Variable reference
Auto-generated by
scripts/build-reference.py. Do not edit by hand.
| Variable | Type | Default | Controls | Documented in |
|---|---|---|---|---|
_AEGIR_UPGRADE_ONLY |
boolean | (see source) |
run only the Aegir-side upgrade steps (aegir keyword) | /operating/control-files-ini/barracuda-cnf |
_AUTOPILOT |
boolean | (see source) |
answer Y to every prompt in silent mode | /operating/control-files-ini/barracuda-cnf |
_AUTOPILOT |
boolean | NO |
silent mode for octopus install/upgrade | /operating/control-files-ini/octopus-cnf |
_AUTOSYMLINK_NIGHTLY |
boolean | NO |
nightly updatesymlinks --auto-fix run (cron :47, 22:00-05:59) converting site files/private dirs into the per-account static store; seeded YES on .aegir.cc-hostname boxes when the line is absent | /operating/control-files-ini/barracuda-cnf |
_AUTOSYMLINK_PAUSE_GRACE |
integer | 240 |
seconds held after pausing the Aegir task queue before draining provision in updatesymlinks --auto-fix (0 skips the wait); runtime fallback, not in the settings template | /operating/control-files-ini/barracuda-cnf |
_AUTO_OCT_UP_HOUR |
integer | (see source) |
hour for octopus upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_OCT_UP_MINUTE |
integer | (see source) |
minute for octopus upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_PHP |
string | (see source) |
which PHP versions the auto-upgrade rebuilds (php-min, php-all or php-max) | /operating/control-files-ini/barracuda-cnf |
_AUTO_UP_DAY |
integer | (see source) |
day (1-31) for one-time full upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_UP_HOUR |
integer | (see source) |
hour (0-23) for barracuda upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_UP_MINUTE |
integer | (see source) |
minute (0-59) for barracuda upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_UP_MONTH |
integer | (see source) |
month (1-12) for one-time full upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_UP_WEEKLY |
integer | (see source) |
weekday (1-7) for weekly system upgrade | /operating/control-files-ini/barracuda-cnf |
_AUTO_VER |
string | dev |
release tier (lts, pro or dev) mapped to barracuda/octopus up-<tier> | /operating/control-files-ini/barracuda-cnf |
_BACKEND_ITEMS_LIST |
list | (see source) |
internal list of backend items the upgrade walks | /operating/control-files-ini/barracuda-cnf |
_BEOWULF_TO_CHIMAERA |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_BOOKWORM_TO_DAEDALUS |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_BOOKWORM_TO_TRIXIE |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_BULLSEYE_TO_BOOKWORM |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_BULLSEYE_TO_CHIMAERA |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_BUSTER_TO_BEOWULF |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_BUSTER_TO_BULLSEYE |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_B_NICE |
integer | 0 |
nice level the monitor agents (second.sh, minute.sh, nginx_guard.sh and friends) renice themselves to; clamped to -20..19 | /operating/control-files-ini/barracuda-cnf |
_CHIMAERA_TO_DAEDALUS |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_CLEAR_BOOST |
boolean | YES |
daily Speed Booster boost-cache clearing during nightly per-site maintenance | /operating/control-files-ini/barracuda-cnf |
_CLIENT_CORES |
integer | 1 |
engine/core multiplier for shared-plan PHP-FPM worker count (read from log/cores.txt) | /operating/control-files-ini/octopus-cnf |
_CLIENT_EMAIL |
string | (see source) |
create separate client user if different from _MY_OCTO_EMAIL | /operating/control-files-ini/octopus-cnf |
_CLIENT_OPTION |
string | (see source) |
PHP-FPM resource plan tier — shared plans (POWER and below) use fixed per-plan worker + memory limits; dedicated plans (PHANTOM and above) size dynamically from RAM/CPU | /operating/control-files-ini/octopus-cnf |
_CLIENT_SUBSCR |
string | (see source) |
reserved client metadata (currently not used) | /operating/control-files-ini/octopus-cnf |
_CPU_CRIT_RATIO |
string | 8.1 |
per-core max load before killing PHP/Drush | /operating/control-files-ini/barracuda-cnf |
_CPU_MAX_RATIO |
string | 6.1 |
per-core max load before disabling Nginx | /operating/control-files-ini/barracuda-cnf |
_CPU_SPIDER_RATIO |
string | 2.1 |
per-core max load before blocking spiders | /operating/control-files-ini/barracuda-cnf |
_CPU_TASK_RATIO |
string | 3.1 |
per-core max load to launch tasks queue | /operating/control-files-ini/barracuda-cnf |
_CUSTOM_COLLATION_SQL |
string | utf8mb4_unicode_ci |
server-level collation override | /operating/control-files-ini/barracuda-cnf |
_CUSTOM_CONFIG_CSF |
boolean | (see source) |
protect custom CSF config | /operating/control-files-ini/barracuda-cnf |
_CUSTOM_CONFIG_LSHELL |
boolean | (see source) |
protect custom Limited Shell config | /operating/control-files-ini/barracuda-cnf |
_CUSTOM_CONFIG_REDIS |
boolean | (see source) |
protect custom Redis config | /operating/control-files-ini/barracuda-cnf |
_CUSTOM_CONFIG_SQL |
