Complete configuration reference

This page is generated from the same closed JSON Schema shipped with the website. It is a searchable view of the structural file contract. Jiandu also performs runtime semantic, filesystem, and UTF-8 byte-limit checks; run jiandu --config /path/to/config.json --check-config for the authoritative deployment result.

Configuration precedence is defaults < JSON file < environment < command line. Unknown file keys and command-line flags stop startup. Every current setting requires a restart.

schema_version

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
schema_version	1	1	File only	Restart required

data_directory

Base for the SQLite database plus blob and owner-token paths. With PostgreSQL, the external URL-file reference is unchanged while blob and owner-token paths still move. A higher-precedence data-directory override moves the applicable local paths unless an equally sourced, more-specific environment path is set.

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
data_directory	string	"jiandu-data"	Environment: JIANDU_DATA_DIR CLI: --data-dir	Base for the SQLite database plus blob and owner-token paths. With PostgreSQL, the external URL-file reference is unchanged while blob and owner-token paths still move. A higher-precedence data-directory override moves the applicable local paths unless an equally sourced, more-specific environment path is set. Restart required; JSON-character length: 1–4096

server

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
server.bind	string	"127.0.0.1:8077"	Environment: JIANDU_BIND CLI: --bind	Restart required
server.request_timeout_seconds	integer	30	Environment: JIANDU_REQUEST_TIMEOUT_SECONDS	Restart required; Range: 1–300
server.ingress	object variant	{"mode":"loopback_http"}	Environment: JIANDU_INGRESS_MODE, JIANDU_PUBLIC_ORIGIN, JIANDU_INGRESS_TRUSTED_PROXY_CIDRS CLI: --ingress-mode, --public-origin, --ingress-trusted-proxy-cidrs	Closed browser/network boundary. loopback_http requires a loopback bind. https_reverse_proxy requires an exact canonical HTTPS public origin, a private backend bind, and kernel-observed direct peers in the bounded CIDR allowlist; all other direct requests are rejected. Restart required
server.ingress.mode	loopback_http	Required for loopback_http	Environment: JIANDU_INGRESS_MODE CLI: --ingress-mode	Applies to: loopback_http; Restart required
server.ingress.mode	https_reverse_proxy	Required for https_reverse_proxy	Environment: JIANDU_INGRESS_MODE CLI: --ingress-mode	Applies to: https_reverse_proxy; Restart required
server.ingress.public_origin	string	Required for https_reverse_proxy	Environment: JIANDU_PUBLIC_ORIGIN CLI: --public-origin	Applies to: https_reverse_proxy; Restart required; Format: uri; Pattern: ^https://[^/]+$; JSON-character length: 0–2048
server.ingress.trusted_proxy_cidrs	array of string	Required for https_reverse_proxy	Environment: JIANDU_INGRESS_TRUSTED_PROXY_CIDRS CLI: --ingress-trusted-proxy-cidrs	Applies to: https_reverse_proxy; Restart required; Items: 1–32; Items must be unique; Item pattern: ^[0-9A-Fa-f:.]+/[0-9]{1,3}$; Item JSON-character length: 0–64
server.public_hostname	string or null	null	Environment: JIANDU_PUBLIC_HOSTNAME CLI: --public-hostname	Deprecated migration input. Accepted only as part of the complete legacy HTTPS boundary and may not be combined with server.ingress or JIANDU_INGRESS_*. Deprecated; Restart required; JSON-character length: 0–253
server.trust_tls_termination	boolean or null	null	Environment: JIANDU_TRUST_TLS_TERMINATION CLI: --trust-tls-termination	Deprecated migration input. Accepted only when true alongside the complete legacy HTTPS boundary and may not be combined with server.ingress or JIANDU_INGRESS_*. Deprecated; Restart required
server.trusted_proxy_cidrs	array of string	null	Environment: JIANDU_TRUSTED_PROXY_CIDRS	Deprecated migration input. Accepted only as part of the complete legacy HTTPS boundary and may not be combined with server.ingress or JIANDU_INGRESS_*. Deprecated; Restart required; Items: 0–32; Items must be unique; Item pattern: ^[0-9A-Fa-f:.]+/[0-9]{1,3}$; Item JSON-character length: 0–64

