Skip to content

Configuration

Configuration Source Priority

The add-in resolves each setting by checking these sources in order, stopping at the first match:

  1. Admin database Config profile — used once the admin database has been activated (see Moving Settings to the Admin Database).
  2. notes.ini — the traditional Domino configuration file.
  3. Environment variables — If a setting is not found in the database or notes.ini, the OS environment is checked.

Required settings have no built-in default. The add-in will refuse to start if any required setting is absent from all sources.

Required Settings

The following settings must be configured before the add-in will start:

Setting notes.ini key Description
Origin FILES_ORIGIN Client-facing base URL — used in OIDC redirect URIs, public share URLs, and the URL Collabora uses to reach the service. Omit the port when behind a reverse proxy on port 443; include the port for direct-bind deployments (e.g. files.example.com:8443).
Port FILES_HTTP_PORT TCP port the HTTPS listener binds to. Independent from the port in ORIGIN: in a reverse-proxy setup the proxy listens on 443 (in ORIGIN) and forwards to this port (typically 8443).
OIDC Issuer FILES_OIDC_ISSUER OIDC provider discovery URL (e.g. https://idp.example.com).
OIDC Client ID FILES_OIDC_CLIENT_ID Client identifier registered with the OIDC provider.
OIDC Client Secret FILES_OIDC_CLIENT_SECRET Client secret registered with the OIDC provider.

Full Settings Reference

The Configuration form in file_admin.nsf is organized into tabs. Settings are grouped below to match that structure.

Basic tab

Setting notes.ini key DB profile key Default Description
Origin FILES_ORIGIN ORIGIN (required) Client-facing base URL. See Required Settings.
Port FILES_HTTP_PORT PORT (required) TCP listener port. See Required Settings.
Web App Folder FILES_WEB_APP_FOLDER WEB_APP_FOLDER file-service-files Path to the static web application assets. May be relative to the Domino program directory or an absolute path.
Web Picker Folder FILES_WEB_PICKER_FOLDER WEB_PICKER_FOLDER file-picker-files Path to the file-picker component assets served to other HCL products. May be relative to the Domino program directory or an absolute path.
Org Name FILES_ORG_NAME ORG_NAME (none) Optional display name for the organisation, shown in the UI and in notification emails.
No-Reply Sender FILES_NOREPLY_SENDER NOREPLY_SENDER noreply@<origin host> Email address used as the From address for notification emails (e.g. share notifications, access-request emails). Defaults to noreply@ followed by the hostname from ORIGIN.
Thumbnail Generation FILES_THUMBNAIL_GENERATION THUMBNAIL_GENERATION 1 Set to 0 to disable all thumbnail generation. When enabled (1), image thumbnails are generated natively; Office/PDF thumbnails require Collabora to be configured.
Server Group FILES_SERVER_GROUP SERVER_GROUP (none) Name of a Domino group containing all file-service servers. Used to broadcast backchannel logout events to peer servers in a cluster.

Authentication tab

Setting notes.ini key DB profile key Default Description
OIDC Issuer FILES_OIDC_ISSUER OIDC_ISSUER (required) OIDC provider URL.
OIDC Client ID FILES_OIDC_CLIENT_ID OIDC_CLIENT_ID (required) OIDC client identifier.
OIDC Client Secret FILES_OIDC_CLIENT_SECRET OIDC_CLIENT_SECRET (required) OIDC client secret.
OIDC Scopes FILES_OIDC_SCOPES OIDC_SCOPES openid,profile,email Comma-separated list of OIDC scopes requested at login.
Accept Invalid Certs FILES_ACCEPT_INVALID_CERTS ACCEPT_INVALID_CERTS 0 Set to 1 to accept invalid TLS certificates on outbound connections. For development use only — never enable in production.
Access Token Accepted Audiences FILES_ACCESS_TOKEN_ACCEPTED_AUDIENCES ACCESS_TOKEN_ACCEPTED_AUDIENCES (none) Comma-separated list of accepted aud claim values for incoming bearer access tokens (e.g. files-api,account). When set, tokens whose audience does not match any entry are rejected. When empty, audience validation is skipped.
Public Link Permissions FILES_PUBLIC_LINK_PERMISSIONS PUBLIC_LINK_PERMISSIONS read-only Controls whether public (anonymous) links can be created and what access level they may grant. Values: disabled, read-only (default), read-write. See table below.
Trusted Return Origins FILES_TRUSTED_RETURN_ORIGINS TRUSTED_RETURN_ORIGINS (none) Comma-separated list of trusted external URL origins permitted as redirect targets after the /checksession endpoint (e.g. https://mail.example.com,https://chat.example.com). An empty list blocks all external redirects.
Session Expire Seconds FILES_SESSION_EXPIRE_SECONDS SESSION_EXPIRE_SECONDS 0 Lifetime of a browser session cookie in seconds. 0 (default) creates a session cookie that expires when the browser closes. Any positive value sets a persistent cookie with that lifetime.
Desktop Session Expire Seconds FILES_DESKTOP_SESSION_EXPIRE_SECONDS DESKTOP_SESSION_EXPIRE_SECONDS 86400 (1 day) Lifetime in seconds of sessions created by desktop or native clients via the Login v2 flow. These sessions are independent of browser sessions and are not terminated by logout or backchannel logout events.
JWT Secret FILES_JWT_SECRET JWT_SECRET (random) Secret key used to sign internal JWTs (e.g. WOPI access tokens). If not set, a random UUID-based secret is generated at startup — meaning tokens are invalidated on every restart. Set an explicit value in clustered deployments so tokens remain valid across restarts and servers.