boolean | (see source) |
protect custom SQL config | /operating/control-files-ini/barracuda-cnf |
_CUSTOM_CONFIG_VALKEY |
boolean | (see source) |
protect custom Valkey config | /operating/control-files-ini/barracuda-cnf |
_DAEDALUS_TO_EXCALIBUR |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_DB_BINARY_LOG |
boolean | (see source) |
enable binary logging | /operating/control-files-ini/barracuda-cnf |
_DB_SERIES |
string | (see source) |
Percona series (5.7, 8.0 or 8.4) | /operating/control-files-ini/barracuda-cnf |
_DB_SERVER |
string | (see source) |
database server (Percona or MySQL Server) | /operating/control-files-ini/barracuda-cnf |
_DEBUG_MODE |
boolean | (see source) |
verbose BOA mode | /operating/control-files-ini/barracuda-cnf |
_DEBUG_MODE |
boolean | NO |
enable Drush debugging | /operating/control-files-ini/octopus-cnf |
_DEL_OLD_BACKUPS |
integer | 0 |
delete Aegir and b-migrate backups older than N days (0 = off) | /operating/control-files-ini/octopus-cnf |
_DEL_OLD_EMPTY_PLATFORMS |
integer | 0 |
delete empty platforms verified more than N days ago (0 = off) | /operating/control-files-ini/octopus-cnf |
_DEL_OLD_TMP |
integer | 0 |
delete sites temp files older than N days (0 = off) | /operating/control-files-ini/octopus-cnf |
_DL_MODE |
string | (see source) |
installer source preference (BATCH, GIT or OLD) | /operating/control-files-ini/barracuda-cnf |
_DL_MODE |
string | (see source) |
install source mode (BATCH, GIT or OLD) | /operating/control-files-ini/octopus-cnf |
_DNS_SETUP_TEST |
boolean | (see source) |
skip DNS testing | /operating/control-files-ini/barracuda-cnf |
_DNS_SETUP_TEST |
boolean | NO |
skip DNS testing during this upgrade | /operating/control-files-ini/octopus-cnf |
_DOMAIN |
string | (see source) |
Aegir control panel URL (override-from-log group) | /operating/control-files-ini/octopus-cnf |
_EASY_HOSTNAME |
string | (see source) |
hostname auto-configured via _EASY_SETUP | /operating/control-files-ini/barracuda-cnf |
_ENABLE_GOACCESS |
boolean | (see source) |
generate stats with GoAccess | /operating/control-files-ini/barracuda-cnf |
_EXTRA_PACKAGES |
list | (see source) |
extra apt packages to install | /operating/control-files-ini/barracuda-cnf |
_FORCE_GIT_MIRROR |
string | (see source) |
alternate git mirror (deprecated) | /operating/control-files-ini/barracuda-cnf |
_FORCE_GIT_MIRROR |
string | (see source) |
alternate git mirror (deprecated) | /operating/control-files-ini/octopus-cnf |
_FULL_FORCE_REINSTALL |
boolean | (see source) |
force full BOA reinstall on next upgrade | /operating/control-files-ini/barracuda-cnf |
_GHOST_ALIASES_CLEANUP |
boolean | NO |
reap stale per-site Drush alias copies in the limited-shell (FTPS) user tree (manage_ltd_users.sh, every 3 min); NO = dry-run; per-account opt-in in octopus.cnf | /operating/control-files-ini/barracuda-cnf |
_GHOST_ALIASES_CLEANUP |
boolean | NO |
per-account opt-in for reaping stale per-site alias copies in the limited-shell (FTPS) user tree | /operating/control-files-ini/octopus-cnf |
_GHOST_CODEBASES_CLEANUP |
boolean | NO |
nightly move of ghost codebases under distro/ (no detectable docroot at root or web/docroot/html) into a backup dir; NO = dry-run | /operating/control-files-ini/barracuda-cnf |
_GHOST_PLATFORMS_CLEANUP |
boolean | NO |
nightly move of ghost/empty platform alias registrations into undo/; NO = dry-run; per-account opt-in also possible in octopus.cnf | /operating/control-files-ini/barracuda-cnf |
_GHOST_PLATFORMS_CLEANUP |
boolean | NO |
per-account opt-in for the nightly ghost/empty platform-alias cleanup; YES here or in barracuda.cnf enables it for this account (dry-run otherwise) | /operating/control-files-ini/octopus-cnf |
_GHOST_SITES_CLEANUP |
boolean | NO |
nightly move of site registrations (alias + vhost) whose site directory is gone; NO = dry-run; per-account opt-in in octopus.cnf | /operating/control-files-ini/barracuda-cnf |
_GHOST_SITES_CLEANUP |
boolean | NO |
per-account opt-in for the nightly ghost site-registration cleanup (alias + vhost whose site dir is gone); YES here or in barracuda.cnf enables | /operating/control-files-ini/octopus-cnf |
_GHOST_SITE_FILES_CLEANUP |
boolean | NO |
also move a ghost site's leftover files directory when _GHOST_SITES_CLEANUP acts; kept separate because it touches data; per-account opt-in in octopus.cnf | /operating/control-files-ini/barracuda-cnf |
_GHOST_SITE_FILES_CLEANUP |
boolean | NO |
per-account opt-in to also move a ghost site's leftover files directory when _GHOST_SITES_CLEANUP acts; separate because it touches data | /operating/control-files-ini/octopus-cnf |
_GHOST_VHOSTS_CLEANUP |
boolean | NO |
nightly move of nginx vhosts with no matching site Drush alias into undo/; NO = dry-run; per-account opt-in in octopus.cnf | /operating/control-files-ini/barracuda-cnf |
_GHOST_VHOSTS_CLEANUP |
boolean | NO |
per-account opt-in for the nightly ghost-vhost cleanup (vhost with no matching site alias); YES here or in barracuda.cnf enables | /operating/control-files-ini/octopus-cnf |