database

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
database.backend	sqlite or postgres	"sqlite"	Environment: JIANDU_DATABASE_BACKEND CLI: --database-backend	Restart required
database.path	string	"jiandu-data/jiandu.sqlite3"	Environment: JIANDU_DATABASE_PATH	Restart required; JSON-character length: 1–4096
database.url_file	string or null	null Required when not (backend = sqlite)	Environment: JIANDU_DATABASE_URL_FILE CLI: --database-url-file	Owner-only file containing the complete PostgreSQL connection URL. Inline connection URLs are never accepted. Protected secret-file reference; Restart required; JSON-character length: 1–4096
database.max_connections	integer	4	Environment: JIANDU_DATABASE_MAX_CONNECTIONS	Maximum database connections. SQLite permits at most 16; PostgreSQL permits at most 64 and defaults to 4. Restart required; Range: 1–64
database.busy_timeout_milliseconds	integer	5000	Environment: JIANDU_DATABASE_BUSY_TIMEOUT_MS	SQLite writer busy timeout. This setting is rejected for PostgreSQL. Restart required; Range: 1–60000
database.min_connections	integer or null	null	Environment: JIANDU_DATABASE_MIN_CONNECTIONS	PostgreSQL minimum pool size. null selects the backend default of 1. Rejected for SQLite. Restart required; Range: 1–64
database.acquire_timeout_milliseconds	integer or null	null	Environment: JIANDU_DATABASE_ACQUIRE_TIMEOUT_MS	PostgreSQL pool-acquisition timeout. null selects the backend default of 10000 milliseconds. Rejected for SQLite. Restart required; Range: 1–60000
database.connect_timeout_milliseconds	integer or null	null	Environment: JIANDU_DATABASE_CONNECT_TIMEOUT_MS	PostgreSQL connection/startup timeout. null selects the backend default of 10000 milliseconds. Rejected for SQLite. Restart required; Range: 1–60000
database.tls_mode	verify_full or verify_ca or null	null	Environment: JIANDU_DATABASE_TLS_MODE	PostgreSQL certificate policy. null selects verify_full. verify_ca omits hostname verification; plaintext and trust-all modes are unsupported. Restart required
database.tls_ca_path	string or null	null Required when backend = postgres and tls_mode = verify_ca	Environment: JIANDU_DATABASE_TLS_CA_PATH	Optional protected file containing PostgreSQL trust anchors. verify_full without this file uses the platform trust store; verify_ca requires it. Inline CA material is not accepted. Protected secret-file reference; Restart required; JSON-character length: 1–4096

storage

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
storage.backend	local or s3 or webdav or owncloud	"local"	Environment: JIANDU_BLOB_BACKEND	Blob storage backend. Optional; omitting it selects the local disk backend, so configuration files written before this key existed are unchanged in meaning. Restart required
storage.blob_root	string	"jiandu-data/blobs"	Environment: JIANDU_BLOB_ROOT	Local disk root for the "local" backend. Ignored by a backend that owns no local path. Restart required; JSON-character length: 1–4096
storage.work_root	string	"jiandu-data/storage-work"	Environment: JIANDU_BLOB_WORK_ROOT	Private local staging and sandbox-snapshot root for a remote backend. Published documents are not mirrored here. Restart required; JSON-character length: 1–4096
storage.bucket	string or null	null Required when backend = s3	Environment: JIANDU_S3_BUCKET	S3 or S3-compatible bucket name. Required by the s3 backend. Restart required; JSON-character length: 1–255
storage.region	string or null	null	Environment: JIANDU_S3_REGION	S3 signing region; defaults to us-east-1. Restart required; JSON-character length: 1–128
storage.endpoint	string or null	null Required when backend is webdav or owncloud	Environment: JIANDU_S3_ENDPOINT, JIANDU_WEBDAV_ENDPOINT	Optional S3-compatible API endpoint, or required WebDAV collection URL. HTTPS is required unless allow_http is explicitly enabled. Restart required; Format: uri; JSON-character length: 0–2048
storage.prefix	string	""	Environment: JIANDU_BLOB_PREFIX	Optional object-key prefix dedicated to one Jiandu installation. Restart required; JSON-character length: 0–1024
storage.allow_http	boolean	false	Environment: JIANDU_BLOB_ALLOW_HTTP	Explicitly permit plaintext HTTP for a trusted local S3-compatible or WebDAV endpoint. Never disables certificate validation for HTTPS. Restart required
storage.virtual_hosted_style	boolean	false	Environment: JIANDU_S3_VIRTUAL_HOSTED_STYLE	Use virtual-hosted-style S3 requests instead of the compatibility-oriented path style. Restart required
storage.username	string or null	null Required when backend is webdav or owncloud	Environment: JIANDU_WEBDAV_USERNAME	WebDAV/ownCloud username. Required by the webdav and owncloud backends. Restart required; JSON-character length: 1–512
storage.password_file	string or null	null Required when backend is webdav or owncloud	Environment: JIANDU_WEBDAV_PASSWORD_FILE	Owner-only file containing the WebDAV app password. Inline passwords are never accepted. Protected secret-file reference; Restart required; JSON-character length: 1–4096

