Configuration

A PEM bundle of certificates trusted, beside the system's, when connecting to the ACME directory: for a private ACME server. Empty trusts the system roots.

acme.ca_file · string

The ACME directory of the certificate authority that issues the edge's certificates when Pando orders them itself.

acme.directory_url · string · Default https://acme-v02.api.letsencrypt.org/directory

The CPU each new app may use, in thousandths of a CPU. An app can override its own. 0 means 1000, one CPU.

apps.cpu_millis · int · Default 0

The disk each new app may use, in bytes. An app can override its own. 0 means 10 GiB.

apps.disk_bytes · int · Default 0

Pull a private image with the Docker login on the Pando server when the app has no registry credential of its own. Off by default: it lends every app on the install whatever that login can read.

apps.docker_credentials · bool · Default false

The memory each new app may use, in bytes. An app can override its own. 0 means 512 MiB.

apps.memory_bytes · int · Default 0

The first administrator's password, for an unattended install. Read only on first run, and the account must change it at first sign-in. Empty: the administrator is set up in the console with the setup token Pando prints to its log.

bootstrap.admin_password · string

A file holding the first administrator's password, in place of admin_password. An empty file is no password. The bundled Compose file writes PANDO_ADMIN_PASSWORD here.

bootstrap.admin_password_file · string

This host's name in the cluster when it joins with join_token. Empty is the machine's hostname.

bootstrap.join_name · string

A join token, which joins this new Pando to a cluster at its first start in place of setting it up. Ignored once it has joined; refused when it already has an account or an app.

bootstrap.join_token · string

How often a host probes every other. 0 means a sixth of liveness_period, which is also the most it may be.

cluster.liveness_interval · duration · Default 0s

T: how long a host may reach fewer than half the cluster before it stops its apps. Its standbys start after 3T. Every host of the cluster must have the same value. From 6s to 10m.

cluster.liveness_period · duration · Default 30s

How old an app's newest volume copy on its standby may get before another is shipped. At least standby_every, and at most a day.

cluster.ship_every · duration · Default 5m0s

How often the standby pass looks at every app: places, refreshes and ships its standby. From 5s to an hour.

cluster.standby_every · duration · Default 1m0s

How long Pando keeps trying to reach Postgres at startup before giving up.

database.connect_timeout · duration · Default 1m0s

The most connections this replica opens to Postgres. Postgres's max_connections must allow this for every replica, plus a few more for each.

database.max_conns · int · Default 32

A file holding the password for the database URL's user, which the URL then leaves out. The bundled Compose file generates one on first start.

database.password_file · string

The Postgres connection string. The bundled Compose file supplies it; set it to use an existing database. Its account must be able to manage Pando's application role.

database.url · string

Write logs as colored, human-readable lines rather than JSON.

log.development · bool · Default false

The least severe log level written: debug, info, warn or error.

log.level · string · Default info

How often metrics are pushed.

metrics.interval · duration · Default 1m0s

The OpenTelemetry collector Pando pushes its own metrics to, such as http://otel-collector:4318 for HTTP or :4317 for gRPC. Empty exports nothing.

metrics.otlp_endpoint · string

Headers sent with every export, as key=value pairs separated by commas with values URL-encoded, as OTEL_EXPORTER_OTLP_HEADERS takes them. Usually an API key.

metrics.otlp_headers · string

The OTLP protocol: http/protobuf or grpc.

metrics.otlp_protocol · string · Default http/protobuf

The retry schedule after a failed deploy or restart, as durations separated by commas: the first retry waits the first, and so on. Empty means 0s,5s,15s,60s,5m. Leave it unset in production; Pando warns at startup when it is faster.

reconciler.backoff · string

How many failures within failure_window before an app is given up on and left failed. 0 means 10.

reconciler.failure_threshold · int · Default 0

The window failures are counted in, measured from the last failure. 0 means 30 minutes.

reconciler.failure_window · duration · Default 0s

How often garbage collection runs. 0 means an hour.

reconciler.gc_interval · duration · Default 0s

Send every build through the registry, even when the runtime could import it directly.

registry.always · bool · Default false

Allow plain HTTP to the registry.

registry.insecure · bool · Default false

How Pando signs in to the registry: basic (a username and password) or ecr (an AWS access key).