_GIT_FORCE_REINSTALL |
boolean | (see source) |
reinstall Git tooling on next upgrade | /operating/control-files-ini/barracuda-cnf |
_HM_ONLY |
boolean | NO |
upgrade Aegir Hostmaster only and skip platforms | /operating/control-files-ini/octopus-cnf |
_HOT_SAUCE |
boolean | NO |
force new platforms tree on install | /operating/control-files-ini/octopus-cnf |
_HOURLY_DB_BACKUPS |
boolean | (see source) |
schedule hourly DB backups in addition to nightly | /operating/control-files-ini/barracuda-cnf |
_ICU_FORCE_VRN |
string | (see source) |
pin ICU/intl to a dashed version on all PHP versions via apply/precheck/retire phases (commented out by default) | /operating/control-files-ini/barracuda-cnf |
_INCIDENT_REPORT |
string | MINI |
monitor incident notification depth (OFF, ALL, MINI or CRIT; legacy NO/YES normalized to OFF/MINI) | /operating/control-files-ini/barracuda-cnf |
_JESSIE_TO_BEOWULF |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_JESSIE_TO_STRETCH |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_KILL_MIN_RUNTIME |
integer | 900 |
loadguard-only kill-filter minimum process age in seconds; loadguard is manual-only (not cron-wired), second.sh is the live enforcement path | /operating/control-files-ini/barracuda-cnf |
_LE_CLIENT_NOTIFY |
boolean | YES |
client-facing Let's Encrypt renewal-failure notices (throttled to once per 7 days per failing site); only a literal NO disables; per-account octopus.cnf value overrides the global | /operating/control-files-ini/barracuda-cnf |
_LE_CLIENT_NOTIFY |
boolean | YES |
per-account override of the global client-facing Let's Encrypt renewal-failure notices; the per-account value wins and only a literal NO disables (not seeded in the template) | /operating/control-files-ini/octopus-cnf |
_LOADPROF_DATA |
string | /var/log/boa/load-profile |
loadreport history directory for --log/--data (environment tunable) | /operating/monitoring/loadreport |
_LOADPROF_INTERVAL |
integer | 1 |
loadreport sample interval in seconds, decimals allowed (environment tunable) | /operating/monitoring/loadreport |
_LOADPROF_KEEP_DAYS |
integer | 14 |
retention in days for loadreport --log JSONL pruning (environment tunable) | /operating/monitoring/loadreport |
_LOADPROF_PROC |
string | /proc |
procfs root seam so the sampler can run against a synthetic fixture - testing/internal only, not an operator tunable | /operating/monitoring/loadreport |
_LOADPROF_TOP |
integer | 25 |
rows in loadreport's BY COMMAND table (environment tunable) | /operating/monitoring/loadreport |
_LOADPROF_WINDOW |
integer | 60 |
loadreport profiling window in seconds (environment/flag tunable, NOT read from barracuda.cnf) | /operating/monitoring/loadreport |
_LOAD_IOWAIT_MIN |
integer | 10 |
min system iowait percent for high load to count as disk-bound, gating the backup-aware pause-skip of the MAX/CRIT load tiers | /operating/control-files-ini/barracuda-cnf |
_LOCAL_DEBIAN_MIRROR |
string | (see source) |
force non-default Debian mirror | /operating/control-files-ini/barracuda-cnf |
_LOCAL_DEVUAN_MIRROR |
string | (see source) |
force non-default Devuan mirror | /operating/control-files-ini/barracuda-cnf |
_LOCAL_NETWORK_HN |
string | (see source) |
hostname for localhost mode | /operating/control-files-ini/barracuda-cnf |
_LOCAL_NETWORK_IP |
string | (see source) |
web server IP for localhost mode | /operating/control-files-ini/barracuda-cnf |
_LOCAL_NETWORK_IP |
string | (see source) |
web server IP for localhost mode (auto-configured) | /operating/control-files-ini/octopus-cnf |
_MAGICK_FROM_SOURCES |
boolean | (see source) |
build ImageMagick from source | /operating/control-files-ini/barracuda-cnf |
_MODULES_FIX |
boolean | YES |
enable weekly modules fix | /operating/control-files-ini/barracuda-cnf |
_MODULES_SKIP |
list | (see source) |
modules never auto-disabled by maintenance agent | /operating/control-files-ini/barracuda-cnf |
_MONITOR_FANOUT_ITER |
integer | 9 NORMAL / 3 SLOW / 1 CI |
minute.sh auto-healing fan-out passes per minute (box-class throttle override) | /operating/control-files-ini/barracuda-cnf |
_MONITOR_FANOUT_SLEEP |
integer | 5 NORMAL / 18 SLOW / 5 CI |
minute.sh seconds between auto-healing fan-out passes (box-class throttle override) | /operating/control-files-ini/barracuda-cnf |
_MONITOR_HEAVY_EVERY |
integer | 1 NORMAL / 4 SLOW / 10 CI |
second.sh runs the heavy fan-out (process guards + security scanners) every Nth of its 10 passes; load sampling stays every pass | /operating/control-files-ini/barracuda-cnf |
_MY_EMAIL |
string | (see source) |
system-admin email for install/upgrade notifications | /operating/control-files-ini/barracuda-cnf |
_MY_FRONT |
string | master.<hostname> |
master Aegir UI URL | /operating/control-files-ini/barracuda-cnf |
_MY_HOSTN |
string | (see source) |
server hostname | /operating/control-files-ini/barracuda-cnf |
_MY_OCTO_EMAIL |
string | (see source) |
instance owner email for Aegir admin notifications | /operating/control-files-ini/octopus-cnf |
