> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/settings.md).

# Settings

Every setting the installation procedures use, what it controls, and whether it can change after the deployment is built.

Deployment-level configuration lives in `/usr/local/openiam/env.conf`, read by the installation and by the platform's own scripts. Service properties are generated from your answers during installation and live in `/usr/local/openiam/conf/properties/`.

**Treat both as sensitive.** They hold credentials for the deployment.

The **Changeable** column is the one to read before you build: *Yes* means edit and restart, *Rebuild* means the value is fixed once the deployment exists.

## Deployment

| Setting              | Controls                                                            | Default              | Changeable |
| -------------------- | ------------------------------------------------------------------- | -------------------- | ---------- |
| `HOME_DIR`           | Where the platform is installed                                     | `/usr/local/openiam` | Rebuild    |
| `INTERNET_AVAILABLE` | Whether the installation downloads components or uses staged files  | `true`               | Yes        |
| `OPENIAM_ENV`        | Entitlement channel — `release` or `prerelease`                     | `release`            | Yes        |
| `SEARCH_ENGINE`      | Search tier — `OS` for OpenSearch, `ES` for Elasticsearch           | `OS`                 | Rebuild    |
| `SERVICE_ACCOUNT`    | Account used for host-to-host operations in a three-node deployment | `root`               | Yes        |

## Database

| Setting                         | Controls                                                     | Default               | Changeable          |
| ------------------------------- | ------------------------------------------------------------ | --------------------- | ------------------- |
| `FLYWAY_DATABASE_TYPE`          | Database platform — `mysql`, `postgres`, `mssql` or `oracle` | `mysql`               | **Rebuild**         |
| `INSTALL_LOCAL_DB`              | Whether the installation installs a database on this host    | `true`                | Rebuild             |
| `FLYWAY_OPENIAM_HOST`           | Database server hostname                                     | `localhost`           | Yes, with a restart |
| `FLYWAY_OPENIAM_PORT`           | Database server port                                         | `3306`                | Yes, with a restart |
| `FLYWAY_BASELINE_VERSION`       | Schema baseline for a new deployment                         | `2.3.0.0`             | Rebuild             |
| `FLYWAY_<schema>_DATABASE_NAME` | Name of each of the eight schemas                            | The schema's own name | Rebuild             |
| `FLYWAY_<schema>_USERNAME`      | Application account for each schema                          | The schema's own name | Rebuild             |
| `FLYWAY_ORACLE_SID`             | Oracle SID, when connecting by SID rather than service name  | Empty                 | Rebuild             |

The eight schemas are `openiam`, `activiti`, `groovy`, `auditlog`, `batchtasks`, `pbac`, `certification` and `privacy`. **Use the default names** — they are what the installation and every service expect.

All eight are hosted on one database server.

## Ports

| Setting                | Controls                                       | Default |
| ---------------------- | ---------------------------------------------- | ------- |
| `NGINX_PORT`           | The interface router, behind the reverse proxy | `8080`  |
| `IDP_PORT`             | Identity provider                              | `8081`  |
| `WEBCONSOLE_PORT`      | Webconsole                                     | `8082`  |
| `SELFSERVICE_PORT`     | Self-service                                   | `8083`  |
| `SELFSERVICE_EXT_PORT` | Self-service, external                         | `8084`  |
| `REPORTVIEWER_PORT`    | Report viewer                                  | `8085`  |
| `UI_STATIC_PORT`       | Static interface assets                        | `8086`  |
| `VAULT_PORT`           | Secret store                                   | `8200`  |
| `REDIS_PORTS`          | Cache                                          | `6379`  |

**These are all internal.** Users reach the platform on 80 or 443 through the reverse proxy — Apache `httpd` with the OpenIAM module — which routes to the interface router on `NGINX_PORT` and to the service bus on 9080. None of the ports in this table is exposed, and none of them is an address to publish.

The proxy and router configurations are generated from these values. If one must change because another application on the host already holds it, change it here **before** installing.

To publish the platform on a different external address or port, do it at your load balancer.