auth

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
auth.owner_token_path	string	"jiandu-data/owner-access-token"	Environment: JIANDU_OWNER_TOKEN_PATH	Protected secret-file reference; Restart required; JSON-character length: 1–4096
auth.session_ttl_seconds	integer	604800	Environment: JIANDU_SESSION_TTL_SECONDS	Restart required; Range: 60–2592000
auth.rotate_after_seconds	integer	86400	Environment: JIANDU_SESSION_ROTATE_AFTER_SECONDS	Restart required; Range: 1–2592000
auth.revoked_retention_seconds	integer	86400	Environment: JIANDU_REVOKED_SESSION_RETENTION_SECONDS	Restart required; Range: 0–2592000
auth.passkeys	object or null	null	File only	Exact WebAuthn relying-party boundary. null keeps passkeys disabled. HTTPS origins require trusted TLS termination, a matching public hostname, and at least one trusted proxy CIDR; exact http://localhost is allowed only on the loopback listener. Restart required
auth.passkeys.rp_id	string	Required when auth.passkeys is enabled	File only	Lowercase DNS relying-party ID. It must equal the public-origin host or be its DNS suffix. Restart required; JSON-character length: 1–253
auth.passkeys.rp_name	string	Required when auth.passkeys is enabled	File only	Human-readable relying-party name shown by authenticators. Restart required; JSON-character length: 1–80
auth.passkeys.public_origin	string	Required when auth.passkeys is enabled	File only	Exact browser origin verified by WebAuthn; paths, query strings, fragments, and credentials are forbidden. Restart required; Format: uri; JSON-character length: 1–2048
auth.providers	array of object variant	[]	File only	Bounded authentication provider registry. Provider IDs are stable lowercase URL-safe identifiers used in callback routes. Registry entries are file-only and may not be combined with the deprecated singleton auth.oidc or JIANDU_OIDC_* settings. Restart required; Items: 0–16; Items must be unique
auth.providers[].kind	oidc	Required for oidc	File only	Applies to: oidc; Restart required
auth.providers[].id	string	Required for oidc	File only	Stable provider identity used in browser start and callback routes. Applies to: oidc; Restart required; Pattern: ^[a-z](?:[a-z0-9-]{0,62}[a-z0-9])?$; JSON-character length: 0–64
auth.providers[].display_name	string	Required for oidc	File only	Operator-selected sign-in label shown to household members. Applies to: oidc; Restart required; JSON-character length: 1–80
auth.providers[].issuer	string	Required for oidc	File only	Configured HTTPS OpenID Connect issuer identifier. Applies to: oidc; Restart required; Format: uri; JSON-character length: 1–2048
auth.providers[].client_id	string	Required for oidc	File only	Applies to: oidc; Restart required; JSON-character length: 1–512
auth.providers[].client_secret_path	string	Required for oidc	File only	Applies to: oidc; Protected secret-file reference; Restart required; JSON-character length: 1–4096
auth.providers[].public_origin	string	Required for oidc	File only	Applies to: oidc; Restart required; Format: uri; JSON-character length: 1–2048
auth.providers[].admission_policy	invitation_only or required_group or open	"invitation_only"	File only	Invitation-only is the default. Required-group admission requires exact claim and group values. Open admission automatically creates a member for every identity authenticated by the configured OIDC issuer; email and domain admission are intentionally unsupported. Applies to: oidc; Restart required
auth.providers[].admission_group_claim	string or null	null	File only	Applies to: oidc; Restart required; JSON-character length: 1–256
auth.providers[].admission_group	string or null	null	File only	Applies to: oidc; Restart required; JSON-character length: 1–512
auth.providers[].kind	ldap	Required for ldap	File only	Applies to: ldap; Restart required
auth.providers[].id	string	Required for ldap	File only	Stable provider identity used for external credential lookup. Applies to: ldap; Restart required; Pattern: ^[a-z](?:[a-z0-9-]{0,62}[a-z0-9])?$; JSON-character length: 0–64
auth.providers[].display_name	string	Required for ldap	File only	Operator-selected directory sign-in label. Applies to: ldap; Restart required; JSON-character length: 1–80
auth.providers[].url	string	Required for ldap	File only	ldaps:// endpoint, or ldap:// endpoint when start_tls is true. Certificate verification is always enabled. Applies to: ldap; Restart required; Format: uri; JSON-character length: 1–2048
auth.providers[].start_tls	boolean	false	File only	Applies to: ldap; Restart required
auth.providers[].bind_dn	string or null	null	File only	Applies to: ldap; Restart required; JSON-character length: 1–2048
auth.providers[].bind_password_path	string or null	null	File only	Applies to: ldap; Protected secret-file reference; Restart required; JSON-character length: 1–4096