_MY_OWNIP |
string | (see source) |
web server IP if non-default | /operating/control-files-ini/barracuda-cnf |
_MY_OWNIP |
string | (see source) |
web server IP if non-default (inherited from barracuda.cnf) | /operating/control-files-ini/octopus-cnf |
_NEWRELIC_KEY |
string | (see source) |
New Relic license whose presence enables the agent | /operating/control-files-ini/barracuda-cnf |
_NGINX_DDOS_IP_MIN_REQS |
integer | 20 |
min requests an individual IP must have contributed under a confirmed DDoS UA before it is blocked (raised from 3) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DDOS_UA_IP_THRESHOLD |
integer | 100 |
distinct IPs sharing one exact User-Agent in the scan window before the UA is treated as a DDoS fingerprint (raised from 20) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DDOS_UA_REQ_THRESHOLD |
integer | 1000 |
per-UA total request count in the scan window required to declare a DDoS (raised from 200) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_DIV_INC_NR |
integer | (see source) |
default divisor for increments | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_IGNORE |
list | (see source) |
keywords to ignore requests if found | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_IGNORE_PATHS |
list | (see source) |
space-separated webhook/API endpoints exempt from IDS banning (setting here replaces the default list) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_INC_MIN |
integer | (see source) |
min allowed number for increments | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_LIMIT |
integer | 399 |
per-IP page-views limit (max 1999) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_LINES |
integer | (see source) |
access.log lines to check | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_LOG |
string | (see source) |
DoS-detector log verbosity (SILENT, NORMAL or VERBOSE) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_MODE |
integer | 2 |
DoS-detector algorithm (1 or 2) | /operating/control-files-ini/barracuda-cnf |
_NGINX_DOS_STOP |
string | (see source) |
SQL-injection-keyword regex that adds a full _NGINX_DOS_LIMIT to the per-IP counter on match (immediate ban) | /operating/control-files-ini/barracuda-cnf |
_NGINX_EXTRA_CONF |
string | (see source) |
custom configure-flags appended to Nginx build | /operating/control-files-ini/barracuda-cnf |
_NGINX_FORWARD_SECRECY |
boolean | YES |
install PFS support | /operating/control-files-ini/barracuda-cnf |
_NGINX_FPM_ERR_GLOB |
string | /var/log/php/php*-fpm-error.log |
glob of PHP-FPM per-version error logs watched by the saturation trigger | /operating/control-files-ini/barracuda-cnf |
_NGINX_FPM_SAT_DETECT |
boolean | YES |
PHP-FPM per-pool saturation early trigger (byte-offset tails the FPM error logs for new max_children ceiling hits; alerts + snapshots) | /operating/control-files-ini/barracuda-cnf |
_NGINX_FPM_SAT_PATTERN |
string | reached max_children setting |
literal the FPM master logs on pool max_children exhaustion, matched by the saturation trigger | /operating/control-files-ini/barracuda-cnf |
_NGINX_HEADERS |
boolean | (see source) |
install Headers More module | /operating/control-files-ini/barracuda-cnf |
_NGINX_HTTP10_AUTH_CIDR_THRESHOLD |
integer | 6 |
/24-aggregate windowed hits before every observed contributing IP of the block is banned (only IPs actually seen sending the signal) | /operating/control-files-ini/barracuda-cnf |
_NGINX_HTTP10_AUTH_DETECT |
boolean | YES |
HTTP/1.0 registration-spam auto-ban (scan_nginx Detector 4); set NO on boxes behind a non-BOA front proxy that downgrades to HTTP/1.0 at origin | /operating/control-files-ini/barracuda-cnf |
_NGINX_HTTP10_AUTH_IP_THRESHOLD |
integer | 3 |
per-IP windowed HTTP/1.0 auth-path hits before that IP is CSF-banned | /operating/control-files-ini/barracuda-cnf |
_NGINX_HTTP10_AUTH_PATHS |
string | ^/([a-z]{2}/)?user/(register|password)(/|$) |
ERE of watched Drupal auth paths for Detector 4; a malformed override fails closed (counts nothing) | /operating/control-files-ini/barracuda-cnf |
_NGINX_HTTP10_AUTH_WINDOW |
integer | 600 |
Detector 4 cross-run sliding-window length in seconds (/var/xdrago/monitor/log/http10_auth.window) | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_C444_THRESHOLD |
integer | 40 |
windowed localized 444s to one vhost (Tier-A limit_conn shedding) that trip the detector on their own, independent of volume | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_COOLDOWN |
integer | 300 |
per-vhost alert cooldown seconds to suppress repeat alerts/snapshots during one ongoing flood | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_DETECT |
boolean | YES |
Tier-B distributed localized-page (i18n) flood detector; alerts + snapshots per vhost, never bans per IP | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_MIN_REQS |
integer | 400 |
min windowed localized requests to one vhost before the volume+stress trip can fire | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_SLOW_SECS |
