Central Configuration

The Central Configuration is where all global settings for a Domino installation are listed.

Go to the Admin portal.
Click Advanced > Central Config.
On the Configuration Management page, you can:
- Click an existing record to edit its attributes.
- Click Add Record to create a new setting. If no record is created in the application, the system uses the default value.
  
  You must restart the Domino services for changes to take effect. To do this, click here to restart services.

Authentication

These options relate to the Keycloak authentication service. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`authentication.oidc.externalOrgsEnabled`
	`false`	Enables Domino organization membership to synchronize with SAML identity provider attributes so that membership can be managed by the identity provider.
`authentication.oidc.externalRolesEnabled`
	`false`	Enables Domino’s user roles to synchronize with SAML identity provider attributes so that user role management can be managed by the identity provider.
`com.cerebro.domino.frontend.authentication.defaultRoles`
	`Practitioner`	If `authentication.oidc.externalRolesEnabled` is `true`, then user roles are retrieved from SAML. If that key is `false`, use this key to set the default roles using a comma-separated list. An example value is: `Practitioner,SysAdmin`. To set this key to a `LiteUser`, delete the central config key entry. A `Lite User` is a user with no roles. See Roles for more information.

authentication.oidc.externalOrgsEnabled

false

Enables Domino organization membership to synchronize with SAML identity provider attributes so that membership can be managed by the identity provider.

authentication.oidc.externalRolesEnabled

false

Enables Domino’s user roles to synchronize with SAML identity provider attributes so that user role management can be managed by the identity provider.

com.cerebro.domino.frontend.authentication.defaultRoles

Practitioner

If authentication.oidc.externalRolesEnabled is true, then user roles are retrieved from SAML. If that key is false, use this key to set the default roles using a comma-separated list. An example value is: Practitioner,SysAdmin. To set this key to a LiteUser, delete the central config key entry. A Lite User is a user with no roles.

See Roles for more information.

Authorization

These options relate to authorization and user roles.

Key Default Description

com.cerebro.domino.auth.refreshTokenInRun.proxyPort

8899

The port on which the API proxy operates. Do not change this value.

Caution

Contact a Customer Success Manager if you want to change this value.

com.cerebro.domino.restrictPublishing

false

If true, only SupportStaff and SysAdmins can create launchers, schedule runs, or publish apps and model APIs.

com.cerebro.domino.authorization.restrictManageCollaborators

false

If true, Project Owners can manage project collaborators. However, the Invite button in the Collaborators and permissions section on the Access & Sharing tab in Project Settings is not available for other users, even if they are collaborators. See Invite collaborators.

com.cerebro.domino.authorization.limitProjectSharing

false

If true, then only users with the Project Manager Domino user role or administrators can manage project permissions. See Settings permissions.

Blob storage

Domino can store long-term, unstructured data in blob storage buckets.

Key Default Description

Key	Default	Description
`com.cerebro.domino.blobStorageMedium`
	""	Determines the DFS storage host for the deployment. For example if set to `S3` or `AzureBlob`, the deployment uses the corresponding object store.

com.cerebro.domino.blobStorageMedium

Determines the DFS storage host for the deployment. For example if set to S3 or AzureBlob, the deployment uses the corresponding object store.

S3 storage options

These options relate to Domino File System support for AWS S3 storage. This is available for AWS deployments only.

Key Default Description

Key	Default	Description
`com.cerebro.domino.blobs.s3.connectionManagerTimeoutDuration`
	`60s`	The timeout duration for a connection from the connection manager.
`com.cerebro.domino.blobs.s3.connectionTimeoutDuration`
	`60s`	The timeout duration for the connection to S3 storage.
`com.cerebro.domino.blobs.s3.bucketInPath`
	`false`	Configures the S3 client to use path-style access for all requests.
`com.cerebro.domino.blobs.s3.bucket`
	""	Required: Name of the S3 bucket in which you want to store blobs.
`com.cerebro.domino.blobs.s3.defaultS3BucketPrefix`
	""	Prefix that is added to the container name. The user can set this, but this prefix must also be on the container in S3.
`com.cerebro.domino.blobs.s3.defaultS3BucketSuffix`
	""	Suffix that is added to the container name. The user can set this, but this suffix must also be on the container in S3.
`com.cerebro.domino.blobs.s3.endpointUrl`
	""	Overrides the S3 client endpoint.
`com.cerebro.domino.blobs.s3.maxConnections`
	`100`	Determines the pool size of max blobs to transfer concurrently.
`com.cerebro.domino.blobs.s3.path`
	""	Carried over from the S3 settings.
`com.cerebro.domino.blobs.s3.region`
	""	The region of the S3 account.
`com.cerebro.domino.blobs.s3.signedUrlTimeoutDuration`
	`5 minutes`	The timeout duration to access the S3 blob store through a signed URL. This pertains to the CLI only.
`com.cerebro.domino.blobs.s3.socketTimeoutDuration`
	`60s`	The timeout duration for packets to reach the server.
`com.cerebro.domino.blobs.s3.sseKmsKeyId`
	""	The KMS key ID for use with server-side encryption.

com.cerebro.domino.blobs.s3.connectionManagerTimeoutDuration

60s

The timeout duration for a connection from the connection manager.

com.cerebro.domino.blobs.s3.connectionTimeoutDuration

60s

The timeout duration for the connection to S3 storage.

com.cerebro.domino.blobs.s3.bucketInPath

false

Configures the S3 client to use path-style access for all requests.

com.cerebro.domino.blobs.s3.bucket

Required: Name of the S3 bucket in which you want to store blobs.

com.cerebro.domino.blobs.s3.defaultS3BucketPrefix

Prefix that is added to the container name. The user can set this, but this prefix must also be on the container in S3.

com.cerebro.domino.blobs.s3.defaultS3BucketSuffix

Suffix that is added to the container name. The user can set this, but this suffix must also be on the container in S3.

com.cerebro.domino.blobs.s3.endpointUrl

Overrides the S3 client endpoint.

com.cerebro.domino.blobs.s3.maxConnections

100

Determines the pool size of max blobs to transfer concurrently.

com.cerebro.domino.blobs.s3.path

Carried over from the S3 settings.

com.cerebro.domino.blobs.s3.region

The region of the S3 account.

com.cerebro.domino.blobs.s3.signedUrlTimeoutDuration

5 minutes

The timeout duration to access the S3 blob store through a signed URL. This pertains to the CLI only.

com.cerebro.domino.blobs.s3.socketTimeoutDuration

60s

The timeout duration for packets to reach the server.

com.cerebro.domino.blobs.s3.sseKmsKeyId

The KMS key ID for use with server-side encryption.

