Configuration File

The Configuration File is the central setup point for UDMG. While Endpoints, Pipelines, and other Configuration Items are managed through the UDMG Admin UI or UDMG REST API, most global and system-level settings are defined here.

On the host where UDMG Server is installed, the default location of the file is:

# Linux
/opt/udmg/etc/udmg-server.hcl
# Windows
C:\Program Files\Stonebranch\UDMG Server\udmg-server.hcl

This file uses HCL (HashiCorp Configuration Language) to express structured configuration in a clear, declarative format.

UDMG also supports a set of custom functions (not part of standard HCL) for dynamic values—see Custom Functions below.

What is HCL?

The UDMG Server configuration file is written in HCL (HashiCorp Configuration Language), a human-friendly syntax for structured configuration.

Key points about HCL:

• Blocks group related settings inside curly braces ({}). For example, the api block contains all API-related options.
• Arguments are key-value pairs defined within blocks. Each argument has a name (the key) and a value.
• Argument names are unique within their block and describe the purpose of the setting.

Dot Notation

Throughout this documentation we use dot notation to reference nested arguments.

This notation is used only in the documentation for clarity. In the actual HCL file, arguments are defined within their respective blocks, not as dot-separated keys.

Dot notation examples

api {
  port =          # Referenced as: api.port
  
  secure {
    enable =    # Referenced as: api.secure.enable
  }
}

HCL vs Environment Variables

Environment Variables override any value specified in the HCL configuration when both are present.

tip

Use HCL arguments for persistent, auditable configuration. Reserve environment variables for temporary overrides or sensitive values such as passwords or keys (for example, in containerized deployments).

Directory Paths

When specifying directory paths in the Configuration File, follow these guidelines for clarity and predictable behavior.

Absolute Over Relative Paths

All path arguments in the Configuration File support both absolute and relative paths:

• Absolute paths start at the filesystem root and are independent of the work_directory_path value.
• Relative paths are resolved against the work_directory_path value.

tip

For predictability and separation of concerns, we recommend using absolute paths for credential files and store those in a directory isolated from transfer data.

Platform-Specific Separators

Use the appropriate path separator for your operating system:

• Linux: use forward slashes (/).
  • Example: /var/udmg/data/
• Windows: use backslashes (\\). Because HCL strings interpret \\ as an escape, write Windows paths with doubled backslashes in the HCL file.
  • Example: C:\\Program Files\\Stonebranch\\UDMG Server\\data\\.

Time Duration Format and Allowed Units

Several configuration arguments accept time durations, which are specified as a string with:

• a decimal number (optionally with a fraction), followed by
• a time unit.

The allowed time units are:

• ns for nanoseconds
• us for microseconds
• ms for milliseconds
• s for seconds
• m for minutes
• h for hours

You can also combine multiple number+unit segments in a single value to express more precise durations.

Examples:

• "250ms" = 250 milliseconds
• "0.5s" = half a second
• "30s" = 30 seconds
• "2h45m" = 2 hours and 45 minutes

Arguments by Block

This section lists all configurable arguments available in udmg-server.hcl. Arguments are grouped by configuration block (including the root level). For every argument, the documentation lists its description, type, and default value—helping you quickly understand what it controls and how to set it.

info

All HCL arguments described on this page use dot notation to reference their full path from the root of the configuration file.

---

Root Level

Top-level arguments define global behavior for the UDMG Server. These settings apply across all domains and act as defaults for path resolution and runtime behavior.

---

auto_migrate

When enabled, UDMG automatically applies any required database schema migrations during startup. This is typically needed when upgrading to a more recent UDMG version.

Type: bool

Default: true

---

cloud_stream_buffer_size

An optional Remote Cloud Storage streaming buffer size (in bytes).

Type: number

Default: 16777216

---

instance_name

Name of the UDMG Server instance used in observability metrics and logs. In High-Availability deployments, set a unique value per Cluster Node so telemetry can be attributed correctly.

Type: string

Default: "udmg-server"

---

work_directory_path

Root directory for relative paths used in configuration and MFT services, including Endpoints and Pipelines.

warning

This is a major configuration argument. Before setting it, see Folder Management.

Type: string

Default: ""

---

admin_app

The admin_app block enables or disables the embedded web server that hosts the UDMG Admin UI.

---

admin_app.enable

Enables or disables the embedded web server for the UDMG Admin UI.

Type: bool

Default: true

---

api

The api block configures the main UDMG Server API, including network binding, security features, CORS settings, logging, and rate limiting.