integer | 3 |
upstream response seconds above which a localized request counts as slow for the stress gate | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_STRESS_PCT |
integer | 15 |
percent of windowed localized requests that are slow/5xx/444 before volume+stress trips (benign peaks run near 0%) | /operating/control-files-ini/barracuda-cnf |
_NGINX_I18N_FLOOD_WINDOW |
integer | 120 |
i18n-flood cross-run sliding-window length in seconds | /operating/control-files-ini/barracuda-cnf |
_NGINX_LDAP |
boolean | (see source) |
install LDAP support | /operating/control-files-ini/barracuda-cnf |
_NGINX_NAXSI |
boolean | (see source) |
install NAXSI WAF (experimental) | /operating/control-files-ini/barracuda-cnf |
_NGINX_PATH_FLOOD_IP_MIN_REQS |
integer | 20 |
per-(prefix, IP) minimum 200-response count before that IP is blocked during a declared path flood (raised from 10; set 1 to block every 200-sending participant) | /operating/control-files-ini/barracuda-cnf |
_NGINX_PATH_FLOOD_IP_THRESHOLD |
integer | 30 |
distinct IPs hitting one path prefix (200 and 444 responses) in the scan window before a path flood is declared | /operating/control-files-ini/barracuda-cnf |
_NGINX_PATH_FLOOD_REQ_THRESHOLD |
integer | 100 |
total 200+444 responses to one watched path prefix in the scan window before a path flood is declared (raised from 15) | /operating/control-files-ini/barracuda-cnf |
_NGINX_PHP_PROBE_WEIGHT |
integer | (see source) |
webshell .php-probe fast-ban weight (default _NGINX_DOS_LIMIT / 3) | /operating/control-files-ini/barracuda-cnf |
_NGINX_SPDY |
boolean | YES |
install SPDY | /operating/control-files-ini/barracuda-cnf |
_NGINX_UA_BURST_BAD_PCT |
integer | 80 |
min percent of the UA's requests that are 3xx/4xx before the fleet is declared hostile (the false-positive keystone) | /operating/control-files-ini/barracuda-cnf |
_NGINX_UA_BURST_DETECT |
boolean | YES |
distributed UA-burst scanner-fleet detector (one forged UA across many IPs, overwhelmingly 3xx/4xx); NO disables | /operating/control-files-ini/barracuda-cnf |
_NGINX_UA_BURST_IP_MIN |
integer | 12 |
min distinct IPs sharing one exact UA in the scan window | /operating/control-files-ini/barracuda-cnf |
_NGINX_UA_BURST_IP_MIN_BAD |
integer | 3 |
min bad (3xx/4xx) probes an individual IP must have sent under the tripped UA before that IP is blocked | /operating/control-files-ini/barracuda-cnf |
_NGINX_UA_BURST_REQ_MIN |
integer | 60 |
min total requests for that UA across all its IPs in the window | /operating/control-files-ini/barracuda-cnf |
_NGINX_V6_BAN_DETECT |
boolean | YES |
nginx-native IPv6 adaptive web-ban arm of scan_nginx; scores IPv6 realip clients (only reachable via the trusted proxy) with the same detectors and bans them via nginx_deny6.sh into nginx_banned_ips.conf6 (csf is IPv4-only). Set NO to restore the pre-existing IPv4-only behaviour | /operating/control-files-ini/barracuda-cnf |
_NGINX_V6_BAN_TTL |
integer | 900 |
seconds an IPv6 web ban lives in the nginx-native store before nginx_deny6.sh prunes it (the nginx equivalent of the csf 900s temp ban); a re-offence refreshes it | /operating/control-files-ini/barracuda-cnf |
_NGINX_WORKERS |
string | (see source) |
override worker_processes (AUTO or an integer) | /operating/control-files-ini/barracuda-cnf |
_NGX_FORCE_REINSTALL |
boolean | (see source) |
reinstall Nginx on next upgrade | /operating/control-files-ini/barracuda-cnf |
_NIGHT_MAX_PARALLEL |
integer | (empty = CPU cores) |
max concurrent per-account owl.sh workers when _NIGHT_PARALLEL=YES; each launch still load-gated | /operating/control-files-ini/barracuda-cnf |
_NIGHT_PARALLEL |
boolean | NO |
owl.sh nightly maintenance processes Octopus accounts in parallel instead of serially | /operating/control-files-ini/barracuda-cnf |
_ORPHAN_FILES_REPORT |
boolean | NO |
daily read-only orphaned files-store email report to _MY_EMAIL, sent only when something is found; seeded YES on .aegir.cc hosts | /operating/control-files-ini/barracuda-cnf |
_PERMISSIONS_FIX |
boolean | YES |
enable daily site re-verify | /operating/control-files-ini/barracuda-cnf |
_PHP_CLI_VERSION |
string | (see source) |
default PHP-CLI version | /operating/control-files-ini/barracuda-cnf |
_PHP_CLI_VERSION |
string | 8.4 |
PHP-CLI version for this Satellite | /operating/control-files-ini/octopus-cnf |
_PHP_EXTRA_CONF |
string | (see source) |
custom configure-flags appended to PHP build | /operating/control-files-ini/barracuda-cnf |
_PHP_FORCE_REINSTALL |
boolean | (see source) |
reinstall all PHP versions on next upgrade | /operating/control-files-ini/barracuda-cnf |
_PHP_FPM_CPU_FACTOR |
string | AUTO |
CPU sanity multiplier capping dedicated-plan pm.max_children at cores x factor (AUTO = 8) | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_DENY |
list | (see source) |
per-host disable_functions list | /operating/control-files-ini/barracuda-cnf |
_PHP_FPM_DENY |
string | (see source) |
per-instance disable_functions list | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_MAX_CHILDREN_FORCE |