Builder

These options relate to the Domino builder.

The Domino builder is a container that runs as a Kubernetes job to build the Docker images for Domino environments and Model APIs. This container is deployed to a node labeled with a configurable Kubernetes label (defaults to domino/build-node=TRUE) whenever a user triggers an environment or model build.

Key Default Description

Key	Default	Description
`com.cerebro.domino.builder.job.environment.buildCpuShares`
	200 CPU shares	If `ShortLivedImageBuilderV2` is off, this limits the CPU utilization for Docker build jobs when your users build environment and model images. If you want to leave the build operation unlimited, delete the default value. This setting corresponds to the `--cpu-shares , -c` docker build command parameter. See here for valid values.
`com.cerebro.domino.builder.job.environment.buildMemory`
	2 (2147483647) GB	If `ShortLivedImageBuilderV2` is off, this limits the memory utilization for Docker build jobs when your users build environment and model images. If you want to leave the build operation unlimited, delete the default value. This setting corresponds to the `--memory , -m` docker build command parameter. See here for valid values.
`com.cerebro.domino.builder.remoteRegistryCredentials.server`
	`quay.io`	The external Docker registry URI to pull Domino base images from.
`com.cerebro.domino.builder.remoteRegistryCredentials.secretName`
	`domino-quay-repos`	The K8s secret containing credentials for authentication to an external Docker registry.
`com.cerebro.domino.builder.remoteRegistryCredentials.secretNamespace`
	<Domino Compute Namespace>	The namespace where the external Docker registry secret is located.
`com.cerebro.domino.builder.job.environment.imageSizeLimit`
	None	Sets a hard upper limit on the object size of created environment revisions in the internal Docker registry. Takes arguments in the form: `10M`.
`com.cerebro.domino.builder.job.model.imageSizeLimit`
	None	Sets a hard upper limit on the object size of created Model API revisions in the internal Docker registry. Takes arguments in the form: `10M`.
`com.cerebro.domino.builder.job.resource.limits.cpu`
	`4` (cores)	Sets a hard upper limit on the vCPU required for image builds. Takes kubernetes quantities as arguments.
`com.cerebro.domino.builder.job.resource.limits.memory`
	`15Gi`	Sets a hard upper limit on the memory required for image builds. Takes kubernetes quantities as arguments
`ShortLived.ImageBuilderV2`
	`on`	Controls whether Domino will use the V2 image builder or V1 image builder. This is a Domino service that creates environment revisions and Model API version Docker images. If you change the setting, you must restart the Nucleus services to apply RabbitMQ queue changes.

com.cerebro.domino.builder.job.environment.buildCpuShares

200 CPU shares

If ShortLivedImageBuilderV2 is off, this limits the CPU utilization for Docker build jobs when your users build environment and model images.

If you want to leave the build operation unlimited, delete the default value. This setting corresponds to the --cpu-shares , -c docker build command parameter.

See here for valid values.

com.cerebro.domino.builder.job.environment.buildMemory

2 (2147483647) GB

If ShortLivedImageBuilderV2 is off, this limits the memory utilization for Docker build jobs when your users build environment and model images.

If you want to leave the build operation unlimited, delete the default value. This setting corresponds to the --memory , -m docker build command parameter.

See here for valid values.

com.cerebro.domino.builder.remoteRegistryCredentials.server

quay.io

The external Docker registry URI to pull Domino base images from.

com.cerebro.domino.builder.remoteRegistryCredentials.secretName

domino-quay-repos

The K8s secret containing credentials for authentication to an external Docker registry.

com.cerebro.domino.builder.remoteRegistryCredentials.secretNamespace

The namespace where the external Docker registry secret is located.

com.cerebro.domino.builder.job.environment.imageSizeLimit

None

Sets a hard upper limit on the object size of created environment revisions in the internal Docker registry. Takes arguments in the form: 10M.

com.cerebro.domino.builder.job.model.imageSizeLimit

None

Sets a hard upper limit on the object size of created Model API revisions in the internal Docker registry. Takes arguments in the form: 10M.

com.cerebro.domino.builder.job.resource.limits.cpu

4 (cores)

Sets a hard upper limit on the vCPU required for image builds. Takes kubernetes quantities as arguments.

com.cerebro.domino.builder.job.resource.limits.memory

15Gi

Sets a hard upper limit on the memory required for image builds. Takes kubernetes quantities as arguments

ShortLived.ImageBuilderV2

on

Controls whether Domino will use the V2 image builder or V1 image builder. This is a Domino service that creates environment revisions and Model API version Docker images. If you change the setting, you must restart the Nucleus services to apply RabbitMQ queue changes.

Compute grid

These options relate to the compute grid. They are available in namespace common and must be recorded with no name.

Key Default Description

com.cerebro.domino.computegrid.kubernetes.apps.nginx.clientBodyMaxSizeMiB

25MiB

Sets the client_body_max_size property for the nginx reverse proxy in workspace pods.