registry.kind · string · Default basic

How images are arranged in the registry: per_app (a repository per app) or single (one repository for every image). Empty means the kind's default.

registry.layout · string

The registry password or access token. With kind ecr, the AWS secret access key. Read from the environment only, never from the config file.

registry.password · string

A file holding the registry password, in place of password.

registry.password_file · string

The image registry Pando pushes builds to, with an optional path prefix, such as https://registry.internal:5000 or 123456789012.dkr.ecr.us-east-1.amazonaws.com/pando. Set, it declares the install's image registry adapter. Empty: no registry, which single-host Docker does not need.

registry.url · string

The registry username. With kind ecr, the AWS access key ID.

registry.username · string

How long a deleted app's detection and backup records are kept. 0 means 30 days.

retention.deleted_apps · duration · Default 0s

How many deployments are kept for each app. 0 means 50.

retention.deployments_per_app · int · Default 0

How long the event outbox is kept. 0 means 30 days.

retention.events · duration · Default 0s

How long idempotency keys are kept. 0 means a day.

retention.idempotency_keys · duration · Default 0s

How long security scans are kept. 0 means 90 days.

retention.scans · duration · Default 0s

How long expired or revoked sessions are kept. 0 means 30 days.

retention.sessions · duration · Default 0s

How long expired sign-in flows are kept. 0 means a day.

retention.sso_flows · duration · Default 0s

The address the console, the API and the proxy listen on, as host:port. A bare :port listens on every interface.

server.addr · string · Default :8080

Where other Pando replicas reach this one, for a deploy's live log. Empty means http://<hostname> and the port of addr, which is right on a Compose network. In Kubernetes, the pod's address, such as http://$(POD_IP):8080.

server.advertise_url · string

Where Pando keeps audit log archives itself, when host policy's audit_archive is keep.

server.audit_archive_dir · string · Default /var/lib/pando/audit-archives

The domain per-app subdomains are made under, so an app called notes is reached at notes.example.com. Used only when routing by subdomain.

server.base_domain · string

The address new hosts join the cluster on, as host:port, served over TLS. Join tokens name its port; it must be reachable from every host that joins.

server.cluster_addr · string · Default :7444

The file holding the cluster's certificate authority, which hosts join and reach each other through. Made on first start. Every control host must read the same one. Empty is cluster-ca.pem beside server.token_key_path.

server.cluster_authority_path · string

Where a host that joined a cluster keeps its certificate, the cluster's authority and, on a control host, the cluster's database address, which then takes the place of database.url.

server.cluster_dir · string · Default /var/lib/pando/cluster

The address browsers reach Pando on, such as https://pando.example.com. Set it whenever something else terminates TLS: its scheme is what marks session cookies Secure. Empty is right when Pando serves TLS itself, or on plain-HTTP localhost.

server.external_url · string

The iss claim in every identity assertion Pando sends an app. It names this installation to the apps behind it.

server.issuer · string · Default https://pando.local

The last host port given to an app when apps are reached by port.

server.port_range_end · int · Default 9999

The first host port given to an app when apps are reached by port.

server.port_range_start · int · Default 9000

The address routing adapters send app traffic to, which is Pando's own proxy. It must be reachable from wherever the routing adapter runs. Empty means http://pando:8080, the Compose service.

server.proxy_upstream · string

How new apps are addressed by default: path (under Pando's own address), subdomain (each app at its own name under base_domain), or port (each app on its own port).

server.routing_mode · string · Default path

How long Pando waits for requests in flight to finish when it is stopped.

server.shutdown_timeout · duration · Default 15s

The file holding the key API tokens are stored under. Made on first start. Every replica must read the same file, and a disaster-recovery bundle carries it.

server.token_key_path · string · Default /var/lib/pando/token.key

The proxies in front of Pando whose X-Forwarded-For header names the client in the audit log: addresses and CIDR ranges, separated by commas. Empty records the connecting address.

server.trusted_proxies · string

Where a disaster-recovery bundle is assembled before it is encrypted and sent. It needs room for a database dump and every app volume.

server.work_dir · string · Default /var/lib/pando/work

How many apps the leader checks for new commits at once. 0 means eight.