string | AUTO |
pin an exact per-pool pm.max_children (minimum 8); AUTO keeps the adaptive calc | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_MEMORY_LIMIT_FORCE |
string | AUTO |
pin an exact per-pool PHP-FPM memory_limit in MB (minimum 64); AUTO keeps the plan policy | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_RAM_PCT |
string | AUTO |
percent of total RAM budgeted for dedicated-plan FPM workers (AUTO = 50) | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_TIMEOUT |
string | 180 |
PHP-FPM timeout (AUTO or 60-180 override) | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_USS_MB |
integer | AUTO (64) |
measured per-child private (USS) footprint in MB used by the dedicated-plan pm.max_children formula min(RAM_PHP_FPM_RAM_PCT%/this, cores_PHP_FPM_CPU_FACTOR) | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_VERSION |
string | (see source) |
default PHP-FPM version | /operating/control-files-ini/barracuda-cnf |
_PHP_FPM_VERSION |
string | 8.4 |
PHP-FPM version for this Satellite | /operating/control-files-ini/octopus-cnf |
_PHP_FPM_WORKERS |
string | (see source) |
override pm.max_children (AUTO or an integer) | /operating/control-files-ini/barracuda-cnf |
_PHP_FPM_WORKERS |
string | AUTO |
PHP-FPM worker count (AUTO or integer override) | /operating/control-files-ini/octopus-cnf |
_PHP_GEOS |
boolean | (see source) |
deprecated no-op (GEOS now built unconditionally for every PHP version except 5.6) | /operating/control-files-ini/barracuda-cnf |
_PHP_IONCUBE |
boolean | (see source) |
install ionCube loader for all PHP versions | /operating/control-files-ini/barracuda-cnf |
_PHP_MONGODB |
boolean | (see source) |
install MongoDB extension for all PHP versions | /operating/control-files-ini/barracuda-cnf |
_PHP_MULTI_INSTALL |
list | (see source) |
comma-separated list of PHP versions to install | /operating/control-files-ini/barracuda-cnf |
_PHP_SINGLE_INSTALL |
string | (see source) |
must be empty for _PHP_MULTI_INSTALL to apply | /operating/control-files-ini/barracuda-cnf |
_PLATFORMS_LIST |
list | ALL |
platform symbols to install (ALL or explicit list) | /operating/control-files-ini/octopus-cnf |
_PLATFORMS_ONLY |
boolean | NO |
install only new Aegir platforms and skip the rest (sibling of _HM_ONLY); now persisted on fresh install and back-filled on upgrade | /operating/control-files-ini/octopus-cnf |
_REDIS_LISTEN_MODE |
string | (see source) |
Redis listen mode (SOCKET recommended or PORT) | /operating/control-files-ini/barracuda-cnf |
_REDIS_MAJOR_RELEASE |
integer | 7 |
Redis major release (5, 6 or 7) | /operating/control-files-ini/barracuda-cnf |
_RESERVED_RAM |
integer | 0 |
MB to reserve for non-BOA apps when sizing memory limits | /operating/control-files-ini/barracuda-cnf |
_RESERVED_RAM |
integer | (see source) |
MB reserved for non-BOA apps on the host | /operating/control-files-ini/octopus-cnf |
_RESUME_FRACTION |
string | 0.8 |
resume hysteresis - web stays paused until both 1m and 5m per-CPU load fall below MAX threshold times this fraction; clamped to (0,1) | /operating/control-files-ini/barracuda-cnf |
_SHARED_CODEBASES_CLEANUP |
boolean | NO |
nightly move of unused legacy D6/D7 shared codebases under /data/all into a codebases-cleanup backup dir; NO = detect/log only (dry-run) | /operating/control-files-ini/barracuda-cnf |
_SITES_COLLATION_SQL |
string | utf8mb4_unicode_ci |
default collation for hosted-site databases | /operating/control-files-ini/octopus-cnf |
_SKYNET_MODE |
string | ON |
SKYNET auto-update mode (ON or OFF) | /operating/control-files-ini/barracuda-cnf |
_SMTP_RELAY_HOST |
string | (see source) |
SMTP relay host with no auth | /operating/control-files-ini/barracuda-cnf |
_SMTP_RELAY_TEST |
boolean | (see source) |
skip SMTP availability tests | /operating/control-files-ini/barracuda-cnf |
_SPEED_VALID_MAX |
integer | 3600 |
Speed Booster hourly cache TTL in seconds | /operating/control-files-ini/barracuda-cnf |
_SQL_CONVERT |
string | NO |
auto DB conversion (NO, innodb, YES or myisam) | /operating/control-files-ini/octopus-cnf |
_SQL_FORCE_REINSTALL |
boolean | (see source) |
reinstall Percona/MySQL on next upgrade | /operating/control-files-ini/barracuda-cnf |
_SQL_LOW_MAX_TTL |
integer | (see source) |
max TTL in seconds per problematic-user mysql process | /operating/control-files-ini/barracuda-cnf |
_SQL_MAX_TTL |
integer | 3600 |
max TTL in seconds per user mysql process | /operating/control-files-ini/barracuda-cnf |
_SSH_ARMOUR |
boolean | (see source) |
enable stricter OpenSSH hardening | /operating/control-files-ini/barracuda-cnf |
_SSH_FROM_SOURCES |
boolean | YES |
build OpenSSH from source | /operating/control-files-ini/barracuda-cnf |
_SSH_PORT |
integer | 22 |
SSH port (22 default or any other valid port) | /operating/control-files-ini/barracuda-cnf |
_SSL_FORCE_REINSTALL |
boolean | NO |
transient one-shot - YES forces an OpenSSL source rebuild on the next barracuda run and cascades _SSH/_NGX/_PHP_FORCE_REINSTALL=YES; consumed and scrubbed from the cnf after use, never persisted | /operating/control-files-ini/barracuda-cnf |