auth.providers[].user_base_dn	string	Required for ldap	File only	Applies to: ldap; Restart required; JSON-character length: 1–2048
auth.providers[].username_attribute	string	Required for ldap	File only	Applies to: ldap; Restart required; Pattern: ^[A-Za-z][A-Za-z0-9-]{0,63}$
auth.providers[].subject_attribute	string	Required for ldap	File only	Immutable directory UUID attribute, commonly entryUUID or objectGUID. Applies to: ldap; Restart required; Pattern: ^[A-Za-z][A-Za-z0-9-]{0,63}$
auth.providers[].display_name_attribute	string or null	null	File only	Applies to: ldap; Restart required; Pattern: ^[A-Za-z][A-Za-z0-9-]{0,63}$
auth.providers[].additional_user_filter	string or null	null	File only	Operator-controlled parenthesized LDAP filter combined with the escaped username assertion. Applies to: ldap; Restart required; JSON-character length: 2–2048
auth.providers[].admission_policy	invitation_only or required_group	"invitation_only"	File only	Applies to: ldap; Restart required
auth.providers[].group_attribute	string or null	null	File only	Applies to: ldap; Restart required; Pattern: ^[A-Za-z][A-Za-z0-9-]{0,63}$
auth.providers[].admission_group	string or null	null	File only	Applies to: ldap; Restart required; JSON-character length: 1–2048
auth.providers[].kind	trusted_proxy	Required for trusted_proxy	File only	Applies to: trusted_proxy; Restart required
auth.providers[].id	string	Required for trusted_proxy	File only	Applies to: trusted_proxy; Restart required; Pattern: ^[a-z](?:[a-z0-9-]{0,62}[a-z0-9])?$; JSON-character length: 0–64
auth.providers[].display_name	string	Required for trusted_proxy	File only	Applies to: trusted_proxy; Restart required; JSON-character length: 1–80
auth.providers[].subject_header	string	Required for trusted_proxy	File only	Lowercase header carrying the proxy's immutable provider-scoped subject. Applies to: trusted_proxy; Restart required; JSON-character length: 1–64
auth.providers[].display_name_header	string or null	null	File only	Applies to: trusted_proxy; Restart required; JSON-character length: 1–64
auth.providers[].groups_header	string or null	null	File only	Applies to: trusted_proxy; Restart required; JSON-character length: 1–64
auth.providers[].secret_path	string	Required for trusted_proxy	File only	Owner-only deployment-secret file injected by the trusted direct proxy. Applies to: trusted_proxy; Protected secret-file reference; Restart required; JSON-character length: 1–4096
auth.providers[].admission_policy	invitation_only or required_group	"invitation_only"	File only	Applies to: trusted_proxy; Restart required
auth.providers[].admission_group	string or null	null	File only	Applies to: trusted_proxy; Restart required; JSON-character length: 1–512
auth.oidc	object or null	null	File only	Deprecated single-provider OpenID Connect input retained for configuration migration. It normalizes to provider ID oidc and cannot be combined with auth.providers. null disables this compatibility input. Restart required
auth.oidc.issuer	string	No schema default	Environment: JIANDU_OIDC_ISSUER	Configured HTTPS OpenID Connect issuer identifier. Discovery and token validation must remain pinned to this issuer. Restart required; Format: uri; JSON-character length: 1–2048
auth.oidc.client_id	string	No schema default	Environment: JIANDU_OIDC_CLIENT_ID	Public OAuth client identifier for the configured issuer. Restart required; JSON-character length: 1–512
auth.oidc.client_secret_path	string	No schema default	Environment: JIANDU_OIDC_CLIENT_SECRET_PATH	Private filesystem reference to the OIDC client secret. The secret value is never accepted inline or through an environment variable. Protected secret-file reference; Restart required; JSON-character length: 1–4096
auth.oidc.public_origin	string	No schema default	Environment: JIANDU_OIDC_PUBLIC_ORIGIN	Exact HTTPS browser origin used for OIDC callbacks; it must exactly match server.ingress.public_origin. Restart required; Format: uri; JSON-character length: 1–2048
auth.oidc.admission_policy	invitation_only or required_group or open	"invitation_only"	Environment: JIANDU_OIDC_ADMISSION_POLICY	Invitation-only is the default. Required-group admission requires exact claim and group values. Open admission automatically creates a member for every identity authenticated by the configured OIDC issuer; email and domain admission are intentionally unsupported. Restart required
auth.oidc.admission_group_claim	string or null	null	Environment: JIANDU_OIDC_ADMISSION_GROUP_CLAIM	Exact identity-token claim name used only with required_group admission. Restart required; JSON-character length: 1–256
auth.oidc.admission_group	string or null	null	Environment: JIANDU_OIDC_ADMISSION_GROUP	Exact group value required only with required_group admission. Restart required; JSON-character length: 1–512