## Secret store

| Setting                   | Controls                                       | Default               | Changeable                      |
| ------------------------- | ---------------------------------------------- | --------------------- | ------------------------------- |
| `VAULT_URL`               | Secret store hostname                          | `localhost`           | Yes, with a restart             |
| `VAULT_PORT`              | Secret store port                              | `8200`                | Yes, with a restart             |
| `VAULT_SECURE_DEPLOYMENT` | Whether the store requires manual unsealing    | `false`               | Yes                             |
| `VAULT_JKS_PASSWORD`      | Keystore password for the store's certificates | A shipped placeholder | **Change it before installing** |

**Set `VAULT_JKS_PASSWORD` to your own value before you install.**

## Three-node deployments

**A three-node cluster is configured in a different file.** The cluster tooling has its own `infra.conf`, which names the three hosts, the shared storage server, the network, and the port each clustered tier is fronted on. [*Install*](/installation/rpm/rpm-ha/install.md) lists every setting in it.

`env.conf` still exists on each of the three hosts and still holds that host's own settings — ports, the secret store, logging. It is `infra.conf` that describes the cluster.

**On a single-node deployment, leave the `*_CLUSTER_HOSTS_LIST` entries in `env.conf` at their defaults.**

## Logging

| Setting             | Controls                                                                                                                        | Default | Changeable                          |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------- |
| `OPENIAM_LOG_LEVEL` | Verbosity of the installation and platform scripts                                                                              | `trace` | Yes                                 |
| Service log level   | Set per service in `/usr/local/openiam/services/start_<service>.sh` as `-Dlogging.level.root` and `-Dlogging.level.org.openiam` | `ERROR` | Yes, with a restart of that service |

Raise the level while diagnosing an issue and return it afterwards.

## Search tier

| Setting               | Controls                 | Default     | Changeable          |
| --------------------- | ------------------------ | ----------- | ------------------- |
| `OPENSEARCH_PROTOCOL` | `http` or `https`        | `https`     | Yes, with a restart |
| `CURATOR_HOST`        | Index maintenance target | `localhost` | Yes                 |
| `CURATOR_PORT`        | Index maintenance port   | `9200`      | Yes                 |

## Search index retention

These control how long the platform keeps its provisioning and federation indexes. They are set at installation and applied by the search tier.

| Setting                                            | Controls                                                          |
| -------------------------------------------------- | ----------------------------------------------------------------- |
| `MAX_INDEX_SIZE_DAYS`                              | How long an index stays current before it rolls over              |
| `MAX_INDEX_SIZE_GB`                                | The size at which an index rolls over                             |
| `DAYS_TO_CURATE_DATA`                              | How long rolled-over provisioning and federation indexes are kept |
| `ES_DOC_MAX_INDEX_SIZE_DAYS`                       | The same, for document indexes                                    |
| `ES_DOC_WARN_PHASE_DAYS`, `ES_DOC_COLD_PHASE_DAYS` | When document indexes move to the warm and cold phases            |
| `ES_DOC_DAYS_TO_CURATE_DATA`                       | How long document indexes are kept                                |

**Review these against your audit retention obligations** before the deployment carries real data. They are set at installation; changing them afterwards means updating the policy in the search tier.

## What this page does not cover

**Tuning values** are deliberately absent here so that this page stays a record of what the installation procedures use. Cache refresh intervals, batch sizes, thread pools, consumer counts and rate limits are on [Configuration tuning reference](/installation/tuning.md).

Service memory limits — which is what decides each JVM's heap, since no service sets `-Xmx` — are on [Service memory](/installation/tuning.md#service-memory). **Sizing for your expected load is not documented anywhere yet**; for a capacity question, talk to OpenIAM support.

**Application configuration** — password policy, notification templates, managed systems, roles and campaigns — is held in the platform and configured in the Webconsole. See the [Administration Guide](/administration-guide/admin.md).

## After changing a setting

Most changes need the platform restarted:

{% code overflow="wrap" %}

```bash
openiam-cli stop && openiam-cli start
```

{% endcode %}

Then repeat the checks in [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md).

## Related

* [*Install*](/installation/rpm/rpm-single-node/install.md)
* [*Configure*](/installation/rpm/rpm-single-node/configure.md)
* [*Ports — single node*](/installation/rpm/rpm-single-node/ports.md) and [*Ports — three nodes*](/installation/rpm/rpm-ha/ports.md)
* [*System requirements*](/installation/system-requirements.md)

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/settings.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.