_STRETCH_TO_BEOWULF |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_STRETCH_TO_BUSTER |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_STRICT_BIN_PERMISSIONS |
boolean | YES |
aggressively protect /usr/local/bin and similar | /operating/control-files-ini/barracuda-cnf |
_STRONG_PASSWORDS |
string | YES |
password length (YES=64, NO=32 or N chars in range 32-128) | /operating/control-files-ini/barracuda-cnf |
_STRONG_PASSWORDS |
string | (see source) |
password length (YES = 64-char, NO = 32-char, or integer 32-128) | /operating/control-files-ini/octopus-cnf |
_SYSTEM_UP_ONLY |
boolean | (see source) |
run only the system-side upgrade steps (system keyword) | /operating/control-files-ini/barracuda-cnf |
_THIS_DB_HOST |
string | (see source) |
DB host as localhost or FQDN | /operating/control-files-ini/barracuda-cnf |
_THIS_DB_HOST |
string | (see source) |
database host inherited from barracuda.cnf (localhost or FQDN) | /operating/control-files-ini/octopus-cnf |
_THIS_DB_PORT |
integer | 3306 |
auto-managed per-instance DB port - rewritten to 6033 when ProxySQL is active for the instance (/data/conf/<user>_use_proxysql.txt); do not hand-edit | /operating/control-files-ini/octopus-cnf |
_TRIXIE_TO_EXCALIBUR |
string | (see source) |
internal OS-version transition marker (do not edit by hand) | /operating/control-files-ini/barracuda-cnf |
_USER |
string | (see source) |
Octopus instance system account (e.g. o1, o2) | /operating/control-files-ini/octopus-cnf |
_USE_CURRENT |
boolean | YES |
force new platforms tree on upgrade | /operating/control-files-ini/octopus-cnf |
_USE_MYSQLTUNER |
boolean | (see source) |
use MySQLTuner to size limits | /operating/control-files-ini/barracuda-cnf |
_VALKEY_LISTEN_MODE |
string | (see source) |
Valkey listen mode (SOCKET recommended or PORT) | /operating/control-files-ini/barracuda-cnf |
_VALKEY_MAJOR_RELEASE |
integer | 9 |
Valkey major release (7, 8 or 9) | /operating/control-files-ini/barracuda-cnf |
_XTRAS_LIST |
list | (see source) |
optional add-on packages | /operating/control-files-ini/barracuda-cnf |
advagg_auto_configuration |
boolean | FALSE |
auto-configure AdvAgg at global.inc level when present | /operating/control-files-ini/ini-precedence |
allow_anon_node_add |
boolean | FALSE |
allow anonymous users to access node/add (also opens node edit) | /operating/control-files-ini/ini-precedence |
allow_anon_node_add |
boolean | FALSE |
permit anonymous node-add submissions on this site | /operating/control-files-ini/ini-precedence |
allow_private_file_downloads |
boolean | FALSE |
allow Drupal private-file mode (commerce or intranet only) | /operating/control-files-ini/ini-precedence |
allow_private_file_downloads |
boolean | FALSE |
allow Drupal private-filesystem downloads for this site | /operating/control-files-ini/ini-precedence |
auto_detect_domain_access_integration |
boolean | FALSE |
auto-include the Domain Access module if detected during daily run | /operating/control-files-ini/ini-precedence |
auto_detect_domain_access_integration |
boolean | FALSE |
per-site override of Domain Access auto-detection | /operating/control-files-ini/ini-precedence |
auto_detect_facebook_integration |
boolean | FALSE |
auto-include the Drupal-for-Facebook (fb) module if detected | /operating/control-files-ini/ini-precedence |
auto_detect_facebook_integration |
boolean | FALSE |
per-site override of Facebook integration auto-detection | /operating/control-files-ini/ini-precedence |
disable_admin_dos_protection |
boolean | FALSE |
allow anonymous users to reach /admin* URLs (DoS risk) | /operating/control-files-ini/ini-precedence |
disable_admin_dos_protection |
boolean | FALSE |
disable the admin-path DoS protection for this site | /operating/control-files-ini/ini-precedence |
disable_drupal_page_cache |
boolean | FALSE |
disable Drupal own page cache (severely degrades non-microcached requests) | /operating/control-files-ini/ini-precedence |
disable_drupal_page_cache |
boolean | FALSE |
disable the internal Drupal page cache for this site | /operating/control-files-ini/ini-precedence |
enable_newrelic_integration |
boolean | FALSE |
enable New Relic agent for sites on this platform | /operating/control-files-ini/ini-precedence |
enable_newrelic_integration |
boolean | FALSE |
enable New Relic APM integration for this site | /operating/control-files-ini/ini-precedence |
enable_strict_user_register_protection |
boolean | FALSE |
force Administrators-only registration on D6/D7 sites globally | /operating/control-files-ini/ini-precedence |
entitycache_dont_enable |
boolean | FALSE |
stop the daily run from auto-enabling entitycache (D7 only) | /operating/control-files-ini/ini-precedence |
fix_files_permissions_daily |
boolean | TRUE |
honour the global _PERMISSIONS_FIX=YES (set FALSE to skip permission-reset on Git-managed platforms) | /operating/control-files-ini/ini-precedence |
