Application Settings

Gateway-wide settings are read from appsettings.json. Environments and endpoints are configured separately: Environment Settings, Entity Configuration.

Configuration sources ​

From highest to lowest priority:

The console never rewrites appsettings.json. An environment variable takes precedence over the same key in appsettings.overrides.json. The console displays a key set by an environment variable as read-only, with the variable name. PUT /ui/api/settings returns 400 for that key.

Sections ​

Console ​

{
  "Console": {
    "Enabled": true,
    "PublicOrigins": [],
    "CorsOrigins": ["https://app.example.com"],
    "SecureCookies": true,
    "Customization": {
      "EnableLandingPage": true,
      "PromoText": "Welcome to **Portway**.",
      "LoginFooter": "No account? Contact your [administrator](mailto:admin@example.com)."
    }
  }
}

WebUi is the deprecated name of this section and is still read, with a warning at startup. The source with the highest priority wins, whichever name it uses. Within one file, Console takes precedence over WebUi. Console saves are written under Console.

PublicOrigins is matched against the client-supplied Origin header and does not authenticate; keep the console behind a proxy, VPN or firewall when it is not meant to be public.

ForwardedHeaders ​

{
  "ForwardedHeaders": {
    "KnownProxies": ["127.0.0.1", "::1"],
    "KnownNetworks": ["10.0.0.0/8"]
  }
}

Portway honors X-Forwarded-For only from a listed proxy. With both lists empty, the connecting address is the client address; behind a proxy, per-IP rate limiting, the sign-in lockout and the console network gate then apply to the proxy address. Settings → Security → Client addresses shows the address Portway resolved and warns about an untrusted forwarded address. Cloudflare client addresses are restored from CF-Connecting-IP for requests from Cloudflare ranges, without an entry here.

SqlConnectionPooling ​

{
  "SqlConnectionPooling": {
    "Enabled": true,
    "ApplicationName": "Portway API - Remote integration gateway",
    "MinPoolSize": 5,
    "MaxPoolSize": 100,
    "ConnectionTimeout": 15,
    "CommandTimeout": 30
  }
}

FileStorage ​

{
  "FileStorage": {
    "StorageDirectory": "storage/files",
    "MaxFileSizeBytes": 52428800,
    "UseMemoryCache": true,
    "MemoryCacheTimeSeconds": 60,
    "MaxTotalMemoryCacheMB": 200,
    "BlockedExtensions": [".exe", ".dll", ".bat", ".sh"]
  }
}

EndpointReloading ​

{
  "EndpointReloading": {
    "Enabled": true,
    "DebounceMs": 2000
  }
}

DatabaseMaintenance ​

{
  "DatabaseMaintenance": {
    "Enabled": true,
    "Schedule": "03:00",
    "Backup": {
      "Enabled": true,
      "Retention": 7
    }
  }
}

A database that fails quick_check is skipped for ANALYZE and VACUUM and logged as an error. Settings → Maintenance displays the result per database. Run now starts a run.

A snapshot is a .zip in .backups/snapshots/ with auth.db, mcp.db, environments/ and endpoints/. The databases are copied with VACUUM INTO and are consistent while Portway runs. metrics.db and tokens/ are not included. Settings → Backups creates, lists, downloads and restores snapshots. Downloading and restoring require the administrator role and are recorded in the audit trail. Backup.Enabled is independent of Enabled.

A snapshot contains password hashes, token hashes and connection strings encrypted with PORTWAY_ENCRYPTION_KEY. The same key is required to read the connection strings after a restore.

Restore extracts a snapshot into .backups/restore-pending/. The next start applies it before any database opens: the current auth.db, mcp.db, environments/ and endpoints/ are copied to .backups/pre-restore-{time}/, then replaced by the snapshot content. Items missing from the snapshot are not changed. Cancel removes the pending restore. A snapshot entry outside auth.db, mcp.db, environments/ and endpoints/ is refused.

Host and path ​

Feature switches ​

Console locations: Oidc:Enabled under Settings → Security → Deployment & Access, OpenApi:Enabled under Settings → OpenAPI, Mcp:Enabled, Mcp:ChatEnabled and the chat provider under Settings → AI, RequestTrafficLogging:Enabled under Settings → System → Logging, Console:Customization:EnableLandingPage under Settings → General.

Environment variables ​

Any key is set with __ as separator (e.g. RateLimiting__IpLimit). Portway-specific variables; list values are comma-separated:

NTLM authentication at an outbound corporate proxy requires all three PORTWAY_PROXY_* variables. AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_CLIENT_SECRET authenticate to Azure Key Vault (Azure Key Vault).

A legacy name logs a deprecation warning at startup; the PORTWAY_ name wins when both are set. For a list, set either the PORTWAY_ name or the indexed legacy names: indexed entries beyond the list length are kept.

Related topics ​

• Environment Settings
• Security
• Getting Started
• Logging