- **Configuration file** – The config file is called `config.yaml` and located in the DefraDB root directory.
- **DefraDB root directory** – The default root directory is `$HOME/.defradb`. You can change it via the `--rootdir` CLI flag when starting a node with `defradb start`.

:::info
Relative paths in configuration settings are interpreted as relative to the DefraDB root directory.
:::

:::tip
You can retrieve the configuration settings of a running node with the CLI command [`defradb client node-options`](references/cli/defradb_client_node-options.md).
:::

## `api.address` {/* #api-address */}

Address of the HTTP API to listen on or connect to. Default: `127.0.0.1:9181`.

## `api.allowed-origins` {/* #api-allowed-origins */}

List of origins a cross-domain request can be executed from.

## `api.audience` {/* #api-audience */}

Audience to set on minted auth tokens. Defaults: hostname of `api.address`.

## `api.pubkeypath` {/* #api-pubkeypath */}

Path to the public key file for TLS / HTTPS.

## `api.privkeypath` {/* #api-privkeypath */}

Path to the private key file for TLS / HTTPS.

## `datastore.path` {/* #datastore-path */}

Path to the database data files. Default: `data`.

## `datastore.badger.valuelogfilesize` {/* #datastore-badger-valuelogfilesize */}

Maximum file size of the value log files. Default: `2^30`.

## `datastore.defaultkeytype` {/* #datastore-defaultkeytype */}

Key type for `node-identity-key`: either `secp256k1` or `ed25519`. Default: `secp256k1`.

See [Keys](/references/keys.md).

## `datastore.maxtxnretries` {/* #datastore-maxtxnretries */}

Number of retries to make in the event of a transaction conflict. Default: `5`.

This is only used within the P2P system and does not affect operations initiated by users.

## `datastore.noencryption` {/* #datastore-noencryption */}

Whether to skip generating an encryption key and disable encryption at rest. Default: `false`.

::::warning
The value of this option cannot be changed after the instance is started for the first time.
::::

## `datastore.nosearchableencryption` {/* #datastore-nosearchableencryption */}

Whether to skip generating a searchable encryption key and disable searchable encryption. Default: `false`.

## `datastore.nosigning` {/* #datastore-nosigning */}

Whether to skip signing new blocks.

::::warning
The value of this option cannot be changed after the instance is started for the first time.
::::

## `datastore.store` {/* #datastore-store */}

Store mode. Options are:

- `badger`: fast pure Go key-value store optimized for SSDs (https://github.com/dgraph-io/badger).
- `memory`: in-memory version of `badger`.

Default: `badger`.

## `development` {/* #development */}

Enables a set of features that facilitates development but should not be enabled in production:

- allows purging of all persisted data
- generates temporary node identity if one doesn't exist in the keyring

Default: `false`.

## `log.colordisabled` {/* #log-colordisabled */}

Whether to disable colored log output. Default: `false`.

## `log.format` {/* #log-format */}

Log format to use. Options are `text` or `json`. Default: `text`.

## `log.level` {/* #log-level */}

Log level to use. Options are `info` or `error`. Default: `info`.

## `log.output` {/* #log-output */}

Log output stream. Options are `stderr` or `stdout`. Default: `stderr`.

## `log.overrides` {/* #log-overrides */}

Logger config overrides. Format

```format title="Logger config overrides format"
<name>,<key>=<val>,...;<name>,...
```

## `log.source` {/* #log-source */}

Include a partial stacktrace in logs. Default: `true`.

## `log.stacktrace` {/* #log-stacktrace */}

Whether to include the stacktrace in error and fatal log entries. Default: `false`.

## `net.p2paddresses` {/* #net-p2paddresses */}

List of addresses for the P2P network to listen on. Default: `[/ip4/127.0.0.1/tcp/9171]`.

## `net.p2pdisabled` {/* #net-p2pdisabled */}

Whether P2P networking is disabled. Default: `false`.

## `net.peers` {/* #net-peers */}

List of peers to bootstrap with, specified as [multiaddresses](https://docs.libp2p.io/concepts/addressing/).

## `net.pubsubenabled` {/* #net-pubsubenabled */}

Whether PubSub is enabled. Default: `true`.

## `net.relay` {/* #net-relay */}

Whether libp2p's [Circuit relay transport protocol](https://docs.libp2p.io/concepts/circuit-relay/) is enabled. Default: `false`.

## `keyring.backend` {/* #keyring-backend */}

Keyring backend to use. Options are:

- `file`: Store keys in encrypted files
- `system`: Store keys in the OS-managed keyring

Default: `file`.

## `keyring.disabled` {/* #keyring-disabled */}

Whether to disable the keyring and generate ephemeral keys instead. Default: `false`.

## `keyring.namespace` {/* #keyring-namespace */}

Service name to use when using the system keyring. Default: `defradb`.

## `keyring.path` {/* #keyring-path */}

Path to store encrypted key files in. Default: `keys`.

## `replicator.retryintervals` {/* #replicator-retryintervals */}

List of durations (in seconds) to wait before retrying a failed replication attempt. Default: `[30, 60, 120, 240, 480, 960, 1920]`.

## `secretfile` {/* #secretfile */}

Path to the file containing secrets. Default: `.env`.

## `telemetry.disabled` {/* #telemetrydisabled */}

Whether to disable telemetry. Default: `false`.

## `lens.runtime` {/* #lens-runtime */}

The LensVM wasm runtime to run lens modules in.

Possible values:
- `wasm-time` (default): https://github.com/bytecodealliance/wasmtime-go
- `wasmer` (windows not supported): https://github.com/wasmerio/wasmer-go
- `wazero`: https://github.com/tetratelabs/wazero

## `acp.document.type` {/* #acp-document-type */}

Type of Access Control Policy module to use. Options are:

- `local`: Local-only ACP
- `source-hub`: [SourceHub ACP](https://github.com/sourcenetwork/sourcehub)

Default: `local`.

## `acp.document.sourceHub.ChainID` {/* #acp-document-sourcehub-chainid */}

The ID of the SourceHub chain to store ACP data in. Required when using `acp.document.type`:`source-hub`.

## `acp.document.sourceHub.GRPCAddress` {/* #acp-document-sourcehub-grpcaddress */}

The address of the SourceHub GRPC server. Required when using `acp.document.type`:`source-hub`.

## `acp.document.sourceHub.CometRPCAddress` {/* #acp-document-sourcehub-cometrpcaddress */}

The address of the SourceHub Comet RPC server. Required when using `acp.document.type`:`source-hub`.

## `acp.document.sourceHub.KeyName` {/* #acp-document-sourcehub-keyname */}

The name of the key in the keyring containing the SourceHub credentials used to sign (and pay for) SourceHub transactions created by the node. Required when using `acp.document.type`:`source-hub`.

## `acp.document.sourceHub.address` {/* #acp-document-sourcehub-address */}

The SourceHub address of the actor that client-side actions should permit to make SourceHub actions on their behalf. This is a client-side only config param. It is required if the client wishes to make SourceHub ACP requests in order to create protected data.