ignore_user_register_protection |
boolean | FALSE |
disable the daily registration-mode lockdown entirely | /operating/control-files-ini/ini-precedence |
ignore_user_register_protection |
boolean | FALSE |
bypass the strict user-register protection on this site | /operating/control-files-ini/ini-precedence |
redis_cache_disable |
boolean | FALSE |
disable Redis entirely (debug only) | /operating/control-files-ini/ini-precedence |
redis_cache_disable |
boolean | FALSE |
disable the Redis cache backend entirely for this site | /operating/control-files-ini/ini-precedence |
redis_exclude_bins |
list | (empty) |
comma-separated cache bin names to keep in MySQL instead of Redis | /operating/control-files-ini/ini-precedence |
redis_exclude_bins |
boolean | FALSE |
exclude selected cache bins from the Redis backend | /operating/control-files-ini/ini-precedence |
redis_flush_forced_mode |
boolean | TRUE |
aggressive cache flush mode capping perm TTL at 6 h | /operating/control-files-ini/ini-precedence |
redis_flush_forced_mode |
boolean | TRUE |
force a full Redis flush on cache clear for this site | /operating/control-files-ini/ini-precedence |
redis_lock_enable |
boolean | TRUE |
use Redis lock implementation (default on) | /operating/control-files-ini/ini-precedence |
redis_lock_enable |
boolean | TRUE |
enable the Redis lock backend for this site | /operating/control-files-ini/ini-precedence |
redis_old_eight_mode |
boolean | FALSE |
set TRUE for Drupal 8 < 8.8 legacy Redis API | /operating/control-files-ini/ini-precedence |
redis_old_eight_mode |
boolean | FALSE |
use legacy Redis behaviour for Drupal 8 on this site | /operating/control-files-ini/ini-precedence |
redis_old_nine_mode |
boolean | FALSE |
set TRUE for Drupal 9 < 9.3 legacy Redis API | /operating/control-files-ini/ini-precedence |
redis_old_nine_mode |
boolean | FALSE |
use legacy Redis behaviour for Drupal 9 on this site | /operating/control-files-ini/ini-precedence |
redis_path_enable |
boolean | TRUE |
use Redis path cache (default on) | /operating/control-files-ini/ini-precedence |
redis_path_enable |
boolean | TRUE |
enable the Redis path/alias cache for this site | /operating/control-files-ini/ini-precedence |
redis_scan_enable |
boolean | FALSE |
use Redis SCAN for wildcard cache delete (avoid in D7) | /operating/control-files-ini/ini-precedence |
redis_scan_enable |
boolean | FALSE |
use SCAN instead of KEYS for Redis key matching | /operating/control-files-ini/ini-precedence |
server_name_cookie_domain |
boolean | FALSE |
force cookie_domain to the main domain even on alias requests | /operating/control-files-ini/ini-precedence |
server_name_cookie_domain |
boolean | FALSE |
scope the session cookie domain to the server name | /operating/control-files-ini/ini-precedence |
session_cookie_ttl |
integer | 86400 |
session.cookie_lifetime in seconds (24 h default) | /operating/control-files-ini/ini-precedence |
session_cookie_ttl |
integer | 86400 |
per-site session.cookie_lifetime in seconds | /operating/control-files-ini/ini-precedence |
session_gc_eol |
integer | 86400 |
session.gc_maxlifetime in seconds; keep <= session_expire module TTL | /operating/control-files-ini/ini-precedence |
session_gc_eol |
integer | 86400 |
per-site session.gc_maxlifetime in seconds | /operating/control-files-ini/ini-precedence |
set_composer_manager_vendor_dir |
boolean | FALSE |
force composer_manager_vendor_dir to the per-site vendor path (post-install only) | /operating/control-files-ini/ini-precedence |
set_composer_manager_vendor_dir |
boolean | FALSE |
point Composer Manager at the per-site vendor directory | /operating/control-files-ini/ini-precedence |
solr_custom_config |
string | NO |
protect customised Solr config files from being overwritten | /operating/control-files-ini/ini-precedence |
solr_integration_module |
string | (see source) |
which Solr integration module to activate for this site | /operating/control-files-ini/ini-precedence |
solr_update_config |
string | NO |
auto-update Solr schema.xml and solrconfig.xml on upgrade | /operating/control-files-ini/ini-precedence |
speed_booster_anon_cache_ttl |
integer | 10 |
anonymous-visitor Nginx microcache TTL in seconds (must exceed 10 to override) | /operating/control-files-ini/ini-precedence |
speed_booster_anon_cache_ttl |
integer | 10 |
anonymous Nginx microcache TTL in seconds for this site | /operating/control-files-ini/ini-precedence |
sql_conversion_mode |
string | NO |
innodb or myisam daily auto-conversion target (ignored if _SQL_CONVERT=YES on the Octopus) | /operating/control-files-ini/ini-precedence |
sql_conversion_mode |
string | NO |
per-site DB engine conversion preference | /operating/control-files-ini/ini-precedence |
views_cache_bully_dont_enable |
boolean | FALSE |
stop the daily run from auto-enabling views_cache_bully | /operating/control-files-ini/ini-precedence |
views_content_cache_dont_enable |
boolean | FALSE |
stop the daily run from auto-enabling views_content_cache | /operating/control-files-ini/ini-precedence |