---

api.cors

Enables or disables Cross-Origin Resource Sharing headers.

info

Required if accessing the API from a web frontend hosted on a different domain/port.

Type: bool

Default: true

---

api.cors_domain

Specifies the allowed origin domain(s) for CORS requests when api.cors is enabled. Use "*" for any domain (less secure).

Type: string

Default: "*"

---

api.csrf

Enables or disables Cross-Site Request Forgery protection middleware. Required by the UDMG Admin UI.

Type: bool

Default: true

---

api.inet

IP address to bind for UDMG REST API connection requests. 0.0.0.0 listens on all available network interfaces.

Type: string

Default: "0.0.0.0"

---

api.log_level

Log level for UDMG REST API operations.

Options:

• "" (inherits from global logger)
• "debug"
• "info"
• "warn"
• "error"

Type: string

Default: ""

---

api.port

The port number the API server listens on.

Type: string

Default: "8080"

---

api.rate_limit

Global rate limiting for all UDMG REST API requests per minute.

Type: number

Default: 5000

---

api.secure.enable

Enables or disables HTTPS for the API server.

info

If enabled, api.secure.pub_key and api.secure.priv_key are required.

Type: bool

Default: false

---

api.secure.priv_key

Path to the private SSL/TLS key file (PEM format).

This key must match the certificate configured in api.secure.pub_key. UDMG Server uses it during the TLS handshake to establish HTTPS connections.

Example:

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

api.secure.pub_key

Path to the SSL/TLS certificate file (PEM format).

This certificate must match the private key configured in api.secure.priv_key. UDMG Server presents it to clients during the TLS handshake to establish HTTPS connections.

Example:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

api.spec

Enables or disables serving the OpenAPI specification (at /spec and /swagger/index.html).

Type: bool

Default: false

---

api.trusted_domains

List of UDMG Admin UI origin hostnames accepted as trusted sources. Only required when using an external web server for the Admin UI. Values must match the HTTP Origin request header.

Examples:

• Default HTTPS port: ["udmg.my-company.com"]
• Custom port: ["udmg-staging.my-company.com:9180"]
• Multiple trusted origins: ["udmg.my-company.com", "udmg-staging.my-company.com:9180"]

Type: List of strings

Default: []

---

api.verbose

Enables verbose logging of API requests and responses. This can generate a high volume of log output.

Type: bool

Default: false

---

as2

The as2 block configures AS2 protocol support. AS2 is used for secure and reliable file transfer over HTTP or HTTPS.

For more information, refer to AS2.

---

as2.enable

Enables or disables the AS2 service.

Type: bool

Default: true

---

as2.message_id_expiry

Number of days to retain AS2 message IDs for replay protection.

Type: number

Default: 0 (unlimited)

---

as2.replay_protect

Enables or disables replay protection for AS2 messages.

Type: bool

Default: true

---

cluster

The cluster block configures high-availability clustering for multiple UDMG Server nodes, including operating mode, node health timing, peer discovery, and cluster communication ports.

For more information, refer to High Availability.

---

cluster.client_port

Port used by UDMG Server for client communication in a cluster.

Type: number

Default: 4222

---

cluster.cluster_port

Port used for inter-node communication within the UDMG Server cluster.

Type: number

Default: 6222

---

cluster.deadline

The time duration after which a node is considered down if no heartbeat is received.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "30s"

---

cluster.heartbeat

The time interval between heartbeat signals sent between nodes.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "10s"

---

cluster.mode

The operational mode of the cluster.

Allowed values:

• "AA" (Active-Active).
• "AP" (Active-Passive).

Type: string

Default: "AA"

---

cluster.seeds

Comma-separated list of seed node addresses in the format host:client_port, used for cluster bootstrapping. Not required for standard setup.

Type: string

Default: ""

---

database

The database block configures the database connection used by UDMG Server for persistent storage of configuration, Users, and Transfer Records.

---

database.dsn

Connection string override.

When set, overrides database.name, database.hostname, and database.port, and invalidates the database.secure block.

Type: string

Default: N/A

---

database.engine

The type of database engine to use.

Options:

• "mysql"
• "oracle"
• "mssql"
• "postgres"

Type: string

Default: ""

---

database.hostname

The hostname or IP address of the database server.

Type: string

Default: ""

---

database.log_level

Log level for database operations.

Options:

• "" (inherits from global logger)
• "debug"
• "info"
• "warn"
• "error"

Type: string

Default: ""

---

database.name

The database name.

Type: string

Default: ""

---

database.options.idle_connections

The maximum number of connections in the idle connection pool.

