The **Configure** section of the Pomerium Enterprise Console houses settings that affect the entirety of the Console environment (across all Namespaces). Adjust these settings with care.

## Outbound network requirements

Pomerium Enterprise Console may require outbound HTTPS (TCP 443) access to:

- `api.keygen.sh` for online license verification
- `raw.githubusercontent.com` for the Tor exit node list when that data source is enabled
- `analytics.pomerium.com` for Pomerium usage analytics.
- `sentry.io` for Sentry error reporting - see https://docs.sentry.io/security-legal-pii/security/ip-ranges/

## Directory sync

Directory sync enumerates users and groups from a directory provider so Pomerium Core can use directory-backed identity data. In the Console, go to **Settings** > **Directory Sync**. The tab shows **Identity Provider**, **Polling Min Delay**, and **Polling Max Delay**. **Identity Provider** renders a provider selector with **None** as the empty value; leaving it empty disables directory sync. When a provider is selected, the Console shows provider-specific options below the selector.

When the Console exports settings to Core, **Identity Provider** maps to `directory_provider`, the provider-specific values map to `directory_provider_options`, **Polling Min Delay** maps to `directory_provider_refresh_interval`, and **Polling Max Delay** maps to `directory_provider_refresh_timeout`. Core uses these settings to choose the directory provider, store provider options as a generic JSON object, refresh the directory cache, and limit a single refresh attempt.

You can seed the same persisted Console settings at startup with `directory_provider`, `directory_provider_options`, `directory_provider_refresh_interval`, and `directory_provider_refresh_timeout` in `config.yaml`, or with the matching environment variables in the table below. If unset, `directory_provider_refresh_interval` defaults to `10m`, and `directory_provider_refresh_timeout` — the deadline for a single refresh attempt — also defaults to `10m`.

## Auto-apply changesets

`auto_apply_changesets` controls whether configuration changesets apply automatically (`true`) or wait for an administrator to apply them (`false`). The Enterprise Console has no UI control for it; set it through the [Console management API](https://www.pomerium.com/docs/internals/management-api-enterprise.md). Pomerium Zero exposes it as the **Auto-apply changesets** toggle under **Settings** > **Advanced**.

## Variables

The keys listed below can be applied in Pomerium Console's `config.yaml` file or as environment variables.

All values are case sensitive unless otherwise noted.