Note	If a file upload to a workspace (such as Jupyter or RStudio) fails with a 413 HTTP code, it might be because the file is larger than this limit. If necessary, increase this limit.

com.cerebro.domino.computegrid.kubernetes.volume.gcFrequency

10min

Controls how often the garbage collector runs to delete old or excess persistent volumes.

com.cerebro.domino.computegrid.kubernetes.volume.maxAge

7 days

Setting a value here will cause persistent volumes older than that to be automatically deleted by the garbage collector.

com.cerebro.domino.computegrid.kubernetes.volume.maxIdle

32

Maximum number of idle persistent volumes to keep. Idle volumes in excess of this number will be deleted by the garbage collector.

com.cerebro.domino.computegrid.kubernetes.volume.storageClass

dominodisk

Kubernetes storage class that will be used to dynamically provision persistent volumes. This is set initially to the value of storage_classes.block.name in the installer storage classes configuration.

com.cerebro.domino.computegrid.kubernetes.volume.volumesSizeInGB

15

Size in GB of compute grid persistent volumes. This is the total amount of disk space available to users in runs and workspaces.

com.cerebro.computegrid.timeouts.sagaStateTimeouts.deployingStateTimeoutSeconds

60 * 60 (1 hour)

The number of seconds an execution pod in a deploying state will wait before timing out.

com.cerebro.computegrid.timeouts.sagaStateTimeouts.executionsOverQuotaStateTimeoutSeconds

24 * 60 * 60 (24 hours)

The number of seconds an execution pod that cannot be assigned due to execution quota limitations will wait for resources to become available before timing out.

com.cerebro.computegrid.timeouts.sagaStateTimeouts.preparingStateTimeoutSeconds

60 * 60 (1 hour)

The number of seconds an execution pod in a preparing state will wait before timing out.

com.cerebro.domino.computegrid.userExecutionsQuota.maximumExecutionsPerUser

25

This is the maximum number of executions each user will be allowed to run concurrently. If a user attempts to start additional executions in excess of this those executions will be queued until some of the user’s other executions finish.

Database

These options customize MongoDB connections.

Key Default Description

Key	Default	Description
`mongodb.default.settings.connectionPool.maxWaitQueueSize`
	`500`	The maximum number of threads allowed to wait for a MongoDB connection.

mongodb.default.settings.connectionPool.maxWaitQueueSize

500

The maximum number of threads allowed to wait for a MongoDB connection.

Email notifications

These options relate to email notifications from Domino. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.supportAlerter.enableEmailSupportAlert`
	`false`	Enable email notifications for the runs which resulted in errors or warnings.
`com.cerebro.domino.email.smtp.host`
	None	Hostname of SMTP relay to use for sending emails from Domino.
`com.cerebro.domino.email.smtp.user`
	None	Username to use for authenticating to the SMTP host.
`com.cerebro.domino.email.smtp.port`
	`25`	Port to use for connecting to SMTP host.
`com.cerebro.domino.email.smtp.ssl`
	`false`	Whether the SMTP host uses SSL.
`com.cerebro.domino.supportAlerter.enableEmailSupportAlert`
	`false`	Enable email notifications for the runs which resulted in errors or warnings.
`com.cerebro.domino.supportAlerter.errorRecipients`
	`alerts@dominodatalab.com`	Comma-separated list of email recipients who should get the error notifications. The placeholder value `alerts@dominodatalab.com` needs to be changed.
`com.cerebro.domino.supportAlerter.warningRecipients`
	`alerts@dominodatalab.com`	Comma-separated list of email recipients who should get the warning notifications. The placeholder value `alerts@dominodatalab.com` needs to be changed.

com.cerebro.domino.supportAlerter.enableEmailSupportAlert

false

Enable email notifications for the runs which resulted in errors or warnings.

com.cerebro.domino.email.smtp.host

None

Hostname of SMTP relay to use for sending emails from Domino.

com.cerebro.domino.email.smtp.user

None

Username to use for authenticating to the SMTP host.

com.cerebro.domino.email.smtp.port

25

Port to use for connecting to SMTP host.

com.cerebro.domino.email.smtp.ssl

false

Whether the SMTP host uses SSL.

com.cerebro.domino.supportAlerter.enableEmailSupportAlert

false

Enable email notifications for the runs which resulted in errors or warnings.

com.cerebro.domino.supportAlerter.errorRecipients

alerts@dominodatalab.com

Comma-separated list of email recipients who should get the error notifications. The placeholder value alerts@dominodatalab.com needs to be changed.

com.cerebro.domino.supportAlerter.warningRecipients

alerts@dominodatalab.com

Comma-separated list of email recipients who should get the warning notifications. The placeholder value alerts@dominodatalab.com needs to be changed.

Environments

These options relate to Domino Environments. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.environments.canNonSysAdminsCreateEnvironments`
	`true`	If set to `false` only system administrators can edit environments.
`com.cerebro.domino.environments.default.image`
	`quay.io/domino/base:Ubuntu18_DAD_Py3.6_R3.6_20190918`	Docker image URI for the initial default environment.
`com.cerebro.domino.environments.default.name`
	Domino Analytics Distribution Py3.6 R3.6	Name of the initial default environment.

com.cerebro.domino.environments.canNonSysAdminsCreateEnvironments

true

If set to false only system administrators can edit environments.

com.cerebro.domino.environments.default.image

quay.io/domino/base:Ubuntu18_DAD_Py3.6_R3.6_20190918

Docker image URI for the initial default environment.

com.cerebro.domino.environments.default.name

Domino Analytics Distribution Py3.6 R3.6

Name of the initial default environment.

File download API

These options relate to the file contents download API endpoint. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.restrictBlobApi`
	`false`	Set to `true` to require an admin API key to download files through API. When `false`, any user with the blob ID for a file might download it through API.
`com.cerebro.domino.frontend.clientBlobModeOverride`
	None	Set to `API` to download blobs directly in the Domino API. Set to `S3` to download blobs through S3. You cannot set the blob mode override in `site_config.json`.

com.cerebro.domino.restrictBlobApi

false

Set to true to require an admin API key to download files through API. When false, any user with the blob ID for a file might download it through API.

com.cerebro.domino.frontend.clientBlobModeOverride

None

Set to API to download blobs directly in the Domino API. Set to S3 to download blobs through S3. You cannot set the blob mode override in site_config.json.

ImageBuilder

These options relate to the Domino ImageBuilder V2 and V3.