Type: number

Default: 5

---

database.options.initial_interval

The initial time duration to wait before retrying a locked operation.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "50ms"

---

database.options.max_connections

The maximum number of open connections to the database.

Type: number

Default: 30

---

database.options.max_interval

The maximum time duration to wait between retries for a locked operation.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "1s"

---

database.options.max_retries

The maximum number of times to retry an operation if the database is locked.

Type: number

Default: 5

---

database.password

The password for connecting to the database.

Type: string

Default: ""

---

database.port

The port number for the database server.

Type: number

Default: 0

---

database.secure.enable

Enables or disables secure (TLS/SSL) connection to the database.

Type: bool

Default: false

---

database.secure.mode

The SSL mode to use. Availability depends on database engine.

Allowed values:

• "disable"
• "require"
• "verify-ca"
• "verify-full"

info

Refer to PostgreSQL docs for details.

Type: string

Default: "require"

---

database.secure.priv_key

Path to the client private key file (used for client certificate authentication, if database.secure.enable is true).

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

database.secure.pub_key

Path to certificate in PEM format for client authentication (required if enabled).

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

database.secure.tls_server_cert_dn

Optional server certificate distinguished name used for verify-full mode (Oracle only).

Type: string

Default: ""

---

database.secure.wallet_location

Path to Oracle wallet directory. Required if database.engine is "oracle" and database.secure.mode is "verify-ca" or "verify-full".

Type: string

Default: ""

---

database.user

The username for connecting to the database.

Type: string

Default: ""

---

hook_server

The hook_server block configures the HTTP server that handles callbacks such as AS2 Message Disposition Notifications (MDNs), enabling asynchronous receipt confirmations for file transfers.

---

hook_server.enable

Enables or disables the hook server.

Type: bool

Default: false

---

hook_server.enable_mdn

Enables or disables the hook server for AS2 MDN callbacks.

Type: bool

Default: false

---

hook_server.inet

Interface address for hook server to listen on.

Type: string

Default: "0.0.0.0"

---

hook_server.log_level

Log level for hook server operations.

Options:

• "" (inherits from global logger)
• "debug"
• "info"
• "warn"
• "error"

Type: string

Default: ""

---

hook_server.port

Port for the hook server.

Type: string

Default: "9090"

---

hook_server.secure.enable

Enables or disables HTTPS. Requires hook_server.secure.pub_key and hook_server.secure.priv_key.

Type: bool

Default: false

---

hook_server.secure.priv_key

Path to private SSL/TLS key file in PEM format. Required if hook_server.secure.enable is true.

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

hook_server.secure.pub_key

Path to public SSL/TLS certificate file in PEM format. Required if hook_server.secure.enable is true.

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

hook_server.spec

Enables or disables serving the API specification.

Type: bool

Default: false

---

icap

The icap block configures general content scanning through an ICAP server. For more information, refer to ICAP Scanner.

---

icap.retry

Number of retry attempts when connecting to or communicating with the ICAP server fails.

Type: number

Default: 0

---

icap.timeout

The maximum time duration to wait for a response from the ICAP server.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "10s"

---

jwt

The jwt block configures token-based authentication for the UDMG Admin UI, UDMG REST API, and WTC UI.

tip

Use strong, unique keys and tune durations to balance security and usability.

---

jwt.access_token.duration

The validity duration of the access token.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "15m"

---

jwt.refresh_token.duration

The validity duration of the refresh token.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "24h"

---

jwt.signing_key

Secret key for signing both access and refresh tokens. Must be at least 30 \[a-zA-Z0-9_] characters.

Type: string

Default: ""

---

ldap

The ldap block defines LDAP synchronization intervals for Users and Accounts. For more information, refer to LDAP for Users and LDAP for Accounts.

---

ldap.ldap_account_sync_interval

Defines how often UDMG synchronizes LDAP-provisioned Accounts. Leave empty ("") to disable synchronization.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "24h"

---

ldap.ldap_user_sync_interval

Defines how often UDMG synchronizes LDAP-provisioned Users. Leave empty ("") to disable synchronization.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "24h"

---

log

The log block controls logging behavior for the UDMG Server instance, including log level, format, output destination, and rotation settings. For more information, refer to Logging.

---

log.file

Log file path. Supports environment variable expansion.

Type: string

Default: "" (stdout)

---

log.format

Format of the log output.

Options:

• "plain"
• "json"

Type: string

Default: "plain"

---

log.level

Log verbosity level. Messages at the specified severity level and higher are written to the log.

