main/config/server.config
| Parameter | Required | Default | Options | Description |
|---|---|---|---|---|
Organization |
Required | — | — | Organization FQDN |
AdminEmail |
Required | — | — | Main administrator email address |
TLSPort |
Required | 443 | — | External port — if <1024, internal port = TLSPort+38000 |
SynkzoneWebAddress |
Required | — | — | FQDN of the web interface |
SNTPServer |
Required | pool.ntp.org | — | NTP server |
SNTPServerBackup |
Required | pool.ntp.org | — | Backup NTP server |
otp.issuer |
Required | Synkzone | — | OTP issuer name shown in authenticator apps |
EmailTemplates |
Required | /email-templates | — | Path to email templates directory |
SecondaryServerIdentifier |
Optional | — | — | Secondary server identifier |
TrustedNodeInstances |
Optional | — | — | Comma-separated UUIDs of the API and BFF components |
mailservice |
Required | False | — | Enable email |
mailservice.bounce |
Enabled | — | — | Bounce email address |
mailservice.domain |
Enabled | — | — | Domain emails are sent from |
mailservice.reply |
Enabled | — | — | Reply address in credential emails |
mailservice.sender |
Enabled | Synkzone | — | Display name for the "from" field |
mailservice.smtp.host |
Enabled | — | — | SMTP host FQDN |
mailservice.smtp.port |
Enabled | — | — | SMTP port |
mailservice.smtp.credentials |
Enabled | — | — | Path to credentials file |
mailservice.startup |
Optional | — | — | Recipient for startup confirmation email |
mailservice.monitoring |
Optional | — | — | Recipient for monitoring notifications |
mailservice.dkim.selector |
Optional | — | — | DKIM selector pointing to public key |
mailservice.dkim.privatekey.path |
Optional | — | — | Path to DKIM private key |
remote_storage.enabled |
Required | False | — | Enable remote storage |
remote_storage.bucket |
Enabled | — | — | Bucket name — must be unique per organization; recommended to use the main component UUID |
remote_storage.provider |
Enabled | — | — | Storage provider name |
remote_storage.endpoint |
Enabled | — | — | Storage endpoint |
remote_storage.credentials |
Enabled | — | — | Path to credentials file |
remote_storage.self_test_on_start |
Optional | — | — | Run a connectivity test on every startup |
remote_storage.etag |
Optional | — | — | ETag handling |
GrandIdAPI |
Enabled | — | — | GrandID API endpoint for BankID |
GrandIdAPIKey.path |
Enabled | — | — | Path to GrandID API key file |
GrandIdBankIdKey.path |
Enabled | — | — | Path to GrandID BankID key file |
PersonalIdentificationTypes |
Enabled | — | — | BankID identification type |
IDPType |
Enabled | — | — | IDP type |
IDPName |
Enabled | Hostname from IDPIssuerURL | — | Display name shown to users |
IDPClientId |
Enabled | — | — | OIDC client identifier registered with the IDP |
IDPIssuerURL * |
Enabled | — | — | OIDC issuer URL — must exactly match the value specified by the IDP |
IDPUserIdClaim |
Enabled | sub | — | JWT claim used as external user ID |
AutoCreateIDPUsers |
Enabled | False | — | Automatically create accounts for IDP users |
OAuthClientSecret.path |
Enabled | — | — | Path to OAuth client secret file |
| Required is mandatory. Optional is not required. Enabled is required only if the related feature is enabled. |
|---|
Note
* IDPIssuerURL: If the IDP at the specified IDPIssuerURL is OIDC capable and responds to configuration requests at <issuerURL>/.well-known/openid-configuration, all IDP configuration will be completed automatically. If no well-known configuration exists, the IDP may still work with standard default settings. The IDP must register <Customer's Synkzone Web URL>/auth and https://synkzone.com/auth as redirect URLs.