Use the ImageBuilder to create new environment revision and Model API version Docker images. To satisfy requirements around heightened security and support for non-Docker container runtimes (such as cri-o for OpenShift), the ImageBuilder uses an open-source image building engine named Buildkit and wraps in a suitable fashion for Domino’s use. The ImageBuilder acts as a controller, built around the Kubernetes operator pattern in which it acts on custom resources (ContainerImageBuild) using standard CRUD actions.

Key Default Description

Key	Default	Description
`com.cerebro.domino.builder.remoteRegistryCredentials.server`
	`quay.io`	The external Docker registry URI to pull Domino base images from.
`com.cerebro.domino.builder.remoteRegistryCredentials.secretName`
	`domino-quay-repos`	The K8s secret containing credentials for authentication to an external Docker registry.
`com.cerebro.domino.builder.remoteRegistryCredentials.secretNamespace`
	<Domino Compute Namespace>	The namespace where the external Docker registry secret is located.
`com.cerebro.domino.builder.job.environment.imageSizeLimit`
	None	Sets a hard upper limit on the object size of created environment revisions in the internal Docker registry. Takes arguments in the form: `10M`.
`com.cerebro.domino.builder.job.model.imageSizeLimit`
	None	Sets a hard upper limit on the object size of created Model API revisions in the internal Docker registry. Takes arguments in the form: `10M`.
`com.cerebro.domino.builder.job.resource.limits.cpu`
	`4` (cores)	Sets a hard upper limit on the vCPU required for image builds. Takes kubernetes quantities as arguments.
`com.cerebro.domino.builder.job.resource.limits.memory`
	`15Gi`	Sets a hard upper limit on the memory required for image builds. Takes kubernetes quantities as arguments

com.cerebro.domino.builder.remoteRegistryCredentials.server

quay.io

The external Docker registry URI to pull Domino base images from.

com.cerebro.domino.builder.remoteRegistryCredentials.secretName

domino-quay-repos

The K8s secret containing credentials for authentication to an external Docker registry.

com.cerebro.domino.builder.remoteRegistryCredentials.secretNamespace

The namespace where the external Docker registry secret is located.

com.cerebro.domino.builder.job.environment.imageSizeLimit

None

Sets a hard upper limit on the object size of created environment revisions in the internal Docker registry. Takes arguments in the form: 10M.

com.cerebro.domino.builder.job.model.imageSizeLimit

None

Sets a hard upper limit on the object size of created Model API revisions in the internal Docker registry. Takes arguments in the form: 10M.

com.cerebro.domino.builder.job.resource.limits.cpu

4 (cores)

Sets a hard upper limit on the vCPU required for image builds. Takes kubernetes quantities as arguments.

com.cerebro.domino.builder.job.resource.limits.memory

15Gi

Sets a hard upper limit on the memory required for image builds. Takes kubernetes quantities as arguments

Long-running Workspaces

These options relate to long-running workspace sessions and long-running jobs. They are available in namespace common and must be recorded with no name.

Key Default Description

com.cerebro.domino.workloadNotifications.longRunningWorkloadDefinitionInSeconds

86400

Defines how long a workspace must run in seconds before the workspace is classified as 'long-running' and begins to generate notifications or becomes subject to automatic shutdown.

com.cerebro.domino.workloadNotifications.isEnabled

false

Set to true to enable the option for email notifications to users when their workspaces become long-running. If com.cerebro.domino.workloadNotifications.isEnabled is true and com.cerebro.domino.workloadNotifications.isRequired is false, users can turn these notifications on or off in their account settings.

com.cerebro.domino.workloadNotifications.isRequired

false

Set to true to turn on long-running workspace notifications for all users. While this is true users cannot turn off long-running workspace notifications.

com.cerebro.domino.workloadNotifications.maximumPeriodInSeconds

7200

Maximum time (in seconds) that a user can set as the period between receiving long-running notification emails.

Note

This does not change how often users will receive notifications. They receive repeated notifications about long-running workspaces based on the frequency that they set in the application. If your users want to change the frequency of their notifications, provide them the following information: Auto Shut Down: Long Running Workspace.

These options relate to long-running workspace sessions. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.workspaceAutoShutdown.isEnabled`
	`false`	Set to `true` to enable automatic shutdown of long-running workspaces. Users can turn automatic shutdown for their workspaces on or off from their account settings.
`com.cerebro.domino.workspaceAutoShutdown.isRequired`
	`false`	Set to `true` to turn on automatic shutdown of long-running workspaces for all users. While this is `true` users cannot turn off automatic shutdown of their long-running workspaces.
`com.cerebro.domino.workspaceAutoShutdown.globalMaximumLifetimeInSeconds`
	`259200`	Longest time in seconds a long-running workspace will be allowed to continue before automatic shutdown. Users cannot set their automatic shutdown timer to be longer than this.

com.cerebro.domino.workspaceAutoShutdown.isEnabled

false

Set to true to enable automatic shutdown of long-running workspaces. Users can turn automatic shutdown for their workspaces on or off from their account settings.

com.cerebro.domino.workspaceAutoShutdown.isRequired

false

Set to true to turn on automatic shutdown of long-running workspaces for all users. While this is true users cannot turn off automatic shutdown of their long-running workspaces.

com.cerebro.domino.workspaceAutoShutdown.globalMaximumLifetimeInSeconds

259200

Longest time in seconds a long-running workspace will be allowed to continue before automatic shutdown. Users cannot set their automatic shutdown timer to be longer than this.

Model APIs

These options relate to Model APIs. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.modelmanager.instances.defaultNumber`
	`2`	Default number of instances per Model used for Model API scaling.
`com.cerebro.domino.modelmanager.instances.maximumNumber`
	`32`	Maximum number of instances per Model used for Model API scaling.
`com.cerebro.domino.modelManager.nodeSelectorLabelKey`
	`dominodatalab.com/node-pool`	Key used in Kubernetes label node selector for Model API pods.
`com.cerebro.domino.modelManager.nodeSelectorLabelValue`
	`default`	Value used in Kubernetes label node selector for Model API pods.

com.cerebro.domino.modelmanager.instances.defaultNumber

2

Default number of instances per Model used for Model API scaling.

com.cerebro.domino.modelmanager.instances.maximumNumber

32

Maximum number of instances per Model used for Model API scaling.

com.cerebro.domino.modelManager.nodeSelectorLabelKey

dominodatalab.com/node-pool

Key used in Kubernetes label node selector for Model API pods.

com.cerebro.domino.modelManager.nodeSelectorLabelValue

default

Value used in Kubernetes label node selector for Model API pods.

