Configuration and security

Core settings

Setting	Purpose
PORT / HOST	API listen address
ADMIN_PASSWORD	Initial administrator password
APP_SECRET	Session and application security secret
ENCRYPTION_KEY	Encryption key for cluster and S3 static credentials
SESSION_COOKIE_PATH	Internal cookie path; keep / for prefixed deployments
SUPER_ES_MANAGER_DATABASE_PROVIDER	SQLITE, POSTGRESQL, MYSQL, or MARIADB
SUPER_ES_MANAGER_DATABASE_URL	System database connection URL
ES_REQUEST_TIMEOUT_MS	Cluster request timeout
ES_MAX_RESPONSE_BYTES	Maximum cluster response size

Transfer jobs

Transfer storage, upload limit, page size, bulk size, concurrency, queue length, and retry settings define the resource boundary for background transfers. Load-test them against index size, disk, network, and cluster capacity.

S3 credentials

• Static credentials are encrypted with ENCRYPTION_KEY.
• Prefer a runtime IAM credential chain where available.
• Grant only the write and multipart-abort permissions required for the target prefix.
• Configure a bucket lifecycle rule for incomplete multipart uploads.

Access boundary

• The browser must never hold cluster credentials.
• Keep the management console behind HTTPS and network restrictions.
• User resources remain owner-scoped; super administrators manage application accounts only.
• Combine audit records with external change control for deletes, restores, and reroutes.