Search tab

Setting notes.ini key DB profile key Default Description
Search Enabled FILES_SEARCH_ENABLED SEARCH_ENABLED auto Controls whether the external search integration is active. Defaults to 1 automatically if FILES_SEARCH_URL is set, 0 otherwise. Set explicitly to override the automatic behaviour.
Search URL FILES_SEARCH_URL SEARCH_URL (none) URL of the external search service. When omitted, full-text search is disabled.
Search User FILES_SEARCH_USER SEARCH_USER (none) Username for authenticating with the search service.
Search Password FILES_SEARCH_PASSWORD SEARCH_PASSWORD (none) Password for authenticating with the search service.
Search Retry Count FILES_SEARCH_MAX_RETRY_COUNT SEARCH_RETRY_COUNT 2 Number of times a failed search request is retried before giving up.

Limits tab

Setting notes.ini key DB profile key Default Description
Max Versions FILES_MAX_VERSIONS MAX_VERSIONS 5 Maximum number of versions retained per file. Older versions are pruned automatically when a new version is saved.
Trash Retention Days FILES_TRASH_RETENTION_DAYS TRASH_RETENTION_DAYS 30 Number of days a file stays in the trash before it is permanently deleted by the purge housekeeping operation.
Quota MB FILES_QUOTA_MB QUOTA_MB 5120 (5 GB) Per-user storage quota in megabytes. Users who exceed their quota cannot upload new files until they free space.
Access Request Cooldown Hours FILES_ACCESS_REQUEST_COOLDOWN_HOURS ACCESS_REQUEST_COOLDOWN_HOURS 24 Minimum number of hours a user must wait before submitting another access request for the same item. Prevents request spam.
Max Recent Files FILES_MAX_RECENT_FILES MAX_RECENT_FILES 100 Maximum number of recent-file entries maintained per user.
Max Folder Depth FILES_MAX_FOLDER_DEPTH MAX_FOLDER_DEPTH 25 Maximum folder nesting depth. Requests that would exceed this depth are rejected.
Audit Retention FILES_AUDIT_RETENTION AUDIT_RETENTION 30 Number of days to retain audit log records in the admin database. Records older than this value are removed by the daily AuditPurge agent.
Low Disk Space MB FILES_LOW_DISK_SPACE_MB LOW_DISK_SPACE_MB 0 Minimum free disk space in MiB required before uploads are accepted. When free space falls below this threshold, uploads are rejected with an appropriate error. 0 disables the check.
Delete Request Retention FILES_DELETE_REQUEST_RETENTION DELETE_REQUEST_RETENTION 30 Number of days to retain completed, dry-run, or failed delete-user-data request documents in the admin database before the daily DeleteRequestPurge agent removes them. Pending and in-progress requests are never purged.
Heavy Load CPU Percent FILES_HEAVY_LOAD_CPU_PERCENT HEAVY_LOAD_CPU_PERCENT 80 Host CPU utilisation, as a percentage, at or above which background thumbnail generation and search indexing are paused. See Pausing background work under load. 0 disables the check, so background work always runs.

Pausing background work under load

Thumbnail generation and search indexing are optional work: generating a thumbnail decodes an image or drives a Collabora conversion, and indexing extracts a file's content and ships it to the search service. Both compete for CPU with the requests users are actually waiting on.

To keep the server responsive, both pause whenever CPU utilisation stays at or above HEAVY_LOAD_CPU_PERCENT (default 80) for at least five seconds. CPU is measured for the whole system, not just this task, so load from Domino itself (compact, updall, replication), from Collabora, or from any other process counts.