On-demand Spark

These options relate to the on-demand Spark clusters. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.integrations.spark.checkClusterStatusIntervalSeconds`
	`1`	Frequency in seconds to run status checks on on-demand Spark clusters.
`com.cerebro.domino.integrations.spark.onDemand.workerStorageMountPath`
	`/tmp`	File system path on which Spark worker storage is mounted.
`com.cerebro.domino.integrations.spark.sparkConfDirDefault`
	None	Option to supply alternative default configuration directory for on-demand Spark clusters.
`com.cerebro.domino.workbench.onDemandSpark.worker.memoryOverheadMinMiB`
	`384`	Minimum amount of memory in MiB to use for Spark worker overhead.
`com.cerebro.domino.workbench.onDemandSpark.worker.memoryOverheadFactor`
	`0.1`	Spark worker overhead scaling factor.
`com.cerebro.domino.computegrid.computeCluster.spark.proxyCompatability`
	None	Set to `legacy` when the Spark UI for on-demand Spark on Domino needs to be compatible with Spark versions prior to 3.1.1.

com.cerebro.domino.integrations.spark.checkClusterStatusIntervalSeconds

1

Frequency in seconds to run status checks on on-demand Spark clusters.

com.cerebro.domino.integrations.spark.onDemand.workerStorageMountPath

/tmp

File system path on which Spark worker storage is mounted.

com.cerebro.domino.integrations.spark.sparkConfDirDefault

None

Option to supply alternative default configuration directory for on-demand Spark clusters.

com.cerebro.domino.workbench.onDemandSpark.worker.memoryOverheadMinMiB

384

Minimum amount of memory in MiB to use for Spark worker overhead.

com.cerebro.domino.workbench.onDemandSpark.worker.memoryOverheadFactor

0.1

Spark worker overhead scaling factor.

com.cerebro.domino.computegrid.computeCluster.spark.proxyCompatability

None

Set to legacy when the Spark UI for on-demand Spark on Domino needs to be compatible with Spark versions prior to 3.1.1.

Performance

The following configuration settings are used for caching.

Key Default Description

com.cerebro.domino.controlCenter.cacheMaxLoadPeriodInMonths

12

Use this key to modify the period (in months) of historical data that the Control Center uses. You might have to change this value to less than 12 to prevent timeout issues when loading data into the application. Do not set cacheMaxLoadPeriodInMonths to greater than 12 months or the chart cannot be used. The report options remain the same: Current Month, Previous Month, Last 3 months, Last 6 months, and Custom. This might improve performance.

Caution

Contact a Customer Success Manager if you want to change this value.

com.cerebro.domino.controlCenter.cacheTimeToLiveInMinutes

30

Specifies how often the cache is refreshed in minutes. This cache is used in the Control Center and improves performance. However, if the cache is refreshed every 30 minutes some recent data will not be included in the reports.

Projects

This option is available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.frontend.overrideDefaultProject`
		String of comma-separated project paths. For example, `admin-user/getting-started-project, admin-user/sample-app-project`. See Change The Default Project For New Users.
`com.cerebro.domino.frontend.defaultMaxFileSizeToRenderInBytes`
		String, indicating the biggest file that may be rendered in the filebrowser: 5 MB, 10 kB, 1 GB, 7 B

com.cerebro.domino.frontend.overrideDefaultProject

String of comma-separated project paths. For example, admin-user/getting-started-project, admin-user/sample-app-project. See Change The Default Project For New Users.

com.cerebro.domino.frontend.defaultMaxFileSizeToRenderInBytes

String, indicating the biggest file that may be rendered in the filebrowser: 5 MB, 10 kB, 1 GB, 7 B

Project visibility options

These options relate to project visibility settings. They are available in namespace common and must be recorded with no name.

Key Default Description

Key	Default	Description
`com.cerebro.domino.publicProjects.enabled`
	`true`	If set to `false`, Practitioners cannot set projects to public visibility. However, an Admin can still create public projects. A change in this setting does not affect existing projects.
`com.cerebro.domino.defaultProjectVisibility`
	`Public`	Controls the default visibility setting for new projects. Options are `Public` or `Private`.

com.cerebro.domino.publicProjects.enabled

true

If set to false, Practitioners cannot set projects to public visibility. However, an Admin can still create public projects. A change in this setting does not affect existing projects.

com.cerebro.domino.defaultProjectVisibility

Public

Controls the default visibility setting for new projects. Options are Public or Private.

Key Default Description

Key	Default	Description
`com.cerebro.domino.workbench.restrictedAssets.enabled`
	FALSE	Set to TRUE to enable marking environments and projects as restricted.

com.cerebro.domino.workbench.restrictedAssets.enabled

FALSE

Set to TRUE to enable marking environments and projects as restricted.

Read-write Datasets

These options relate to read-write datasets. They are available in namespace common and must be recorded with no name. Scratch spaces have been deprecated starting with Domino 4.5.

Key Default Description

com.cerebro.domino.dataset.maxFileListingLength

1000

The maximum number of files shown in the dataset snapshot file viewer

com.cerebro.domino.dataset.fileCacheTimeout

2s

The timeout for fetching files in the dataset snapshot file viewer

com.cerebro.domino.dataset.quota.enabled

true

If true, the dataset (com.cerebro.domino.dataset.quota.maxActiveSnapshotsPerDataset) and snapshot (com.cerebro.domino.dataset.quota.maxDatasetsPerProject) limits will be enforced. If false, these settings are ignored.

com.cerebro.domino.dataset.quota.maxActiveSnapshotsPerDataset

20

The maximum number of snapshots a user can create for a dataset. com.cerebro.domino.dataset.quota.enabled must be true for this to work.

