Configuration reference
Generated by
scripts/generate-config-reference.mjsfrom the per-moduleMETA-INF/spring-configuration-metadata.jsonfiles that the build produces; do not edit this page by hand. To change a property, edit the corresponding@ConfigurationPropertiesclass and regenerate; CI verifies that this page matches the code.Prerequisite:
cd strata && mvn -DskipTests compile(add-ofor an offline build).Environment variable override: Spring Boot relaxed binding, e.g.
strata.security.jwt.secret→STRATA_SECURITY_JWT_SECRET. In production prefer environment variables over editing yml.
84 configuration properties, grouped by prefix.
strata.ai (2)
| Property | Type | Default | Description |
|---|---|---|---|
strata.ai.history-limit |
Integer | 30 |
how many most-recent messages are sent back to the model as context (and returned by the message-history endpoint). An unbounded history would grow prompt tokens without bound on long sessions and would risk an out-of-memory read on a busy session. Bumped to at least 1 on bind. |
strata.ai.public-base-url |
String | "" |
see above |
strata.community (3)
| Property | Type | Default | Description |
|---|---|---|---|
strata.community.cache-local-demo |
Boolean | true |
In-memory demo keys when Redis is not configured. |
strata.community.job-scheduler-stub |
Boolean | true |
Community job "Run now" simulates a tick — no Quartz/Spring scheduler. |
strata.community.workflow-runner-stub |
Boolean | true |
Background workflow runner auto-completes PENDING runs (no BPM engine). |
strata.generator (1)
| Property | Type | Default | Description |
|---|---|---|---|
strata.generator.output-dir |
String |
strata.idempotency (10)
| Property | Type | Default | Description |
|---|---|---|---|
strata.idempotency.enabled |
Boolean | true |
|
strata.idempotency.header-name |
String | "Idempotency-Key" |
|
strata.idempotency.max-body-bytes |
Integer | 65536 |
|
strata.idempotency.methods |
List |
"[POST, PUT, PATCH, DELETE]" |
|
strata.idempotency.path-patterns |
List |
"[/api/v1/**, /v1/**]" |
|
strata.idempotency.purge-enabled |
Boolean | true |
|
strata.idempotency.purge-interval |
Duration | "PT30M" |
|
strata.idempotency.required |
Boolean | false |
|
strata.idempotency.required-path-patterns |
List |
"[]" |
|
strata.idempotency.retention |
Duration | "PT24H" |
strata.plugin (8)
| Property | Type | Default | Description |
|---|---|---|---|
strata.plugin.encrypt.aes.enabled |
Boolean | false |
|
strata.plugin.encrypt.aes.key |
String | "" |
Base64-encoded 32-byte AES key. |
strata.plugin.storage.local.base-dir |
String | ||
strata.plugin.stripe.api-key |
String | ||
strata.plugin.stripe.cancel-url |
String | ||
strata.plugin.stripe.currency |
String | ||
strata.plugin.stripe.success-url |
String | ||
strata.plugin.stripe.webhook-secret |
String |
strata.rate-limit (5)
| Property | Type | Default | Description |
|---|---|---|---|
strata.rate-limit.annotations-enabled |
Boolean | true |
|
strata.rate-limit.enabled |
Boolean | true |
|
strata.rate-limit.idle-expiry |
Duration | "PT10M" |
|
strata.rate-limit.max-buckets |
Integer | 100000 |
|
strata.rate-limit.rules |
List<dev.strata.common.core.ratelimit.RateLimitProperties$Rule> | "[]" |
strata.redisson (14)
| Property | Type | Default | Description |
|---|---|---|---|
strata.redisson.address |
String | "redis://localhost:6379" |
Redis server address (e.g., redis://localhost:6379). |
strata.redisson.connect-timeout |
Integer | 10000 |
Connect timeout in milliseconds. |
strata.redisson.connection-minimum-idle-size |
Integer | 10 |
Connection minimum idle size. |
strata.redisson.connection-pool-size |
Integer | 64 |
Connection pool size. |
strata.redisson.database |
Integer | 0 |
Redis database index. |
strata.redisson.enabled |
Boolean | false |
Whether Redisson integration is enabled. |
strata.redisson.lock-watchdog-timeout |
Long | 30000 |
Lock watchdog timeout in milliseconds. Redisson automatically extends lock lease while the lock holder is alive. |
strata.redisson.netty-threads |
Integer | 32 |
Number of Netty threads for network operations. |
strata.redisson.password |
String | Redis password. | |
strata.redisson.retry-attempts |
Integer | 3 |
Retry attempts. |
strata.redisson.retry-interval |
Integer | 1500 |
Retry interval in milliseconds. |
strata.redisson.threads |
Integer | 16 |
Number of threads used by Redisson for internal operations. |
strata.redisson.timeout |
Integer | 3000 |
Response timeout in milliseconds. |
strata.redisson.use-as-primary-lock |
Boolean | false |
Whether to use Redisson distributed lock as the primary lock implementation. If true, replaces the default RedisTemplate-based lock. |
strata.saml (14)
| Property | Type | Default | Description |
|---|---|---|---|
