Configuration
Configuration Source Priority
The add-in resolves each setting by checking these sources in order, stopping at the first match:
- Admin database
Configprofile — used once the admin database has been activated (see Moving Settings to the Admin Database). notes.ini— the traditional Domino configuration file.- Environment variables — If a setting is not found in the database or
notes.ini, the OS environment is checked.
Required settings have no built-in default. The add-in will refuse to start if any required setting is absent from all sources.
Required Settings
The following settings must be configured before the add-in will start:
| Setting | notes.ini key | Description |
|---|---|---|
| Origin | FILES_ORIGIN | Client-facing base URL — used in OIDC redirect URIs, public share URLs, and the URL Collabora uses to reach the service. Omit the port when behind a reverse proxy on port 443; include the port for direct-bind deployments (e.g. files.example.com:8443). |
| Port | FILES_HTTP_PORT | TCP port the HTTPS listener binds to. Independent from the port in ORIGIN: in a reverse-proxy setup the proxy listens on 443 (in ORIGIN) and forwards to this port (typically 8443). |
| OIDC Issuer | FILES_OIDC_ISSUER | OIDC provider discovery URL (e.g. https://idp.example.com). |
| OIDC Client ID | FILES_OIDC_CLIENT_ID | Client identifier registered with the OIDC provider. |
| OIDC Client Secret | FILES_OIDC_CLIENT_SECRET | Client secret registered with the OIDC provider. |
Full Settings Reference
The Configuration form in file_admin.nsf is organized into tabs. Settings are grouped below to match that structure.
Basic tab
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| Origin | FILES_ORIGIN | ORIGIN | (required) | Client-facing base URL. See Required Settings. |
| Port | FILES_HTTP_PORT | PORT | (required) | TCP listener port. See Required Settings. |
| Web App Folder | FILES_WEB_APP_FOLDER | WEB_APP_FOLDER | file-service-files | Path to the static web application assets. May be relative to the Domino program directory or an absolute path. |
| Web Picker Folder | FILES_WEB_PICKER_FOLDER | WEB_PICKER_FOLDER | file-picker-files | Path to the file-picker component assets served to other HCL products. May be relative to the Domino program directory or an absolute path. |
| Org Name | FILES_ORG_NAME | ORG_NAME | (none) | Optional display name for the organisation, shown in the UI and in notification emails. |
| No-Reply Sender | FILES_NOREPLY_SENDER | NOREPLY_SENDER | noreply@<origin host> | Email address used as the From address for notification emails (e.g. share notifications, access-request emails). Defaults to noreply@ followed by the hostname from ORIGIN. |
| Thumbnail Generation | FILES_THUMBNAIL_GENERATION | THUMBNAIL_GENERATION | 1 | Set to 0 to disable all thumbnail generation. When enabled (1), image thumbnails are generated natively; Office/PDF thumbnails require Collabora to be configured. |
| Server Group | FILES_SERVER_GROUP | SERVER_GROUP | (none) | Name of a Domino group containing all file-service servers. Used to broadcast backchannel logout events to peer servers in a cluster. |
Authentication tab
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| OIDC Issuer | FILES_OIDC_ISSUER | OIDC_ISSUER | (required) | OIDC provider URL. |
| OIDC Client ID | FILES_OIDC_CLIENT_ID | OIDC_CLIENT_ID | (required) | OIDC client identifier. |
| OIDC Client Secret | FILES_OIDC_CLIENT_SECRET | OIDC_CLIENT_SECRET | (required) | OIDC client secret. |
| OIDC Scopes | FILES_OIDC_SCOPES | OIDC_SCOPES | openid,profile,email | Comma-separated list of OIDC scopes requested at login. |
| Accept Invalid Certs | FILES_ACCEPT_INVALID_CERTS | ACCEPT_INVALID_CERTS | 0 | Set to 1 to accept invalid TLS certificates on outbound connections. For development use only — never enable in production. |
| Access Token Accepted Audiences | FILES_ACCESS_TOKEN_ACCEPTED_AUDIENCES | ACCESS_TOKEN_ACCEPTED_AUDIENCES | (none) | Comma-separated list of accepted aud claim values for incoming bearer access tokens (e.g. files-api,account). When set, tokens whose audience does not match any entry are rejected. When empty, audience validation is skipped. |
| Public Link Permissions | FILES_PUBLIC_LINK_PERMISSIONS | PUBLIC_LINK_PERMISSIONS | read-only | Controls whether public (anonymous) links can be created and what access level they may grant. Values: disabled, read-only (default), read-write. See table below. |
| Trusted Return Origins | FILES_TRUSTED_RETURN_ORIGINS | TRUSTED_RETURN_ORIGINS | (none) | Comma-separated list of trusted external URL origins permitted as redirect targets after the /checksession endpoint (e.g. https://mail.example.com,https://chat.example.com). An empty list blocks all external redirects. |