connectors

Optional OAuth email-ingest connectors. null keeps the feature unavailable. When any key is present, the effective merged configuration requires secret_key_path, oauth_client_id, oauth_client_secret_path, and an https public_origin. Provider refresh tokens are sealed at rest with the file-backed connector key; provider client secrets are also file-backed, and neither secret is accepted inline. Configure the complete boundary at https://jiandu.org/docs/configuration/capture-and-email.

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
connectors	object or null	null	File only	Optional OAuth email-ingest connectors. null keeps the feature unavailable. When any key is present, the effective merged configuration requires secret_key_path, oauth_client_id, oauth_client_secret_path, and an https public_origin. Provider refresh tokens are sealed at rest with the file-backed connector key; provider client secrets are also file-backed, and neither secret is accepted inline. Configure the complete boundary at https://jiandu.org/docs/configuration/capture-and-email. Restart required
connectors.secret_key_path	string	No schema default	Environment: JIANDU_CONNECTOR_SECRET_KEY_PATH	Owner-only file containing the base64 32-byte key that seals connector refresh tokens at rest. The key value is never accepted inline or through an environment variable. Protected secret-file reference; Restart required; JSON-character length: 1–4096
connectors.oauth_client_id	string	No schema default	Environment: JIANDU_CONNECTOR_OAUTH_CLIENT_ID	Public OAuth client identifier registered with the mailbox provider. Restart required; JSON-character length: 1–512
connectors.oauth_client_secret_path	string	No schema default	Environment: JIANDU_CONNECTOR_OAUTH_CLIENT_SECRET_PATH	Owner-only file containing the provider OAuth client secret. The secret value is never accepted inline or through an environment variable. Protected secret-file reference; Restart required; JSON-character length: 1–4096
connectors.public_origin	string	No schema default	Environment: JIANDU_CONNECTOR_PUBLIC_ORIGIN	Exact HTTPS browser origin the provider redirects back to. The registered redirect URI is this origin plus /api/v1/connectors/email/callback. Restart required; Format: uri; JSON-character length: 1–2048