If the user reaches the maximum number of snapshots, the next time they create a snapshot, Domino shows a warning that they have reached their snapshot limit and that if they proceed, their oldest snapshot will be marked for deletion.

See Create a Snapshot of a Dataset and Datasets and Snapshots.

com.cerebro.domino.dataset.quota.maxDatasetsPerProject

5

The maximum number of Datasets you can create in a Project. com.cerebro.domino.dataset.quota.enabled must be true for this to work.

If the user reaches the maximum number of datasets, Domino shows a message about the limit.

com.cerebro.domino.dataset.quota.maxFileSizeForPreview

5000000

The maximum file size (in bytes) that the Data renderer will support to preview files. If a file is larger than this limit, the renderer will default to a message recommending file download.

See Datasets and Snapshots.

com.cerebro.domino.dataset.containerHome

/domino/datasets

Set the path to mount datasets in Domino projects. Users see this path in the Path column on the Domino Datasets tab on the Data page.

Note	This is not for git-based projects.

Tip	Add '/' to the beginning of the path to make it clear that it is an absolute path.

See Domino Datasets.

com.cerebro.domino.dataset.gitBasedContainerHome

/mnt

Path at which datasets reside in git-based projects.

Tip	Add '/' to the beginning of the path to make it clear that it is an absolute path.

com.cerebro.domino.dataset.executor.snapshotSizeTimeout

1 minute

The time allotted to gather all file sizes to calculate the size of the snapshot. If the time expires and the size hasn’t finished calculating, Domino shows the current calculation for the snapshot but doesn’t notify the user that the calculation is incomplete.

com.cerebro.domino.dataset.storageUsageWarningThreshold

70

The percentage of a user’s dataset storage quota that, when reached, triggers warning notifications.

com.cerebro.domino.dataset.storageUsageCriticalThreshold

85

The percentage of a user’s dataset storage quota that, when reached, triggers email notifications.

com.cerebro.domino.dataset.snapshotSizingPeriod

7 days

Interval during which the size of a snapshot are not recalculated.

com.cerebro.domino.dataset.thresholdActionPeriod

7 days

Interval during which notifications to users about their storage usage are not repeated.

com.cerebro.domino.dataset.unitCostDollarsPerGbPerMonth

None

Estimate unit cost of a dataset (in dollars/GB/month). This value is multiplied linearly by the size of a dataset to estimate its cost per month.

Key Default Description

Key	Default	Description
`com.cerebro.domino.runResults.maximumNumberOfInputComparisons`
	`1000`	The maximum number of input files to compare.
`com.cerebro.domino.runResults.maximumNumberOfInputDiffs`
	`250`	The maximum number of input file comparisons that will be found. If this value is reached, the comparison will stop.
`com.cerebro.domino.runResults.maximumNumberOfResultsComparisons`
	`1000`	The maximum number of result files to compare.
`com.cerebro.domino.runResults.maximumNumberOfResultsDiffs`
	`250`	The maximum number of result file comparisons that will be found. If this value is reached, the comparison will stop.

com.cerebro.domino.runResults.maximumNumberOfInputComparisons

1000

The maximum number of input files to compare.

com.cerebro.domino.runResults.maximumNumberOfInputDiffs

250

The maximum number of input file comparisons that will be found. If this value is reached, the comparison will stop.

com.cerebro.domino.runResults.maximumNumberOfResultsComparisons

1000

The maximum number of result files to compare.

com.cerebro.domino.runResults.maximumNumberOfResultsDiffs

250

The maximum number of result file comparisons that will be found. If this value is reached, the comparison will stop.

Usage reports

These options relate to the User Activity Reports.

Key Default Description

com.cerebro.domino.email.usageReportRecipient

usage@dominodatalab.com

Sets the default recipient for the user activity report. To access this report, go to Admin > Advanced > User Activity Report.

com.cerebro.domino.email.EmailToDomino

true

When true, the system sends a scheduled user activity report to usage@dominodatalab.com to help improve Domino.

com.cerebro.domino.Usage.RecentUsageDays

30

Specifies the number of days to report for recent activity in the user activity reports. For example, the default value includes activity within the past 30 days in the Recent Activity section.

Important

The cron entry is set in UTC.

com.cerebro.domino.Usage.ReportFrequency

0 2 * * *

Defines the frequency for automatically scheduled user activity reports. The default cron string value is set to daily at 02:00.

com.cerebro.domino.Usage.ReportRecipients

Empty

Identifies a comma-separated list of email addresses that receive automatic scheduled user activity reports. This is not shown in the Central Configuration unless it is set explicitly. Example values are: email1@domain.com, email2@domain.com.

Web Apps

IFrame Security

Web apps in Domino are served in HTML inline frames, also known as “iframes”. To improve iframe security, a “sandbox” attribute can be set for iframe elements. When this attribute is set, extra security restrictions are applied to the iframes serving web apps in Domino, like blocking cross-origin requests, form submissions, script executions, and much more.

In Domino, this “sandbox” attribute can be toggled with the ShortLived.iFrameSecurityEnabled feature flag. Setting this flag to “TRUE” will apply the sandbox attribute to the iframe and apply the extra security restrictions. If the flag is set to “FALSE”, no security restrictions will be applied to the iframe. By default, in Domino 4.4.1 the ShortLived.iFrameSecurityEnabled flag is set to FALSE.

Important

This feature flag will be deprecated in future versions of Domino. Domino recommends implementing web app security using content security policies instead (described below).

Content Security Policies

A content security policy allows Domino web apps to access specific, whitelisted external resources. Any request made to non-whitelisted external resources, however, will be blocked.

In Domino, you can toggle this feature with the EnableContentSecurityPolicyforApps feature flag. Setting this flag to “TRUE” will block requests to all non-whitelisted resources and allow requests to whitelisted resources. Setting this flag to “FALSE” will allow all requests to resources (that is, no blocking of any kind). By default, in Domino 4.4.1 the EnableContentSecurityPolicyforApps is set to FALSE.

