fails.
dbdebug	boolean	false	Log the SQL statements.
debug	boolean	false	Show the traceback page to clients on errors: development only, off by default.
default_locale	string	en	Language of the API error messages (language tag, e.g. en, it, pt-BR).
description	string		Description of the project (taken from pyproject.toml when empty).
disable_core_routers	list or comma-separated string		Routers of the core not to mount (e.g. permissions).
disable_core_routes	list or comma-separated string		Routes of the core not to expose: [METHOD ]/path, relative to /api.
disable_routers	list or comma-separated string		Routers of the project not to mount.
disable_routes	list or comma-separated string		Routes of the project not to expose: [METHOD ]/path, relative to /api.
docs_enabled	boolean	true	Serve the Swagger UI (/docs, /docs/core) and the OpenAPI schemas; false removes them (404).
envelope_enabled	boolean	true	Wrap 2xx JSON in {success, message, data}; false: plain bodies (configure the client too).
events_allow_query_token	boolean	false	Accept the access token in the WebSocket URL (?token=); false: one-time tickets only.
events_broadcast_enabled	boolean	false	Open the event WebSocket (/api/core/events/ws).
events_public_types	list or comma-separated string		Event types sent to every client (e.g. login); default: superusers and the user concerned.
events_ticket_store	database | cache	database	Where the WebSocket tickets live: the auth database (shared by workers) or the cache.
expose_response_database	boolean	false	Add the name of the database the data came from to the enveloped API responses.
global_noauth	boolean	false	Disable authentication on every router: development only.
group_permission_table	string		Name of the group-permission table (empty: table_prefix + group_permission).
group_table	string		Name of the groups table (empty: table_prefix + group).
host	string	127.0.0.1	Address the development server (pachifast dev) listens on.
log_format	text | json	text	Format of the log lines: text (coloured) or json (one object per line).
log_level	"" | CRITICAL | ERROR | WARNING | INFO | DEBUG		Log level of the application; empty means DEBUG with debug, INFO otherwise.
login_lockout_minutes	integer	15	How long a locked account stays locked, in minutes.
login_max_attempts	integer	5	Failed logins before the account is locked.
mfa_config_table	string		Name of the MFA configuration table (empty: table_prefix + mfa_config).
mfa_enabled	boolean	false	Enable multi-factor authentication.
mfa_encryption_key	string		Key of the TOTP secrets stored encrypted; empty: derived from secret_key. Prefer the environment variable or the .env file: do not commit it.
mfa_max_attempts	integer	5	Wrong MFA codes allowed before the login challenge is discarded.
mfa_otp_expire_minutes	integer	10	Minutes the user has to give the MFA code after the password.
mfa_pending_table	string		Name of the pending MFA challenges table (empty: table_prefix + mfa_pending).
mfa_send_cooldown_seconds	integer	30	Seconds between two codes sent by the email or SMS enrolment; 0 is no wait.
mfa_totp_issuer	string		Issuer shown by authenticator apps.
password_min_length	integer	12	Minimum length of a password.
permission_table	string		Name of the permissions table (empty: table_prefix + permission).
port	integer	8000	Port of the development server.
project_name	string		Name of the project (taken from pyproject.toml when empty).
refresh_reuse_grace_seconds	integer	10	Grace seconds in which a reused refresh token is refused but the login is kept.
refresh_token_expire_days	integer	7	Lifetime of a refresh token, in days.
refresh_token_rotation	boolean	true	Every refresh issues a new, single-use refresh token; a reused one revokes the login.
registration_enabled	boolean	false	Allow POST /auth/register (anyone can create an account); false answers 403.
request_id_enabled	boolean	true	Put an X-Request-ID header on every response and the id in every log line.
secret_key	string		Secret that signs the tokens: random string of at least 32 characters, required. Prefer the environment variable or the .env file: do not commit it.
swagger_noauth	boolean	false	Let the Swagger UI (/docs) act as the first superuser without a token: development only.
table_prefix	string	pachifast_	Prefix of every table name of the core.
use_accept_language	boolean	false	Pick the message language from the Accept-Language header of each request.
user_group_table	string		Name of the user-group table (empty: table_prefix + user_group).
user_permission_table	string		Name of the user-permission table (empty: table_prefix + user_permission).
user_settings_table	string		Name of the user settings table (empty: table_prefix + user_settings).
user_table	string		Name of the users table (empty: table_prefix + user).
version	string		Version of the project (taken from pyproject.toml when empty).
wrap_auth_token_response	boolean	false	Wrap the login and refresh-token responses in the standard envelope.