capture

Optional operator-owned trust boundary for watch-folder, cloud-drive, and eSCL capture. Household users may select only these configured roots and address-pinned endpoints; null keeps these transports unavailable.

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
capture	object or null	null	File only	Optional operator-owned trust boundary for watch-folder, cloud-drive, and eSCL capture. Household users may select only these configured roots and address-pinned endpoints; null keeps these transports unavailable. Restart required
capture.watch_roots	array of object	[]	File only	Absolute local roots the operator allows Jiandu to inspect. Connector records reference an ID and cannot supply arbitrary paths. Restart required; Items: 0–32
capture.watch_roots[].id	string	Required for every item	File only	Restart required; Pattern: ^[a-z0-9][a-z0-9_-]*$; JSON-character length: 1–64
capture.watch_roots[].display_name	string	Required for every item	File only	Restart required; JSON-character length: 1–80
capture.watch_roots[].path	string	Required for every item	File only	Absolute operator-approved filesystem root. Restart required; JSON-character length: 1–4096
capture.watch_roots[].processed_directory	string	Required for every item	File only	Safe relative directory beneath the root for accepted or duplicate inputs. Restart required; JSON-character length: 1–4096
capture.watch_roots[].quarantine_directory	string	Required for every item	File only	Safe relative directory beneath the root for terminal failures. Restart required; JSON-character length: 1–4096
capture.watch_roots[].stable_seconds	integer	Required for every item	File only	Restart required; Range: 1–300
capture.watch_roots[].polling_only	boolean	Required for every item	File only	Use polling as the correctness path; filesystem events are only an optional latency hint. Restart required
capture.cloud_roots	array of object	[]	File only	Operator-approved cloud folders polled through fixed Google Drive, Dropbox, or Microsoft Graph endpoints. Root IDs must be unique across local and cloud roots. Remote files remain unchanged after ingestion. Restart required; Items: 0–32
capture.cloud_roots[].id	string	Required for every item	File only	Restart required; Pattern: ^[a-z0-9][a-z0-9_-]*$; JSON-character length: 1–64
capture.cloud_roots[].display_name	string	Required for every item	File only	Restart required; JSON-character length: 1–80
capture.cloud_roots[].provider	google_drive or dropbox or one_drive	Required for every item	File only	Restart required
capture.cloud_roots[].folder_id	string	Required for every item	File only	Google Drive or OneDrive folder ID (root selects the account root), or Dropbox absolute folder path, id: identifier, or empty string for its root. Google Drive and OneDrive IDs are limited to 256 ASCII letters, digits, underscores, hyphens, exclamation marks, and periods; dot and dot-dot are rejected. Dropbox paths reject empty, dot, dot-dot, backslash, and control-character components. Restart required; JSON-character length: 0–1024
capture.cloud_roots[].drive_id	string or null	null	File only	Optional Microsoft Graph drive ID using the same bounded ID syntax; valid only for one_drive. Omit to select the authenticated user's drive. Restart required; JSON-character length: 1–256
capture.cloud_roots[].credential_file	string	Required for every item	File only	Absolute owner-only JSON file containing client_id, optional client_secret, refresh_token, and optional Microsoft tenant. Credentials are never accepted inline or exposed through capture options. Protected secret-file reference; Restart required; JSON-character length: 1–4096
capture.cloud_roots[].poll_interval_seconds	integer	Required for every item	File only	Minimum interval between cloud folder scans. Restart required; Range: 60–86400
capture.escl_endpoints	array of object	[]	File only	Fixed eSCL/AirScan endpoints with explicit address pins and approved network ranges. Redirects and ambient proxies cannot widen this allowlist. Restart required; Items: 0–32
capture.escl_endpoints[].id	string	Required for every item	File only	Restart required; Pattern: ^[a-z0-9][a-z0-9_-]*$; JSON-character length: 1–64
capture.escl_endpoints[].display_name	string	Required for every item	File only	Restart required; JSON-character length: 1–80
capture.escl_endpoints[].endpoint	string	Required for every item	File only	Restart required; Format: uri; JSON-character length: 1–2048
capture.escl_endpoints[].pinned_addresses	array of string	Required for every item	File only	Restart required; Items: 1–8
capture.escl_endpoints[].approved_networks	array of string	Required for every item	File only	Restart required; Items: 1–32
capture.escl_endpoints[].request_timeout_seconds	integer	Required for every item	File only	Restart required; Range: 5–300
capture.reconciliation_interval_seconds	integer	5	File only	Bounded interval for durable watch and capture-job reconciliation. Restart required; Range: 1–300
capture.capture_job_lease_seconds	integer	300	File only	Lease duration for direct eSCL workers and outbound Linux/SANE agents. Restart required; Range: 30–900