work.auto_deploy · int · Default 0

How many rolling backups the leader takes at once. 0 means two.

work.backups · int · Default 0

The older name for host policy's max_concurrent_deploys. Set, it fixes that policy setting unless the policy setting is also set.

work.deploys · int · Default 0

How many detections this replica runs at once. 0 means one per CPU, and at least two.

work.detections · int · Default 0

Verbs an agent's token may not use: denied to CLI and MCP tokens only, not to people.

policy.agent_disabled_verbs · list · Default app.exec,app.secrets.read,app.grants.manage,install.policy.manage,install.users.manage,install.backup.manage,install.deploys.approve,app.deploy.approve,install.upgrade

Older form of public_sharing: false means apps cannot be shared with everyone. Prefer public_sharing.

policy.allow_anonymous_grants · bool · Default true

Let apps together ask for more CPU than the runtime has. Off by default: a deploy that would need more CPU than is left is refused. On, busy apps share the CPU and run slower.

policy.allow_cpu_oversubscription · bool · Default false

In a cluster, let apps' standbys be placed past the CPU and memory kept free for losing a host. Off by default: an app whose standby could not start anywhere runs without one. On, a host that takes over starts what fits, highest availability.priority first. Disk is never oversubscribed.

policy.allow_failover_oversubscription · bool · Default false

Let apps together ask for more memory than the runtime has. Off by default: a deploy that would need more memory than is left is refused. On, the host may run out and stop an app to free memory. Disk is never oversubscribed.

policy.allow_memory_oversubscription · bool · Default false

Let event subscription webhooks send to private addresses — the local network, loopback, and link-local addresses such as a cloud metadata service. Off by default, because anyone who can see an app can subscribe to it.

policy.allow_private_webhooks · bool · Default false

Where a month of the audit log goes once it is past retention: keep (archived under Pando's own directory), export (to a backup destination), or off (nothing is archived, so nothing is removed).

policy.audit_archive · string

The backup destination, by adapter ID, that audit archives are exported to when audit_archive is export. Empty means the default backup destination.

policy.audit_archive_destination · string

How many months the audit log keeps before an older month is archived and removed from the live log. 0 means 3, which is also the least it may be.

policy.audit_retention_months · int · Default 0

Upgrade to new patch releases automatically inside maintenance_window. Takes a database copy for rollback but not a full backup. Needs upgrade_in_place.

policy.auto_upgrade_patches · bool · Default false

Apps, by ID, whose deploys need approval whatever their owners say.

policy.deploy_approval_apps · list

How many approvals a deploy needs. 0 means one.

policy.deploy_approval_count · int · Default 0

How long a deploy waits for approval before it expires, in hours. 0 means it waits until somebody answers.

policy.deploy_approval_expiry_hours · int · Default 168

Every app's deploys need approval from somebody holding install.deploys.approve or app.deploy.approve. Automatic deploys stop while it is on.

policy.deploy_approval_required · bool · Default false

Turn off AI screening of deployment plans: AI is never sent a repository to repair a plan or answer detection's questions.

policy.disable_ai_screening · bool · Default false

Don't record refusals of people who aren't signed in: authz.denied is written for an anonymous visitor to an app not shared with them only while this is off. Refusals of signed-in people and tokens are always recorded.

policy.disable_anonymous_denial_audit · bool · Default false

Don't record visits from people who aren't signed in: app.use is written to the audit log for signed-in people and tokens only, not for anonymous visitors to public apps.

policy.disable_anonymous_use_audit · bool · Default false

Don't make an account when someone first signs in through an identity provider, whatever the provider is set to. People need an account from SCIM or an administrator first.

policy.disable_jit_provisioning · bool · Default false

Turn off sign-in with a local username and password, so people sign in through an external identity provider. Needs at least one provider turned on.

policy.disable_password_sign_in · bool · Default false

Don't check GitHub for newer Pando releases. Off sends no request at all, for an installation that has no internet access or may not call out.

policy.disable_update_check · bool · Default false

Turn off webhook routes: a plan declaring one is refused, and deliveries to those already deployed meet the app's ordinary access.

policy.disable_webhook_routes · bool · Default false

Permissions nobody may use, install-wide, including an app's owner. app.exec here is the Policy screen's "Turn off terminal access for the whole installation".

