Environment settings
The values that live in the settings file rather than in the screen, and why.
Why some settings are not in the screen
A setting can be set in two places: on the Settings page, or in the .env file
on each node. When both have a value, the file wins.
That is why the Settings page has a section at the bottom called Set in the environment. Anything listed there is being controlled by the file and cannot be changed from the screen. If a box will not save, or saves and then goes back to its old value, that list is the first thing to look at.
The arrangement exists so that somebody building servers automatically can set everything in the file and know the screen cannot quietly change it later. If you are not doing that, use the screen and ignore the file.
The values
| Name | What it does | Default |
|---|---|---|
NFM_NODE_NAME | Short name for this box. Shows up all over the GUI, so make it something you will recognize at three in the morning. Has to be unique in the cluster. | The hostname |
NFM_NODE_ADDRESS | The address other nodes use to reach this one. An address on the network your load balancers share, not the public one and not localhost. | Guessed |
NFM_CLUSTER_PRIORITY | Who wins the election. Higher takes it. Ties break on node name, so the result is always the same rather than a coin flip. | 100 |
NFM_GUI_PORT | The web GUI port. | 7443 |
NFM_PEER_PORT | Node to node. | 7444 |
NFM_BIND_ADDRESS | What address to bind to. If your management network is its own interface, put that address here and cut your exposure. | 0.0.0.0 |
NFM_SECRET_KEY | Encrypts secrets at rest: the single sign on client secret, DNS credentials, and the per peer HMAC keys. Generated by the installer. Every node needs its own. | Generated |
NFM_ADMIN_ALLOWLIST | Which networks may load the GUI at all. Checked before the login page renders. Leave it empty and anybody who can reach the port sees the login page. | Empty |
NFM_TRUSTED_PROXIES | Whose forwarded address header we are willing to believe. Empty is the right answer unless you put a proxy in front of the GUI. | Empty |
NFM_SESSION_TIMEOUT_MINUTES | How long a signed in session lasts. | 60 |
NFM_ROOT_PATH | The prefix the GUI is served under, when you put it behind a site. | Empty |
NFM_ACME_EMAIL | Where the certificate authority sends expiry warnings. Genuinely optional. | Empty |
NFM_ACME_STAGING | Use the practice service. On by default on purpose. | true |
NFM_OIDC_* | Single sign on fallbacks. These days the settings live in the database instead, and anything left blank there falls back to these. | Empty |
NFM_LOG_LEVEL | How much the manager logs. | info |
NFM_HOST_GID | The group id the container shares with the host agent socket. | 10001 |
Never copy .env between machines
It carries the node name, the node address and the secret key. A second machine with the first machine's file believes it is the first machine, and both end up sharing one key. The installer refuses to join when it spots this, and a machine set up before that check will sit there failing quietly.
The allowlist is the one that matters
It is enforced before anything in the database is read, which is why it cannot be a setting on a page. Set it on every node. Include IPv6 forms if your staff might arrive over IPv6, because an allowlist that names only IPv4 is the most common way people lock themselves out of their own system.
It is a different thing from the management networks list on the Settings page. That one decides who your nginx sites let in. This one decides who can reach the management GUI at all.