The keys and default values associated with this feature flag are listed in the table below.

Key Default Description

Key	Default	Description
`com.cerebro.domino.apps.contentSecurityPolicy.whiteListAppHost`
	`true`	Whitelist the app’s own host URL for all resource types. This can be toggled to `false` for an even more stringent security policy. For example, to prevent internal attacks by disabling all JavaScript in web apps, you can set this flag to `false` and `com.cerebro.domino.apps.contentSecurityPolicy.whiteListedScriptSrcList` to `none` or the empty string.
`com.cerebro.domino.apps.contentSecurityPolicy.whiteListedImageSrcList`
	`data:`	Allows images to be inserted directly into a webapp using a `data:` URL. This allows Domino apps to include images in the app’s HTML without loading the image from an outside resource. Learn more about `data:` URLs here: Mozilla - Data URLs.
`com.cerebro.domino.apps.contentSecurityPolicy.whiteListedScriptSrcList`
	`cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.js` `cdn.plot.ly/plotly-latest.min.js` `'unsafe-eval' 'unsafe-inline'`	Whitelists the URLs of the scripts that the demo Apps in the `quick-start` project load to display their interactive charts. It also allows an app to define scripts in HTML using the `<script>` tag. Also allows JavaScript to create more JavaScript as the app runs using the built-in JavaScript function `eval`.
`com.cerebro.domino.apps.contentSecurityPolicy.whiteListedStyleSrcList`
	`'unsafe-inline'`	Allows apps to define their own styles with `<style>`, `javascript:` URLs, and inline `<script>` elements.
`com.cerebro.domino.apps.contentSecurityPolicy.whiteListedConnectSrcList`
	`ws:`	Allows the app to use WebSockets, which use URLs that begin with `ws:`, to communicate with other resources.

com.cerebro.domino.apps.contentSecurityPolicy.whiteListAppHost

true

Whitelist the app’s own host URL for all resource types. This can be toggled to false for an even more stringent security policy. For example, to prevent internal attacks by disabling all JavaScript in web apps, you can set this flag to false and com.cerebro.domino.apps.contentSecurityPolicy.whiteListedScriptSrcList to none or the empty string.

com.cerebro.domino.apps.contentSecurityPolicy.whiteListedImageSrcList

data:

Allows images to be inserted directly into a webapp using a data: URL. This allows Domino apps to include images in the app’s HTML without loading the image from an outside resource. Learn more about data: URLs here: Mozilla - Data URLs.

com.cerebro.domino.apps.contentSecurityPolicy.whiteListedScriptSrcList

cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.js cdn.plot.ly/plotly-latest.min.js 'unsafe-eval' 'unsafe-inline'

Whitelists the URLs of the scripts that the demo Apps in the quick-start project load to display their interactive charts. It also allows an app to define scripts in HTML using the <script> tag. Also allows JavaScript to create more JavaScript as the app runs using the built-in JavaScript function eval.

com.cerebro.domino.apps.contentSecurityPolicy.whiteListedStyleSrcList

'unsafe-inline'

Allows apps to define their own styles with <style>, javascript: URLs, and inline <script> elements.

com.cerebro.domino.apps.contentSecurityPolicy.whiteListedConnectSrcList

ws:

Allows the app to use WebSockets, which use URLs that begin with ws:, to communicate with other resources.

To whitelist a resource:

Go to Configuration Management (that is, Central Config) in your Domino admin settings.
Click Add Record.
Set the key to com.cerebro.domino.apps.contentSecurityPolicy.whiteListedConnectSrcList.
Set the value to ws: followed by the URL of the resource you’d like to whitelist (that is, ws: https://foobar.buz.bax/). You must work with your team to figure out which URLs have to be whitelisted. For more details, see: Identify Resources to Whitelist.
Save the record and restart Domino services.

IFrame Security in combination with Content Security Policies

In Domino 4.4.1, the ShortLived.iFrameSecurityEnabled and EnableContentSecurityPolicyforApps feature flags coexist. The matrix below describes the blocking behavior for requests based on both feature flags.

Important

The IFrame feature flag will be deprecated in future versions of Domino. Domino recommends implementing web app security using content security policies instead.

	ShortLived.iFrameSecurityEnabled = FALSE	ShortLived.iFrameSecurityEnabled = TRUE
EnableContent SecurityPolicyForApps = FALSE	No blocking occurs. All requests to external resources are allowed.	All requests from web apps to external resources are blocked.
EnableContent SecurityPolicyForApps = TRUE	Only requests to whitelisted external resources are allowed. All other requests to external resources are blocked.	All requests from web apps to external resources are blocked.

ShortLived.iFrameSecurityEnabled = FALSE

ShortLived.iFrameSecurityEnabled = TRUE

EnableContent SecurityPolicyForApps = FALSE

No blocking occurs. All requests to external resources are allowed.

All requests from web apps to external resources are blocked.

EnableContent SecurityPolicyForApps = TRUE

Only requests to whitelisted external resources are allowed. All other requests to external resources are blocked.

All requests from web apps to external resources are blocked.

White labeling

Use these options to customize the Domino application with your organization’s brand. See White Labeling.