plugins

Optional reduced-isolation execution for owner-reviewed local plugin packages. null keeps all plugin workers unavailable. Registry or unreviewed packages are not supported by this runtime profile.

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
plugins	object or null	null	File only	Optional reduced-isolation execution for owner-reviewed local plugin packages. null keeps all plugin workers unavailable. Registry or unreviewed packages are not supported by this runtime profile. Restart required
plugins.runtime	deno	"deno"	File only	Restart required
plugins.trust_policy	owner_reviewed_local_only	"owner_reviewed_local_only"	File only	Explicit acknowledgement that the current Deno subprocess boundary is for locally reviewed packages, not hostile code. Restart required
plugins.deno_executable_path	string	Required when plugins is enabled	File only	Absolute path to the Jiandu-packaged Deno executable. Ambient PATH lookup is never used and the runtime version is checked before every invocation. Restart required; JSON-character length: 1–4096
plugins.worker_count	integer	1	File only	Bounded concurrent plugin invocations. Core document processing remains independently supervised. Restart required; Range: 1–4
plugins.packages	array of string	[]	File only	Absolute directories of reviewed packages. Startup verifies digests and installs without resetting existing settings. Restart required; Items: 0–128; Item JSON-character length: 1–4096
plugins.network	array of object	[]	File only	Package-bound HTTPS destination approvals; no network is approved by default. Addresses are pinned and redirects are denied. Restart required; Items: 0–128
plugins.network[].plugin_id	string	Required for every item	File only	Restart required; JSON-character length: 1–128
plugins.network[].package_digest	string	Required for every item	File only	Restart required; Pattern: ^sha256:[0-9a-f]{64}$
plugins.network[].destination_id	string	Required for every item	File only	Restart required; JSON-character length: 1–128
plugins.network[].pinned_addresses	array of string	Required for every item	File only	Restart required; Items: 1–8
plugins.network[].secret_name	string or null	No schema default	File only	Restart required; JSON-character length: 1–128
plugins.network[].secret_file	string or null	No schema default	File only	Absolute mode-0600 regular file for a host-applied bearer credential. Restart required
plugins.network[].tls_ca_file	string or null	No schema default	File only	Optional absolute private CA certificate path. Restart required

limits

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
limits.max_upload_bytes	integer	104857600	Environment: JIANDU_MAX_UPLOAD_BYTES	Restart required; Changes processing identity; Range: 1–268435456
limits.max_pages	integer	2000	Environment: JIANDU_MAX_PAGES	Restart required; Changes processing identity; Range: 1–10000
limits.max_image_pixels	integer	200000000	Environment: JIANDU_MAX_IMAGE_PIXELS	Restart required; Changes processing identity; Range: 1–1000000000
limits.worker_count	integer	2	Environment: JIANDU_WORKER_COUNT	Restart required; Range: 1–16