policy.disabled_verbs · list

Older form of egress_mode allowlist with egress_list. Prefer those.

policy.egress_allowlist · list

Stop apps connecting to private addresses — the local network, loopback, and the cloud metadata address — whatever egress_mode says.

policy.egress_block_private · bool · Default false

The installation's egress list: hostnames, *.wildcards, addresses or ranges, each optionally with a port. Read by egress_mode.

policy.egress_list · list

Whether an app may loosen the installation's egress rules (add to an allowlist, remove from a denylist, unblock private addresses): verb (somebody holding app.egress.loosen may), approval (its deploy needs approval), or forbidden.

policy.egress_loosening · string

Where apps may connect out to: allow_all (anywhere), denylist (anywhere except egress_list), or allowlist (only egress_list). Apps can narrow it; loosening it is governed by egress_loosening.

policy.egress_mode · string

Delete an app nobody has used for this many days, counted from its last use, so it is longer than idle_stop_days. Its owner is told 7 days before. Storage is backed up first when require_backup_before_destroy is on, and discarded otherwise. An app can set its own number or turn this off. 0 means never.

policy.idle_delete_days · int · Default 0

Stop an app nobody has used for this many days. Its owner is told 7 days before, and somebody starts it again by hand. An app can set its own number or turn this off. 0 means never.

policy.idle_stop_days · int · Default 0

Ignore findings with no fix available, in both the security score and the list.

policy.ignore_unfixable_findings · bool · Default false

What happens to a running app that falls below the minimum security score: warn, or stop (after the grace period).

policy.insecure_action · string

Grace period, in hours, before stop applies to an app below the minimum score.

policy.insecure_grace_hours · int · Default 0

When automatic upgrades may start, in UTC: weekdays, a start time and a length, such as "sun,wed 02:00 2h" or "daily 03:30 1h".

policy.maintenance_window · string

How many apps each person may own, unless their account or one of their groups says otherwise. 0 means unlimited.

policy.max_apps_per_user · int · Default 0

How many deploys each replica of Pando runs at once. A deploy past the limit waits in the queue and its log says how many are ahead of it. 0 means one per CPU, and at least two.

policy.max_concurrent_deploys · int · Default 0

Total disk for app logs across every app, in bytes. 0 means no limit.

policy.max_log_disk_bytes · int · Default 0

Longest a token may live, in days. 0 means no limit.

policy.max_token_lifetime_days · int · Default 0

Minimum isolation for builds, as an isolation class number (10 is a container).

policy.min_build_isolation · int · Default 10

Minimum isolation for running apps, as an isolation class number (10 is a container).

policy.min_runtime_isolation · int · Default 10

Minimum security score a deploy must reach, 0 to 100. 0 means off.

policy.min_security_score · int · Default 0

Whether an app may be shared with anyone on the internet: allowed, passcode_only (only behind the app's passcode), or none.

policy.public_sharing · string

Require a backup before anything is destroyed: an app's storage is backed up before the app or its volumes are deleted.

policy.require_backup_before_destroy · bool · Default false

Require two-factor authentication on every local account. Someone without it sets it up at their next sign-in, and can do nothing else until they have. Accounts from an identity provider are not affected.

policy.require_local_two_factor · bool · Default false

Where apps may be created from: a host (github.com), a host suffix (.corp.example), or a host and path (github.com/acme, ghcr.io/acme) — repositories and image registries alike. Add upload to allow files sent from a computer. Empty means anywhere.

policy.source_allowlist · list

Keep a stopped copy of each app on another host, with its storage copied every 5 minutes, and start it if the app's host is lost. On by default. An app can turn it on or off for itself. Only a runtime with more than one host keeps one.

policy.standby · bool · Default true

Stop an app once none of its owners has an active account and no group owns it. On by default. It stays stopped until somebody starts it. Administrators are told either way.

policy.stop_orphaned_apps · bool · Default true

Which Pando releases the update check offers: stable (releases only) or prerelease (release candidates too).

policy.update_channel · string

Let Pando upgrade itself to a newer release from the Updates screen. Needs Pando's image set to a moving tag such as trypando/pando:latest; usually set in the deployment's configuration.

policy.upgrade_in_place · bool · Default false