Configuration and security
System database
Section titled “System database”The default local database path is:
/data/super-kafka-manager/system/super-kafka-managerRuntime storage configuration is stored at:
/data/super-kafka-manager/config/system-storage.jsonEnvironment overrides include:
| Setting | Purpose |
|---|---|
SUPER_KAFKA_MANAGER_STORAGE_CONFIG |
Bootstrap configuration path |
SUPER_KAFKA_MANAGER_DATABASE_LOCAL_PATH |
Local system database path |
SUPER_KAFKA_MANAGER_DATABASE_PROVIDER |
Remote system database provider |
SUPER_KAFKA_MANAGER_DATABASE_URL |
Remote JDBC URL |
SUPER_KAFKA_MANAGER_DATABASE_USERNAME |
Database username |
SUPER_KAFKA_MANAGER_DATABASE_PASSWORD |
Database password |
Connection security
Section titled “Connection security”- Sensitive fields remain masked in the UI and encrypted in the system database.
- Kafka supports SSL/SASL/SCRAM/GSSAPI/OAuth/MSK IAM templates.
- Schema Registry and Kafka Connect support Basic, Bearer, SSL, and OAuth-header templates.
- Connection diagnostics sanitize properties before display.
Web security
Section titled “Web security”Use HTTPS in production. When TLS terminates at a proxy, forward X-Forwarded-Proto: https; the application uses it to add Secure to HttpOnly, SameSite=Strict cookies.
Audit and capacity
Section titled “Audit and capacity”Writes are audited in the system database. Retention defaults to 90 days and is controlled by SUPER_KAFKA_MANAGER_AUDIT_RETENTION; use 0 for indefinite retention.
GET /api/health reports database readiness and bounded Kafka-client, search, and live-tail capacity without initiating a remote Kafka request.