Configuration Reference

LiMon keeps its configuration in the database after setup. The Admin UI is the normal way to change servers, applications, sites, email, tools, reports, privacy and monitoring defaults; the configuration API does the same for scripts.

config.yml still matters, but not for day-to-day changes. It holds the database connection and other startup settings, and its YAML shape doubles as the portable export/import format for backup, migration and support.

Configuration Sources

LiMon builds the effective configuration in layers:

defaults.yml ships with each release and is never edited. New versions bring new defaults.
config.yml holds the database connection and any base values you set by hand.
Settings saved from the Setup Wizard, Admin UI or configuration API are stored in the database and win over both files.

Monitored servers live only in the database. A servers section in config.yml seeds the first setup and is read by an import; after that, servers are managed from Admin → Servers.

Every saved change bumps a configuration revision. The monitor applies it at the start of its next polling cycle and the API within about a minute, so routine changes need no restart. A restart is needed only for settings read when a process starts: the database section, api.workers and api.db_pool_size. The save response names any of these it touched.

Note

Hand edits to config.yml are read on process start, and a value saved in the Admin UI still wins over the file. Use the Admin UI for anything it offers.

Export and Import

Admin → Settings → About has Export config.yml and Import buttons. The same operations are available as API calls:

Action	Endpoint	Notes
Export	`POST /api/v1/config/export`	Downloads the effective configuration as YAML, including servers, sites and applications.
Import	`POST /api/v1/config/import`	Uploads a YAML file as the multipart field `file`.

Both need the admin permission (the API key or an Admin session) and a valid license.

What to expect from an import:

It is all or nothing. Every section is validated first and written in one transaction; one invalid server, site or setting rejects the whole file.
Secrets are not exported. Passwords come out empty, and the API key is never included. On import, an empty SMTP or directory password keeps the one already stored. If none is stored, that feature stays off and the response says what to enter.
Some sections are never imported: database, licensing and the API key. They have their own channels.
A servers section replaces the server set. Servers in the file are added or updated; active servers missing from it are marked pending decommission and are decommissioned after monitoring.server_grace_period_days (7 by default). Leave the section out to keep servers untouched. Your license tier's server limit applies to the imported set.
Sites and applications are merged. Sites are matched by code and applications by name; entries are added or updated, and nothing is deleted.

Sections

This is a compact operator reference, not a full dump of defaults.yml.

Section	What it controls
`database`	MariaDB/MySQL connection: host, port, user, password, database name. LiMon's own pool settings live under `database.policy` (`pool_size`, `max_connections_allowance`, `operational_headroom`). Startup-only, never imported.
`company`	Organisation name, contact and email, collected by the setup wizard and shown on the About page.
`api`	Trusted reverse proxies, Gunicorn worker count and pool size, response cache TTL, and browser log-import limits (files, file size, batch size, staged size, stall timeout). The API key itself is managed with `limon-manage` or under Admin → Settings → About; see API Reference.
`auth`	Sign-in: access mode, account source (local or directory), directory role rules, session lifetime, idle timeout, lockout and throttling. Managed under Admin → Access; see Authentication.
`monitoring`	Instance name, timezone, polling interval, retention horizons, server grace period, reports folder, expiry warning intervals and long-session threshold.
`smtp`	Mail relay host, port, sender, credentials, TLS/SSL and timeout. Managed under Admin → Settings → Notifications.
`notifications`	Email pacing, announcement recipient cap and batch size, and the public URL used in notification links. Routes and recipients are managed in the UI; see Notifications.
`ldap`	Directory sync: directory type, server, base DN, bind account, batch size, timeouts, TLS (StartTLS, CA bundle) and attribute overrides.
`tools`	Vendor utility paths for FlexLM, RLM, LM-X, DSLS and Sentinel RMS. Admin → Settings → Tools validates them.
`servers`	Servers grouped by vendor. Seeds the first setup and carries servers through export/import.
`sites`	Locations used for rollups, reports and server assignment.
`applications`	Product definitions and feature groupings.
`feature_ignore`	Per-vendor and global feature tokens excluded from monitoring and reports.
`reports`	PDF styling, retention, output directory, collector thresholds (business days, unlimited-pool threshold, daily load hours) and the report job queue limits.
`privacy`	Username and workstation pseudonymization after a retention period, and the default masking of usernames in reports.
`compliance.ledger`	Daily evidence sealing, signing-key path, finalization delay, retention and export limits. Only `enabled` is managed in the Admin UI; see Compliance Ledger.
`log_import`	Longest session an import will pair from a checkout and a check-in (30 days by default).
`parser_compatibility`	Parser packs and the completeness checks applied to vendor output. Leave the defaults unless support asks you to change them.
`background_activity`	How long each background task may go without activity, or run, before the health checks report it overdue.
`logging`	Log level, directory and file name.

Common Defaults

Key	Default	Notes
`monitoring.collection_interval`	`10`	Polling interval in minutes.
`monitoring.raw_data_retention_weeks`	`52`	Raw poll and session history.
`monitoring.evidence_retention_weeks`	`260`	Consolidated hourly evidence behind reports. `0` keeps it forever.
`monitoring.server_grace_period_days`	`7`	How long a removed server stays pending before it is decommissioned.
`monitoring.expiration_notification_intervals`	`[60, 30, 7, 1]`	Days before expiry at which licenses are flagged.
`monitoring.reports_folder`	`/opt/limon/reports`	Dashboard snapshots and Prometheus output.
`api.cache_ttl_seconds`	`90`	Cache duration for selected API responses.
`smtp.port`	`587`	SMTP submission port.
`reports.output.directory`	`/opt/limon/reports/intelligence`	Intelligence PDF output.
`reports.retention_days`	`90`	How long generated reports are kept.
`reports.money.currency`	`EUR`	Default report currency.
`reports.jobs.max_inflight_ad_hoc_jobs`	`5`	On-demand PDF jobs queued or running at once; scheduled reports are exempt.
`privacy.anonymize_after_days`	`null`	Never. The Admin UI offers 30, 60, 90, 180 or 365 days.
`compliance.ledger.enabled`	`false`	Off until switched on in Admin → Settings → Compliance Ledger.

Example YAML Shape

The export/import format looks like the bootstrap YAML. Servers are grouped by vendor and named port@host, where the host uses only letters, digits, dots and hyphens. description and site_code are optional:

servers:
  flexlm:
    - server: "27000@flexlm-server1.example.com"
      description: "Engineering CAD Licenses"
      site_code: "US-NYC"
    - server: "27001@flexlm-server2.example.com"
      description: "Simulation Software Licenses"
      site_code: "UK-LDN"

  rlm:
    - server: "5053@rlm-server.example.com"
      description: "Development Tools"

  lmx:
    - server: "6200@lmx-server.example.com"
      description: "Analysis Software"

  dsls:
    - server: "40000@dsls-server.example.com"
      description: "CATIA Licenses"

  sentinel:
    - server: "5093@sentinel-server.example.com"
      description: "Sentinel RMS Licenses"

Remember that importing this section replaces the server set: an export taken before you added a server will mark that server for decommission when imported.