Settings

Singleton application configuration in config/settings.yaml. Each key below has its own reference page; the complete example at the end shows them together.

Sections

Section	Keys	Page
General	schemaVersion, appName, externalBaseURL	General
Admin authentication	adminAuth.*	Admin authentication
Trusted proxies	trustedProxies	Trusted proxies
TLS	tls.minVersion	TLS
Security headers	securityHeaders, stripResponseHeaders	Security headers
Error pages	errorPages	Error pages
Maintenance	maintenance	Maintenance mode
DNS sync	dnsSync	DNS sync
Ingress discovery	ingressDiscovery	Kubernetes Ingress discovery
Docker discovery	dockerDiscovery	Docker container discovery
Access-list sync	accessListSync	Access-list source sync
Webhooks	webhooks	Webhooks
Notifications	notifications	Notifications
PROXY protocol	proxyProtocol	PROXY protocol

Complete example

schemaVersion: 1
appName: Go Proxy Manager
externalBaseURL: https://gpm.example.com
adminAuth:
  providers: [authentik-oidc]
  localLoginEnabled: true
  ssoOnly: false
tls:
  minVersion: "1.2"                 # fleet floor; a host may pin "1.3" (or back to "1.2")
webhooks:
  - name: ci
    url: https://hooks.example.com/gpm
    secret: ${FILE:/run/secrets/gpm_webhook_secret}
dnsSync:
  pihole:
    enabled: true
    url: http://pihole.lan
    appPassword: ${FILE:/run/secrets/pihole_app_password}
    apexTarget: edge.example.com
  cloudflare:
    enabled: true
    dnsProviderRef: cloudflare      # an existing dns-providers entry
    zoneName: example.com
    apexTarget: edge.example.com
    proxied: false
accessListSync:
  enabled: true
  pollInterval: 15m
ingressDiscovery:
  enabled: true
  apiURL: https://k8s.example.lan:6443
  tokenFile: /run/secrets/gpm-k8s-token
  caFile: /run/secrets/gpm-k8s-ca.crt
  pollInterval: 60s
  allowedDomainSuffixes: [example.com]
  template:
    upstream: { scheme: http, host: 10.0.0.40, port: 80 }   # the ingress controller
    tls:
      certificateRef: wildcard
      forceSSL: true
    middlewares: [sso]
    robotsNoIndex: true             # same field a hand-written host has
    timeouts: { connectSeconds: 5, readSeconds: 60 }
    tags: [cluster]
    defaultDNS: { lanDirect: true }
  profiles:                         # optional named chains, selected per Ingress
    public-ratelimited:
      upstream: { scheme: http, host: 10.0.0.40, port: 80 }
      tls: { certificateRef: wildcard, forceSSL: true }
      middlewares: [rate-limit]     # and no access list: public on purpose