**Environment variables:**

| Name | Description | Default Value |
| :-- | :-- | --- |
| <a className="entRef-anchor" id="administrators">#</a><a href="#administrators">ADMINISTRATORS</a> | A list of user ids, names or emails to make administrators. Useful for bootstrapping. | none |
| <a className="entRef-anchor" id="audience">#</a><a href="#audience">AUDIENCE</a> | A list of audiences for verifying the signing key. | `[]` |
| <a className="entRef-anchor" id="authenticate-service-url">#</a><a href="#authenticate-service-url">AUTHENTICATE\_SERVICE\_URL</a> | (deprecated) Authenticate service URL is not required in the Console configuration. For Device Enrollment, use the [external route URL](https://www.pomerium.com/docs/reference/routes/from.md). | none |
| <a className="entRef-anchor" id="bind-addr">#</a><a href="#bind-addr">BIND\_ADDR</a> | The address the Pomerium Console will listen on. | `:8701` |
| <a className="entRef-anchor" id="bootstrap-service-account">#</a><a href="#bootstrap-service-account">BOOTSTRAP\_SERVICE\_ACCOUNT</a> | Enable the bootstrap service account. | `false` |
| <a className="entRef-anchor" id="cache-dir">#</a><a href="#cache-dir">CACHE\_DIR</a> | Directory to use for caching. | Cache only in memory. |
| <a className="entRef-anchor" id="customer-id">#</a><a href="#customer-id">CUSTOMER\_ID</a> | The customer ID | none |
| <a className="entRef-anchor" id="database-encryption-key">#</a><a href="#database-encryption-key">DATABASE\_ENCRYPTION\_KEY</a> | The base64-encoded encryption key for encrypting sensitive data in the database. | none |
| <a className="entRef-anchor" id="database-encryption-key-file">#</a><a href="#database-encryption-key-file">DATABASE\_ENCRYPTION\_KEY\_FILE</a> | Loads base64-encoded `database-encryption-key` secret from a file. | none |
| <a className="entRef-anchor" id="database-encryption-key-raw-file">#</a><a href="#database-encryption-key-raw-file">DATABASE\_ENCRYPTION\_KEY\_RAW\_FILE</a> | Loads `database-encryption-key` secret from a raw file. Setting this option from a raw file does not require base64 encoding. | none |
| <a className="entRef-anchor" id="database-url">#</a><a href="#database-url">DATABASE\_URL</a> | The database Pomerium Enterprise Console will use. | `postgresql://pomerium:pomerium`<br />`@localhost:5432/dashboard?sslmode=disable` |
| <a className="entRef-anchor" id="databroker-service-url">#</a><a href="#databroker-service-url">DATABROKER\_SERVICE\_URL</a> | Databroker service URL for Console to reach Core. Leave unset in the default single-process deployment (Console uses `http://localhost:5443`). Set only when the databroker runs on another host/port or Core is split/remote. | `http://localhost:5443` |
| <a className="entRef-anchor" id="debug-config-dump">#</a><a href="#debug-config-dump">DEBUG\_CONFIG\_DUMP</a> | Dumps the Databroker configuration. This is a debug option to be used only when specified by Pomerium Support. | `false` |
| <a className="entRef-anchor" id="directory-provider">#</a><a href="#directory-provider">DIRECTORY\_PROVIDER</a> | Directory-sync provider Pomerium uses to enumerate users and groups. Empty disables directory sync. | none |
| <a className="entRef-anchor" id="directory-provider-options">#</a><a href="#directory-provider-options">DIRECTORY\_PROVIDER\_OPTIONS</a> | Provider-specific options for the directory provider, as a JSON object. | none |
| <a className="entRef-anchor" id="directory-provider-refresh-interval">#</a><a href="#directory-provider-refresh-interval">DIRECTORY\_PROVIDER\_REFRESH\_INTERVAL</a> | How often Pomerium refreshes the directory cache. | `10m` |
| <a className="entRef-anchor" id="directory-provider-refresh-timeout">#</a><a href="#directory-provider-refresh-timeout">DIRECTORY\_PROVIDER\_REFRESH\_TIMEOUT</a> | Per-attempt timeout for a single directory refresh cycle. | `10m` |
| <a className="entRef-anchor" id="disable-feedback-widget">#</a><a href="#disable-feedback-widget">DISABLE\_FEEDBACK\_WIDGET</a> | Disables third-party feedback widget and removes it from the Enterprise Console. | `false` |
| <a className="entRef-anchor" id="disable-remote-diagnostics">#</a><a href="#disable-remote-diagnostics">DISABLE\_REMOTE\_DIAGNOSTICS</a> | Disable remote diagnostics. | `true` |
| <a className="entRef-anchor" id="disable-validation">#</a><a href="#disable-validation">DISABLE\_VALIDATION</a> | (deprecated, please update your configuration to set `VALIDATION_MODE=none` instead) Disable config validation. | `false` |