telemetry

Setting	Accepted value	Default or requirement	Overrides	Meaning and constraints
telemetry.log_filter	string	"jiandu=info"	Environment: RUST_LOG	Restart required; JSON-character length: 1–4096
telemetry.json_logs	boolean	true	Environment: JIANDU_JSON_LOGS	Restart required
telemetry.remote_export	boolean	false	Environment: JIANDU_REMOTE_TELEMETRY	Master operator consent for network telemetry export. Signal-specific OTEL exporters remain independently disableable. Restart required
telemetry.product_metrics_export	boolean	false	Environment: JIANDU_PRODUCT_METRICS_TELEMETRY	Separate consent for remotely exporting the product-use metric privacy class. Requires remote_export. Restart required
telemetry.export_queue_items	integer	1024	Environment: OTEL_BSP_MAX_QUEUE_SIZE, OTEL_BLRP_MAX_QUEUE_SIZE	Default item bound applied to each asynchronous trace and log export queue. Signal-specific standard OTel environment variables may lower it. Restart required; Range: 1–4096
telemetry.export_queue_bytes	integer	8388608	Environment: JIANDU_OTEL_QUEUE_BYTES	Shared hard in-memory payload-accounting bound for asynchronous trace and log export. It must be at least 4096 bytes multiplied by the sum of the effective trace and log queue item bounds. Restart required; Range: 8192–33554432
telemetry.export_batch_items	integer	128	Environment: OTEL_BSP_MAX_EXPORT_BATCH_SIZE, OTEL_BLRP_MAX_EXPORT_BATCH_SIZE	Default item bound applied to trace and log export batches. It cannot exceed the corresponding queue bound. Restart required; Range: 1–512
telemetry.export_schedule_delay_milliseconds	integer	1000	Environment: OTEL_BSP_SCHEDULE_DELAY, OTEL_BLRP_SCHEDULE_DELAY	Default maximum delay before a trace or log batch is offered to its exporter. Restart required; Range: 1–10000
telemetry.export_timeout_milliseconds	integer	2000	Environment: OTEL_EXPORTER_OTLP_TIMEOUT, OTEL_EXPORTER_OTLP_TRACES_TIMEOUT, OTEL_EXPORTER_OTLP_METRICS_TIMEOUT, OTEL_EXPORTER_OTLP_LOGS_TIMEOUT, OTEL_BSP_EXPORT_TIMEOUT, OTEL_BLRP_EXPORT_TIMEOUT	Default per-attempt OTLP export deadline. General and per-signal standard OTel environment variables may lower it. Restart required; Range: 1–5000
telemetry.shutdown_timeout_milliseconds	integer	3000	Environment: JIANDU_OTEL_SHUTDOWN_TIMEOUT_MS	Hard process deadline for flushing and stopping telemetry workers during graceful shutdown. Restart required; Range: 1–10000
telemetry.metric_export_interval_milliseconds	integer	30000	Environment: OTEL_METRIC_EXPORT_INTERVAL	Periodic metric-reader interval when OTLP metric export is enabled. Restart required; Range: 1–300000
telemetry.max_attribute_count	integer	32	Environment: OTEL_ATTRIBUTE_COUNT_LIMIT	Maximum reviewed attributes retained on a telemetry record or span. Restart required; Range: 1–64
telemetry.max_attribute_value_bytes	integer	256	Environment: OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT	Maximum UTF-8 byte length retained for any telemetry attribute value. Restart required; Range: 1–1024
telemetry.max_span_events	integer	16	Environment: OTEL_SPAN_EVENT_COUNT_LIMIT	Maximum event count retained on one span. Restart required; Range: 0–32
telemetry.max_span_links	integer	8	Environment: OTEL_SPAN_LINK_COUNT_LIMIT	Maximum link count retained on one span. Restart required; Range: 0–16
telemetry.metric_cardinality_limit	integer	128	Environment: JIANDU_OTEL_METRIC_CARDINALITY_LIMIT	Maximum active attribute sets retained per metric stream. Restart required; Range: 1–256

Validate before restart

Run validation as the same operating-system account, with the same filesystem and secret mounts, that will run Jiandu:

jiandu --config /etc/jiandu/jiandu.json --check-config

For a concern-oriented explanation, start with Configuration. For environment-only OpenTelemetry inputs, use Environment variables.