Nothing is lost, and nothing starves. Both queues are durable documents in the data database (ThumbnailRecord and SearchRecord notes), and while the server is busy the records are still created — only their processing waits. Specifically:

  • A worker waits between records, never part-way through one, so a file is never left half-processed.
  • It resumes within half a second of load dropping, so a lull is used immediately.
  • If load never drops, it still lets one record through every 60 seconds. A server that is permanently busy therefore drains its backlog slowly, rather than never.

This is visible in the server log at debug level (it fires on every busy spell, so it is kept out of the normal log stream — raise the log level to see it when diagnosing why background work is lagging):

System under heavy load (94% CPU), pausing thumbnail generation
Load cleared (31% CPU), resuming thumbnail generation
Still under heavy load (91% CPU) after 60s, processing one thumbnail generation record anyway to keep the queue draining

Console commands are never refused: tell files search-sync and tell files rebuild-search-index always run, and the work they queue is then paced the same way as everything else.

In a container, CPU is measured against the container's own CPU limit when one is set (cgroup v1 and v2 are both supported), not against the host. This matters: a pod limited to 4 cores on a 64-core node can be fully CPU-throttled while the node as a whole looks idle. With no CPU limit set, the whole machine is measured, which is then the correct reading. The source is logged once, on the first sample:

Load is measured from the container's CPU quota
Load is measured from the host CPU (/proc/stat)

Set HEAVY_LOAD_CPU_PERCENT to 0 to disable the check entirely and restore the previous behaviour, in which background work always runs at full speed regardless of load. If CPU utilisation cannot be read at all, the check fails open — background work runs as before, and a warning is logged once.

Collabora tab

Setting notes.ini key DB profile key Default Description
Collabora Enabled FILES_COLLABORA_ENABLED COLLABORA_ENABLED auto Controls whether Collabora Online editing is active. Defaults to 1 automatically if FILES_COLLABORA_HOST is set, 0 otherwise. Set explicitly to override.
Collabora Host FILES_COLLABORA_HOST COLLABORA_HOST (none) URL of the Collabora Online server (e.g. https://collabora.example.com). When omitted, in-browser editing is disabled.

CLAMAV tab

Setting notes.ini key DB profile key Default Description
ClamAV Enabled FILES_CLAMAV_ENABLED CLAMAV_ENABLED 0 Set to 1 to enable ClamAV virus scanning of every uploaded file. Requires a running clamd daemon.
ClamAV Host FILES_CLAMAV_HOST CLAMAV_HOST 127.0.0.1 Hostname or IP address of the clamd daemon.
ClamAV Port FILES_CLAMAV_PORT CLAMAV_PORT 3310 TCP port of the clamd daemon.
ClamAV Max Scan Bytes FILES_CLAMAV_MAX_SCAN_BYTES CLAMAV_MAX_SCAN_BYTES 5242880 (5 MB) Maximum bytes sent to ClamAV per file. Set to 0 to scan the entire file (may impact performance for large files).
ClamAV TLS FILES_CLAMAV_TLS CLAMAV_TLS 0 Set to 1 to wrap the connection to clamd in TLS (e.g. when an nginx TLS proxy fronts the daemon). Trusted CA roots are read from Domino's certstore.nsf.
ClamAV Strict FILES_CLAMAV_STRICT CLAMAV_STRICT 0 Set to 1 to enable strict mode: any scan error or incomplete scan result causes the upload to be rejected. When 0, scan errors are logged but the upload is allowed through.

Not in admin db

Setting notes.ini key DB profile key Default Description
HTTP Bridge Channel Buffer FILES_HTTP_BRIDGE_CHANNEL_BUFFER HTTP_BRIDGE_CHANNEL_BUFFER 4 Internal queue depth for the Domino HTTP bridge. Valid range: 1–256. Higher values smooth bursty traffic at the cost of more memory per request. Start with the default and increase only if you observe stalls under load.
Value Behaviour
disabled All public link endpoints return 403 Forbidden. No links can be created or accessed.
read-only (default) Users can create public links. Links requested with write access are silently downgraded to read-only. Write operations through public links are rejected.

The current value is reported to clients via the capabilities API:

GET /ocs/v1.php/cloud/capabilities

Moving Settings to the Admin Database

Once the service is running with notes.ini settings, you can migrate the configuration into the admin database using either of the following methods:

Method 1 — Domino console command

> tell files migrate-config

This copies all recognised FILES_* settings from notes.ini into the Config profile document in file_admin.nsf and removes them from notes.ini. From that point on, the admin database is the active configuration source.

Method 2 — Configuration form button

Open file_admin.nsf in a Notes client, navigate to the Configuration form, and click the Migrate Config button. The button issues the same tell files migrate-config command automatically.

After migration, edit settings directly in the Config profile document in file_admin.nsf. Changes take effect after reloading the add-in (tell files quit followed by load files), or on the next scheduled reload, depending on your environment.