| <a className="entRef-anchor" id="grpc-addr">#</a><a href="#grpc-addr">GRPC\_ADDR</a> | The address to listen for gRPC on. | `:8702` |
| <a className="entRef-anchor" id="help">#</a><a href="#help">HELP</a> | help for serve | `false` |
| <a className="entRef-anchor" id="license-key">#</a><a href="#license-key">LICENSE\_KEY</a> | Required: Provide the license key issued by your account team. | none |
| <a className="entRef-anchor" id="override-certificate-name">#</a><a href="#override-certificate-name">OVERRIDE\_CERTIFICATE\_NAME</a> | Overrides the certificate name used for the databroker connection. | none |
| <a className="entRef-anchor" id="prometheus-data-dir">#</a><a href="#prometheus-data-dir">PROMETHEUS\_DATA\_DIR</a> | The path to Prometheus data | none |
| <a className="entRef-anchor" id="prometheus-listen-addr">#</a><a href="#prometheus-listen-addr">PROMETHEUS\_LISTEN\_ADDR</a> | When set, embedded Prometheus listens at this address. Set as `host:port` | `127.0.0.1:9090` |
| <a className="entRef-anchor" id="prometheus-scrape-interval">#</a><a href="#prometheus-scrape-interval">PROMETHEUS\_SCRAPE\_INTERVAL</a> | The Prometheus scrape frequency | `10s` |
| <a className="entRef-anchor" id="prometheus-url">#</a><a href="#prometheus-url">PROMETHEUS\_URL</a> | The URL to access the Prometheus metrics server. | none |
| <a className="entRef-anchor" id="shared-secret">#</a><a href="#shared-secret">SHARED\_SECRET</a> | The base64-encoded secret for signing JWTs, shared with OSS Pomerium. | none |
| <a className="entRef-anchor" id="shared-secret-file">#</a><a href="#shared-secret-file">SHARED\_SECRET\_FILE</a> | Loads base64-encoded `shared-secret` from a file. | none |
| <a className="entRef-anchor" id="shared-secret-raw-file">#</a><a href="#shared-secret-raw-file">SHARED\_SECRET\_RAW\_FILE</a> | Loads `shared-secret` from a raw file. Setting this option from a raw file does not require base64 encoding. | none |
| <a className="entRef-anchor" id="signing-key">#</a><a href="#signing-key">SIGNING\_KEY</a> | (deprecated) base64-encoded signing key (public or private) for verifying JWTs. This option is no longer required in the Console config. | none |
| <a className="entRef-anchor" id="signing-key-file">#</a><a href="#signing-key-file">SIGNING\_KEY\_FILE</a> | Loads base64-encoded `signing-key` secret from a file. | none |
| <a className="entRef-anchor" id="signing-key-raw-file">#</a><a href="#signing-key-raw-file">SIGNING\_KEY\_RAW\_FILE</a> | Loads `signing-key` secret from a raw file. Setting this option from a raw file does not require base64 encoding. | none |
| <a className="entRef-anchor" id="tls-ca">#</a><a href="#tls-ca">TLS\_CA</a> | base64-encoded string of tls-ca | none |
| <a className="entRef-anchor" id="tls-ca-file">#</a><a href="#tls-ca-file">TLS\_CA\_FILE</a> | file storing tls-ca | none |
| <a className="entRef-anchor" id="tls-cert">#</a><a href="#tls-cert">TLS\_CERT</a> | base64-encoded string of tls-cert | none |
| <a className="entRef-anchor" id="tls-cert-file">#</a><a href="#tls-cert-file">TLS\_CERT\_FILE</a> | file storing tls-cert | none |
| <a className="entRef-anchor" id="tls-derive">#</a><a href="#tls-derive">TLS\_DERIVE</a> | Derives TLS server certificate for the console HTTPS and gRPC endpoints for the host specified by this option, using the CA derived from the shared key. Uses this CA to verify the server certificate presented by the Databroker gRPC TLS when the [`tls_derive`](https://www.pomerium.com/docs/reference/tls-derive.md) option is set in the Pomerium Core. | none |
| <a className="entRef-anchor" id="tls-insecure-skip-verify">#</a><a href="#tls-insecure-skip-verify">TLS\_INSECURE\_SKIP\_VERIFY</a> | Disable remote hosts TLS certificate chain and hostname checks. | `false` |
| <a className="entRef-anchor" id="tls-key">#</a><a href="#tls-key">TLS\_KEY</a> | base64-encoded string of tls-key | none |
| <a className="entRef-anchor" id="tls-key-file">#</a><a href="#tls-key-file">TLS\_KEY\_FILE</a> | file storing tls-key | none |
| <a className="entRef-anchor" id="use-static-assets">#</a><a href="#use-static-assets">USE\_STATIC\_ASSETS</a> | When false, forward static requests to `localhost:3000`. | `true` |
| <a className="entRef-anchor" id="validation_mode">#</a><a href="#validation_mode">VALIDATION\_MODE</a> | Validates config based on the specified mode: `full` (The default config validation mode), `static` (A "light" validation mode that catches most config issues), or `none` (Disables config validation). | `full` |