| Session Expire Seconds | FILES_SESSION_EXPIRE_SECONDS | SESSION_EXPIRE_SECONDS | 0 | Lifetime of a browser session cookie in seconds. 0 (default) creates a session cookie that expires when the browser closes. Any positive value sets a persistent cookie with that lifetime. |
| Desktop Session Expire Seconds | FILES_DESKTOP_SESSION_EXPIRE_SECONDS | DESKTOP_SESSION_EXPIRE_SECONDS | 86400 (1 day) | Lifetime in seconds of sessions created by desktop or native clients via the Login v2 flow. These sessions are independent of browser sessions and are not terminated by logout or backchannel logout events. |
| JWT Secret | FILES_JWT_SECRET | JWT_SECRET | (random) | Secret key used to sign internal JWTs (e.g. WOPI access tokens). If not set, a random UUID-based secret is generated at startup — meaning tokens are invalidated on every restart. Set an explicit value in clustered deployments so tokens remain valid across restarts and servers. |
Search tab
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| Search Enabled | FILES_SEARCH_ENABLED | SEARCH_ENABLED | auto | Controls whether the external search integration is active. Defaults to 1 automatically if FILES_SEARCH_URL is set, 0 otherwise. Set explicitly to override the automatic behaviour. |
| Search URL | FILES_SEARCH_URL | SEARCH_URL | (none) | URL of the external search service. When omitted, full-text search is disabled. |
| Search User | FILES_SEARCH_USER | SEARCH_USER | (none) | Username for authenticating with the search service. |
| Search Password | FILES_SEARCH_PASSWORD | SEARCH_PASSWORD | (none) | Password for authenticating with the search service. |
| Search Retry Count | FILES_SEARCH_MAX_RETRY_COUNT | SEARCH_RETRY_COUNT | 2 | Number of times a failed search request is retried before giving up. |
Limits tab
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| Max Versions | FILES_MAX_VERSIONS | MAX_VERSIONS | 5 | Maximum number of versions retained per file. Older versions are pruned automatically when a new version is saved. |
| Trash Retention Days | FILES_TRASH_RETENTION_DAYS | TRASH_RETENTION_DAYS | 30 | Number of days a file stays in the trash before it is permanently deleted by the purge housekeeping operation. |
| Quota MB | FILES_QUOTA_MB | QUOTA_MB | 5120 (5 GB) | Per-user storage quota in megabytes. Users who exceed their quota cannot upload new files until they free space. |
| Access Request Cooldown Hours | FILES_ACCESS_REQUEST_COOLDOWN_HOURS | ACCESS_REQUEST_COOLDOWN_HOURS | 24 | Minimum number of hours a user must wait before submitting another access request for the same item. Prevents request spam. |
| Max Recent Files | FILES_MAX_RECENT_FILES | MAX_RECENT_FILES | 100 | Maximum number of recent-file entries maintained per user. |
| Max Folder Depth | FILES_MAX_FOLDER_DEPTH | MAX_FOLDER_DEPTH | 25 | Maximum folder nesting depth. Requests that would exceed this depth are rejected. |
| Audit Retention | FILES_AUDIT_RETENTION | AUDIT_RETENTION | 30 | Number of days to retain audit log records in the admin database. Records older than this value are removed by the daily AuditPurge agent. |
| Low Disk Space MB | FILES_LOW_DISK_SPACE_MB | LOW_DISK_SPACE_MB | 0 | Minimum free disk space in MiB required before uploads are accepted. When free space falls below this threshold, uploads are rejected with an appropriate error. 0 disables the check. |
| Delete Request Retention | FILES_DELETE_REQUEST_RETENTION | DELETE_REQUEST_RETENTION | 30 | Number of days to retain completed, dry-run, or failed delete-user-data request documents in the admin database before the daily DeleteRequestPurge agent removes them. Pending and in-progress requests are never purged. |
| Heavy Load CPU Percent | FILES_HEAVY_LOAD_CPU_PERCENT | HEAVY_LOAD_CPU_PERCENT | 80 | Host CPU utilisation, as a percentage, at or above which background thumbnail generation and search indexing are paused. See Pausing background work under load. 0 disables the check, so background work always runs. |
Pausing background work under load
Thumbnail generation and search indexing are optional work: generating a thumbnail decodes an image or drives a Collabora conversion, and indexing extracts a file's content and ships it to the search service. Both compete for CPU with the requests users are actually waiting on.
To keep the server responsive, both pause whenever CPU utilisation stays at or above HEAVY_LOAD_CPU_PERCENT (default 80) for at least five seconds. CPU is measured for the whole system, not just this task, so load from Domino itself (compact, updall, replication), from Collabora, or from any other process counts.
Nothing is lost, and nothing starves. Both queues are durable documents in the data database (ThumbnailRecord and SearchRecord notes), and while the server is busy the records are still created — only their processing waits. Specifically:
- A worker waits between records, never part-way through one, so a file is never left half-processed.