Key Default Description

Key	Default	Description
`com.cerebro.domino.frontend.footerCustomization.customContactUsHref`
	N/A	Set a URL that directs your users to a web-based form or email address (mailto:support@domain.com).
`com.cerebro.domino.frontend.footerCustomization.customFooterHtml`
	N/A	Set the custom HTML to show immediately above the page footer.
`com.cerebro.domino.frontend.footerCustomization.customFooterImageUrl`
	N/A	Set the URL for the image that you want shown in the footer. The image displays on the same line as the Domino logo. If `customFooterHTML` is set, this displays below the custom HTML, inside the footer.
`com.cerebro.domino.whitelabel.jsonConfig`
	N/A	A JSON-formatted list of white labeling configuration parameters, such as: { "appLogo": "https://s3-us-west-2.amazonaws.com/your-logo.png", "appName": "Your Company Name", "favicon": "https://www.your-website.com/favicon.ico", "helpContentUrl": "https://your-support-website.com", "showSupportButton": true, "supportEmail": "support@your-email-domain.com", "errorPageContactEmail": "support-error@your-email-domain.com", "hidePopularProjects": true, "hideSuggestedProjects": true, "gitCredentialsDescription": "Authenticate to your Git Account by clicking Add a New Git Credential", "hideDownloadDominoCli": true, "pageFooter": "<p>Your Custom Footer</p>", "hideSearchableProjects": true }

com.cerebro.domino.frontend.footerCustomization.customContactUsHref

N/A

Set a URL that directs your users to a web-based form or email address (mailto:support@domain.com).

com.cerebro.domino.frontend.footerCustomization.customFooterHtml

N/A

Set the custom HTML to show immediately above the page footer.

com.cerebro.domino.frontend.footerCustomization.customFooterImageUrl

N/A

Set the URL for the image that you want shown in the footer. The image displays on the same line as the Domino logo. If customFooterHTML is set, this displays below the custom HTML, inside the footer.

com.cerebro.domino.whitelabel.jsonConfig

N/A

A JSON-formatted list of white labeling configuration parameters, such as:

{
"appLogo": "https://s3-us-west-2.amazonaws.com/your-logo.png",
"appName": "Your Company Name",
"favicon": "https://www.your-website.com/favicon.ico",
"helpContentUrl": "https://your-support-website.com",
"showSupportButton": true,
"supportEmail": "support@your-email-domain.com",
"errorPageContactEmail": "support-error@your-email-domain.com",
"hidePopularProjects": true,
"hideSuggestedProjects": true,
"gitCredentialsDescription": "Authenticate to your Git Account by clicking Add a New Git Credential",
"hideDownloadDominoCli": true,
"pageFooter": "<p>Your Custom Footer</p>",
"hideSearchableProjects": true
}

Custom HTML banner

Workspaces

These options relate to Domino workspaces.

Key Default Description

Key	Default	Description
`com.cerebro.domino.workbench.project.defaultVolumeSizeGiB`
	`10`	Controls default allocated persistent volume size for a new workspace.
`com.cerebro.domino.workbench.project.minVolumeSizeGiB`
	`4`	Controls min allocated persistent volume size for a new workspace.
`com.cerebro.domino.workbench.project.maxVolumeSizeGiB`
	`200`	Controls max allocated persistent volume size for a new workspace.
`com.cerebro.domino.workbench.workspace.maxWorkspacesPerUserPerProject`
	`2`	Sets a limit on the number of provisioned workspaces per user per project.
`com.cerebro.domino.workbench.workspace.maxWorkspacesPerUser`
	`8`	Sets a limit on the number of provisioned workspaces per user across all projects.
`com.cerebro.domino.workbench.workspace.maxWorkspaces`
	`1500`	Sets a limit on the number of provisioned workspaces across the whole Domino.
`com.cerebro.domino.workbench.workspace.maxAllocatedVolumeSizeAcrossAllWorkspacesGiB`
	`None`	Sets a limit on the total volume size of all provisioned workspaces across the whole Domino combined.
`com.cerebro.domino.workbench.workspace.stopToDeleteDelayDuration`
	`20.seconds`	The number of seconds the frontend waits after the workspace stops before making the delete request to the backend. This allows for enough time after workspace stop for the workspace’s persistent volume to be released. If users frequently receive an error after trying a delete, then this value should be increased.
`com.cerebro.domino.workbench.workspace.volume.enableSnapshots`
	`true`	Whether to capture snapshots of workspace persistent volumes in AWS.
`com.cerebro.domino.workbench.workspace.volume.snapshotCleanupFrequency`
	`1.day`	How often to delete all but the X most recent snapshots Where X is a number defined by `workbench.workspace.volume.numSnapshotsToRetain`. Only snapshots older than two hours are cleaned up.
`com.cerebro.domino.workbench.workspace.volume.numSnapshotsToRetain`
	`5`	The number of snapshots to retain. All older snapshots beyond this limit will be deleted during a periodic cleanup.

com.cerebro.domino.workbench.project.defaultVolumeSizeGiB

10

Controls default allocated persistent volume size for a new workspace.

com.cerebro.domino.workbench.project.minVolumeSizeGiB

4

Controls min allocated persistent volume size for a new workspace.

com.cerebro.domino.workbench.project.maxVolumeSizeGiB

200

Controls max allocated persistent volume size for a new workspace.

com.cerebro.domino.workbench.workspace.maxWorkspacesPerUserPerProject

2

Sets a limit on the number of provisioned workspaces per user per project.

com.cerebro.domino.workbench.workspace.maxWorkspacesPerUser

8

Sets a limit on the number of provisioned workspaces per user across all projects.

com.cerebro.domino.workbench.workspace.maxWorkspaces

1500

Sets a limit on the number of provisioned workspaces across the whole Domino.

com.cerebro.domino.workbench.workspace.maxAllocatedVolumeSizeAcrossAllWorkspacesGiB

None

Sets a limit on the total volume size of all provisioned workspaces across the whole Domino combined.

com.cerebro.domino.workbench.workspace.stopToDeleteDelayDuration

20.seconds

The number of seconds the frontend waits after the workspace stops before making the delete request to the backend. This allows for enough time after workspace stop for the workspace’s persistent volume to be released. If users frequently receive an error after trying a delete, then this value should be increased.

com.cerebro.domino.workbench.workspace.volume.enableSnapshots

true

Whether to capture snapshots of workspace persistent volumes in AWS.

com.cerebro.domino.workbench.workspace.volume.snapshotCleanupFrequency

1.day

How often to delete all but the X most recent snapshots Where X is a number defined by workbench.workspace.volume.numSnapshotsToRetain. Only snapshots older than two hours are cleaned up.

com.cerebro.domino.workbench.workspace.volume.numSnapshotsToRetain

5

The number of snapshots to retain. All older snapshots beyond this limit will be deleted during a periodic cleanup.