**Config file keys:**

| Name | Description | Default Value |
| :-- | :-- | --- |
| <a className="entRef-anchor" id="administrators">#</a><a href="#administrators">administrators</a> | A list of user ids, names or emails to make administrators. Useful for bootstrapping. | none |
| <a className="entRef-anchor" id="audience">#</a><a href="#audience">audience</a> | A list of audiences for verifying the signing key. | `[]` |
| <a className="entRef-anchor" id="authenticate-service-url">#</a><a href="#authenticate-service-url">authenticate\_service\_url</a> | (deprecated) Authenticate service URL is not required in the Console configuration. For Device Enrollment, use the [external route URL](https://www.pomerium.com/docs/reference/routes/from.md). | none |
| <a className="entRef-anchor" id="bind-addr">#</a><a href="#bind-addr">bind\_addr</a> | The address the Pomerium Console will listen on. | `:8701` |
| <a className="entRef-anchor" id="bootstrap-service-account">#</a><a href="#bootstrap-service-account">bootstrap\_service\_account</a> | Enable the bootstrap service account. | `false` |
| <a className="entRef-anchor" id="cache-dir">#</a><a href="#cache-dir">cache\_dir</a> | Directory to use for caching. | Cache only in memory. |
| <a className="entRef-anchor" id="customer-id">#</a><a href="#customer-id">customer\_id</a> | The customer ID | none |
| <a className="entRef-anchor" id="database-encryption-key">#</a><a href="#database-encryption-key">database\_encryption\_key</a> | The base64-encoded encryption key for encrypting sensitive data in the database. | none |
| <a className="entRef-anchor" id="database-encryption-key-file">#</a><a href="#database-encryption-key-file">database\_encryption\_key\_file</a> | Loads base64-encoded `database-encryption-key` secret from a file. | none |
| <a className="entRef-anchor" id="database-encryption-key-raw-file">#</a><a href="#database-encryption-key-raw-file">database\_encryption\_key\_raw\_file</a> | Loads `database-encryption-key` secret from a raw file. Setting this option from a raw file does not require base64 encoding. | none |
| <a className="entRef-anchor" id="database-url">#</a><a href="#database-url">database\_url</a> | The database Pomerium Enterprise Console will use. | `postgresql://pomerium:pomerium`<br />`@localhost:5432/dashboard?sslmode=disable` |
| <a className="entRef-anchor" id="databroker-service-url">#</a><a href="#databroker-service-url">databroker\_service\_url</a> | Databroker service URL for Console to reach Core. Leave unset in the default single-process deployment (Console uses `http://localhost:5443`). Set only when the databroker runs on another host/port or Core is split/remote. | `http://localhost:5443` |
| <a className="entRef-anchor" id="debug-config-dump">#</a><a href="#debug-config-dump">debug\_config\_dump</a> | Dumps the Databroker configuration. This is a debug option to be used only when specified by Pomerium Support. | `false` |
| <a className="entRef-anchor" id="directory-provider">#</a><a href="#directory-provider">directory\_provider</a> | Directory-sync provider Pomerium uses to enumerate users and groups. Empty disables directory sync. | none |
| <a className="entRef-anchor" id="directory-provider-options">#</a><a href="#directory-provider-options">directory\_provider\_options</a> | Provider-specific options for the directory provider, as a JSON object. | none |
| <a className="entRef-anchor" id="directory-provider-refresh-interval">#</a><a href="#directory-provider-refresh-interval">directory\_provider\_refresh\_interval</a> | How often Pomerium refreshes the directory cache. | `10m` |
| <a className="entRef-anchor" id="directory-provider-refresh-timeout">#</a><a href="#directory-provider-refresh-timeout">directory\_provider\_refresh\_timeout</a> | Per-attempt timeout for a single directory refresh cycle. | `10m` |
| <a className="entRef-anchor" id="disable-feedback-widget">#</a><a href="#disable-feedback-widget">disable\_feedback\_widget</a> | Disables third-party feedback widget and removes it from the Enterprise Console. | `false` |
| <a className="entRef-anchor" id="disable-remote-diagnostics">#</a><a href="#disable-remote-diagnostics">disable\_remote\_diagnostics</a> | Disable remote diagnostics. | `true` |
| <a className="entRef-anchor" id="disable-validation">#</a><a href="#disable-validation">disable\_validation</a> | (deprecated, please update your configuration to set `validation_mode=none` instead) Disable config validation. | `false` |