- It resumes within half a second of load dropping, so a lull is used immediately.
- If load never drops, it still lets one record through every 60 seconds. A server that is permanently busy therefore drains its backlog slowly, rather than never.
This is visible in the server log at debug level (it fires on every busy spell, so it is kept out of the normal log stream — raise the log level to see it when diagnosing why background work is lagging):
System under heavy load (94% CPU), pausing thumbnail generation
Load cleared (31% CPU), resuming thumbnail generation
Still under heavy load (91% CPU) after 60s, processing one thumbnail generation record anyway to keep the queue draining
Console commands are never refused: tell files search-sync and tell files rebuild-search-index always run, and the work they queue is then paced the same way as everything else.
In a container, CPU is measured against the container's own CPU limit when one is set (cgroup v1 and v2 are both supported), not against the host. This matters: a pod limited to 4 cores on a 64-core node can be fully CPU-throttled while the node as a whole looks idle. With no CPU limit set, the whole machine is measured, which is then the correct reading. The source is logged once, on the first sample:
Load is measured from the container's CPU quota
Load is measured from the host CPU (/proc/stat)
Set HEAVY_LOAD_CPU_PERCENT to 0 to disable the check entirely and restore the previous behaviour, in which background work always runs at full speed regardless of load. If CPU utilisation cannot be read at all, the check fails open — background work runs as before, and a warning is logged once.
Collabora tab
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| Collabora Enabled | FILES_COLLABORA_ENABLED | COLLABORA_ENABLED | auto | Controls whether Collabora Online editing is active. Defaults to 1 automatically if FILES_COLLABORA_HOST is set, 0 otherwise. Set explicitly to override. |
| Collabora Host | FILES_COLLABORA_HOST | COLLABORA_HOST | (none) | URL of the Collabora Online server (e.g. https://collabora.example.com). When omitted, in-browser editing is disabled. |
CLAMAV tab
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| ClamAV Enabled | FILES_CLAMAV_ENABLED | CLAMAV_ENABLED | 0 | Set to 1 to enable ClamAV virus scanning of every uploaded file. Requires a running clamd daemon. |
| ClamAV Host | FILES_CLAMAV_HOST | CLAMAV_HOST | 127.0.0.1 | Hostname or IP address of the clamd daemon. |
| ClamAV Port | FILES_CLAMAV_PORT | CLAMAV_PORT | 3310 | TCP port of the clamd daemon. |
| ClamAV Max Scan Bytes | FILES_CLAMAV_MAX_SCAN_BYTES | CLAMAV_MAX_SCAN_BYTES | 5242880 (5 MB) | Maximum bytes sent to ClamAV per file. Set to 0 to scan the entire file (may impact performance for large files). |
| ClamAV TLS | FILES_CLAMAV_TLS | CLAMAV_TLS | 0 | Set to 1 to wrap the connection to clamd in TLS (e.g. when an nginx TLS proxy fronts the daemon). Trusted CA roots are read from Domino's certstore.nsf. |
| ClamAV Strict | FILES_CLAMAV_STRICT | CLAMAV_STRICT | 0 | Set to 1 to enable strict mode: any scan error or incomplete scan result causes the upload to be rejected. When 0, scan errors are logged but the upload is allowed through. |
Not in admin db
| Setting | notes.ini key | DB profile key | Default | Description |
|---|---|---|---|---|
| HTTP Bridge Channel Buffer | FILES_HTTP_BRIDGE_CHANNEL_BUFFER | HTTP_BRIDGE_CHANNEL_BUFFER | 4 | Internal queue depth for the Domino HTTP bridge. Valid range: 1–256. Higher values smooth bursty traffic at the cost of more memory per request. Start with the default and increase only if you observe stalls under load. |
Public Link Permissions
| Value | Behaviour |
|---|---|
disabled | All public link endpoints return 403 Forbidden. No links can be created or accessed. |
read-only (default) | Users can create public links. Links requested with write access are silently downgraded to read-only. Write operations through public links are rejected. |
The current value is reported to clients via the capabilities API:
GET /ocs/v1.php/cloud/capabilities
Moving Settings to the Admin Database
Once the service is running with notes.ini settings, you can migrate the configuration into the admin database using either of the following methods:
Method 1 — Domino console command
> tell files migrate-config
This copies all recognised FILES_* settings from notes.ini into the Config profile document in file_admin.nsf and removes them from notes.ini. From that point on, the admin database is the active configuration source.
Method 2 — Configuration form button
Open file_admin.nsf in a Notes client, navigate to the Configuration form, and click the Migrate Config button. The button issues the same tell files migrate-config command automatically.
After migration, edit settings directly in the Config profile document in file_admin.nsf. Changes take effect after reloading the add-in (tell files quit followed by load files), or on the next scheduled reload, depending on your environment.