strata.saml.acs-url |
String | Browser-facing ACS URL registered at the IdP. | |
strata.saml.auto-provision |
Boolean | true |
|
strata.saml.clock-skew-seconds |
Integer | 120 |
Allowed clock skew for assertion conditions. |
strata.saml.code-ttl-seconds |
Integer | 60 |
Lifetime of the one-time login code handed to the SPA. |
strata.saml.default-role-code |
String | "" |
Role granted to auto-provisioned users (empty = no role; an admin assigns one). |
strata.saml.display-name |
String | "SAML" |
Browser-facing label for the login button. |
strata.saml.enabled |
Boolean | false |
|
strata.saml.frontend-callback-url |
String | Where the backend sends the browser after a successful ACS, before the SPA exchanges the code. | |
strata.saml.idp-certificates |
List |
Base64 DER certificate(s) of the IdP signing key, required when metadata is not used. | |
strata.saml.idp-entity-id |
String | IdP entity id, required when metadata is not used. | |
strata.saml.idp-metadata-uri |
String | IdP metadata XML URL; alternative to setting the explicit values below. | |
strata.saml.idp-sso-url |
String | IdP SSO endpoint (browser-facing), required when metadata is not used. | |
strata.saml.sp-entity-id |
String | SP entity id sent in AuthnRequests and expected in the Audience restriction. | |
strata.saml.state-store |
String | "memory" |
One-time state store: {@code memory} (single instance) or {@code redis}. |
strata.scim (3)
| Property | Type | Default | Description |
|---|---|---|---|
strata.scim.enabled |
Boolean | false |
|
strata.scim.max-results |
Integer | 200 |
|
strata.scim.token |
String | "" |
strata.security (15)
| Property | Type | Default | Description |
|---|---|---|---|
strata.security.admin-write-guard.allowed-origins |
List |
"[]" |
exact or {@code }-pattern origins a state-changing request may come from (e.g. {@code https://admin.example.com}, {@code http://localhost:}). When empty the Origin check is skipped (local development); production must set it non-empty. |
strata.security.admin-write-guard.enabled |
Boolean | true |
master switch for both checks. |
strata.security.cookie.hardened |
Boolean | false |
when true, rewrite every Set-Cookie to enforce the secure attributes. Production turns this on. |
strata.security.cookie.host-prefix |
Boolean | true |
when true, rename the cookie to the {@code __Host-} prefix. |
strata.security.cookie.idle-timeout |
Duration | "PT30M" |
sessions idle longer than this are evicted (0 = never idle-expire). |
strata.security.cookie.max-concurrent-sessions |
Integer | 5 |
maximum concurrent authenticated sessions per user (0 = unlimited). The login flow enforces this; exposed here so the value is one documented knob. |
strata.security.cookie.same-site |
String | "Lax" |
the SameSite attribute to force (Lax by default). |
strata.security.jwt.access-token-ttl-seconds |
Long | 0 |
|
strata.security.jwt.previous-secret |
String | ||
strata.security.jwt.refresh-token-ttl-seconds |
Long | 0 |
|
strata.security.jwt.secret |
String | ||
strata.security.login-lock.lock-minutes |
Integer | 0 |
|
strata.security.login-lock.max-attempts |
Integer | 0 |
|
strata.security.login-lock.store |
String | ||
strata.security.token.blacklist-enabled |
Boolean | false |
strata.social (5)
| Property | Type | Default | Description |
|---|---|---|---|
strata.social.allowed-launch-domains |
List |
Domains allowed for the optional game-launch bounce URL (legacy helper). | |
strata.social.allowed-redirect-uris |
List |
Exact redirect URIs the browser may use (open-redirect guard at the IdP step). | |
strata.social.enabled |
Boolean | false |
Master switch for the social login endpoints. |
strata.social.providers |
java.util.Map<String,dev.strata.system.rbac.biz.service.support.SocialLoginProperties$Provider> | Configured providers, keyed by the id the admin UI uses. | |
strata.social.state-store |
String | "memory" |
Where the one-time state + PKCE verifier pair is stored: {@code memory} (default) or {@code redis}. |
strata.system (1)
| Property | Type | Default | Description |
|---|---|---|---|
strata.system.seed.admin-password |
String |
strata.tenant (1)
| Property | Type | Default | Description |
|---|---|---|---|
strata.tenant.row-level-enabled |
Boolean | false |
When true, APIs scope data by {@code X-Tenant-Id} header (Pro row-level isolation). |
strata.web (2)
| Property | Type | Default | Description |
|---|---|---|---|
strata.web.json-body-limit-enabled |
Boolean | true |
|
strata.web.json-max-bytes |
Integer | 2097152 |
maximum accepted {@code application/json} request body in bytes (declared Content-Length). Defaults to 2 MiB. Chunked (unknown-length) bodies are not buffered here; the container's {@code max-swallow-size} is the backstop for those. |