| <a className="entRef-anchor" id="grpc-addr">#</a><a href="#grpc-addr">grpc\_addr</a> | The address to listen for gRPC on. | `:8702` |
| <a className="entRef-anchor" id="help">#</a><a href="#help">help</a> | help for serve | `false` |
| <a className="entRef-anchor" id="license-key">#</a><a href="#license-key">license\_key</a> | Required: Provide the license key issued by your account team. | none |
| <a className="entRef-anchor" id="override-certificate-name">#</a><a href="#override-certificate-name">override\_certificate\_name</a> | Overrides the certificate name used for the databroker connection. | none |
| <a className="entRef-anchor" id="prometheus-data-dir">#</a><a href="#prometheus-data-dir">prometheus\_data\_dir</a> | The path to Prometheus data | none |
| <a className="entRef-anchor" id="prometheus-listen-addr">#</a><a href="#prometheus-listen-addr">prometheus\_listen\_addr</a> | When set, embedded Prometheus listens at this address. Set as `host:port` | `127.0.0.1:9090` |
| <a className="entRef-anchor" id="prometheus-scrape-interval">#</a><a href="#prometheus-scrape-interval">prometheus\_scrape\_interval</a> | The Prometheus scrape frequency | `10s` |
| <a className="entRef-anchor" id="prometheus-url">#</a><a href="#prometheus-url">prometheus\_url</a> | The URL to access the Prometheus metrics server. | none |
| <a className="entRef-anchor" id="shared-secret">#</a><a href="#shared-secret">shared\_secret</a> | The base64-encoded secret for signing JWTs, shared with OSS Pomerium. | none |
| <a className="entRef-anchor" id="shared-secret-file">#</a><a href="#shared-secret-file">shared\_secret\_file</a> | Loads base64-encoded `shared-secret` from a file. | none |
| <a className="entRef-anchor" id="shared-secret-raw-file">#</a><a href="#shared-secret-raw-file">shared\_secret\_raw\_file</a> | Loads `shared-secret` from a raw file. Setting this option from a raw file does not require base64 encoding. | none |
| <a className="entRef-anchor" id="signing-key">#</a><a href="#signing-key">signing\_key</a> | (deprecated) base64-encoded signing key (public or private) for verifying JWTs. This option is no longer required in the Console config. | none |
| <a className="entRef-anchor" id="signing-key-file">#</a><a href="#signing-key-file">signing\_key\_file</a> | Loads base64-encoded `signing-key` secret from a file. | none |
| <a className="entRef-anchor" id="signing-key-raw-file">#</a><a href="#signing-key-raw-file">signing\_key\_raw\_file</a> | Loads `signing-key` secret from a raw file. Setting this option from a raw file does not require base64 encoding. | none |
| <a className="entRef-anchor" id="tls-ca">#</a><a href="#tls-ca">tls\_ca</a> | base64-encoded string of tls-ca | none |
| <a className="entRef-anchor" id="tls-ca-file">#</a><a href="#tls-ca-file">tls\_ca\_file</a> | file storing tls-ca | none |
| <a className="entRef-anchor" id="tls-cert">#</a><a href="#tls-cert">tls\_cert</a> | base64-encoded string of tls-cert | none |
| <a className="entRef-anchor" id="tls-cert-file">#</a><a href="#tls-cert-file">tls\_cert\_file</a> | file storing tls-cert | none |
| <a className="entRef-anchor" id="tls-derive">#</a><a href="#tls-derive">tls\_derive</a> | Derives TLS server certificate for the console HTTPS and gRPC endpoints for the host specified by this option, using the CA derived from the shared key. Uses this CA to verify the server certificate presented by the Databroker gRPC TLS when the [`tls_derive`](https://www.pomerium.com/docs/reference/tls-derive.md) option is set in the Pomerium Core. | none |
| <a className="entRef-anchor" id="tls-insecure-skip-verify">#</a><a href="#tls-insecure-skip-verify">tls\_insecure\_skip\_verify</a> | Disable remote hosts TLS certificate chain and hostname checks. | `false` |
| <a className="entRef-anchor" id="tls-key">#</a><a href="#tls-key">tls\_key</a> | base64-encoded string of tls-key | none |
| <a className="entRef-anchor" id="tls-key-file">#</a><a href="#tls-key-file">tls\_key\_file</a> | file storing tls-key | none |
| <a className="entRef-anchor" id="use-static-assets">#</a><a href="#use-static-assets">use\_static\_assets</a> | When false, forward static requests to `localhost:3000`. | `true` |
| <a className="entRef-anchor" id="validation_mode">#</a><a href="#validation_mode">validation\_mode</a> | Validates config based on the specified mode: `full` (The default config validation mode), `static` (A "light" validation mode that catches most config issues), or `none` (Disables config validation). | `full` |