Options:

• "TRACE"
• "DEBUG"
• "INFO"
• "WARN"
• "ERROR"

Type: string

Default: "INFO"

---

log.rotate.enable

When enabled, log files are rotated based on the configured log.rotate.frequency. If log.rotate.size is greater than 0, log files are also rotated when the configured size is reached.

Type: bool

Default: false

---

log.rotate.file_format

Format for rotated log filenames. It can include directory structure and the following placeholders:

• {YYYY} (year)
• {MM} (month)
• {DD} (day)
• {HH} (hour)
• {mm} (minute)
• {ss} (second)
• {ns} (nanosecond)

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: "{YYYY}{MM}{DD}/udmg-server{HH}{mm}{ss}{ns}.log"

---

log.rotate.frequency

Time interval used for time-based log rotation.

Options:

• "daily"
• "weekly"
• "monthly"
• "quarterly"

Type: string

Default: "daily"

---

log.rotate.size

Maximum log file size (in megabytes) before rotation is triggered. Checked every hour.

Type: number

Default: 0 (disabled)

---

observability

The observability block configures experimental features for metrics, tracing, debugging, and the observability API. Use it to integrate UDMG Server with monitoring stacks and to expose a separate, minimal API for status and metrics collection.

---

observability.api.debug.enable

Enables or disables debug mode for the observability API.

Type: bool

Default: false

---

observability.api.debug.password

Debug password for observability API.

Type: string

Default: ""

---

observability.api.debug.user

Debug username for observability API.

Type: string

Default: ""

---

observability.api.enable

Enables or disables the observability API.

Type: bool

Default: false

---

observability.api.inet

Address for the observability API.

Type: string

Default: "0.0.0.0"

---

observability.api.log_level

Log level for observability API operations.

Options:

• "" (inherits from global logger)
• "debug"
• "info"
• "warn"
• "error"

Type: string

Default: ""

---

observability.api.port

Port for the observability API.

Type: string

Default: "7070"

---

observability.api.rate_limit

Global rate limiting for observability API requests per minute.

Type: number

Default: 5000

---

observability.api.secure.enable

Enables or disables HTTPS for the observability API. Requires observability.api.secure.pub_key and observability.api.secure.priv_key.

Type: bool

Default: false

---

observability.api.secure.priv_key

Path to private SSL/TLS key file in PEM format. Required if observability.api.secure.enable is true.

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

observability.api.secure.pub_key

Path to public SSL/TLS certificate file in PEM format. Required if observability.api.secure.enable is true.

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

observability.api.spec

Enables or disables serving the observability OpenAPI specification (at /spec and /swagger/index.html, at the port defined in observability.api.port).

Type: bool

Default: false

---

observability.opentelemetry.enable

Enables or disables OpenTelemetry.

Type: bool

Default: false

---

observability.opentelemetry.host

Host for OpenTelemetry collector.

Type: string

Default: ""

---

observability.opentelemetry.port

Port for OpenTelemetry collector.

Type: string

Default: ""

---

observability.prometheus.enable

Enables or disables Prometheus metrics.

Type: bool

Default: false

---

protocol

The protocol block defines default settings for supported transfer protocol services, including authentication timeout, session idle timeout, and connection limits.

---

protocol.auth_timeout

Authentication timeout before dropping the connection.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "30s"

---

protocol.max_connections

Maximum number of concurrent connections.

Type: number

Default: 120

---

protocol.session_idle_timeout

Defines how long an authenticated protocol session may remain open with no activity before UDMG automatically terminates it.

For more information, refer to Timeout for Idle Sessions.

For the timeout that governs unauthenticated connection attempts, see protocol.auth_timeout.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "15m"

---

security

The security block configures system-wide security settings, including secret encryption, path resolution behavior, file permissions, and recovery options.

---

security.directory_permissions

Permissions for created folders, specified as a standard Linux file mode.

Type: string

Default: "700"

---

security.domain_chroot

Defines the path resolution behavior for Local Filesystem Endpoints.

Allowed values:

• "NONE"
• "WORKDIR"
• "WORKDIR+DOMAIN"

warning

This is a major configuration argument. Before setting this up, we recommend reading Folder Management.

Type: string

Default: "WORKDIR+DOMAIN"

---

security.file_permissions

Permissions for created files, specified as a standard Linux file mode.

Type: string

Default: "600"

---

security.ignore_system_user_ip_filter

Bypasses the IP Filtering - Admin UI restriction. Use this option only to recover from an accidental lockout.

Type: bool

Default: false

---

security.passphrase_key

Root encryption key (K0) used to encrypt secret values, such as passwords and Private Key Credentials. Must be a valid 32-byte hexadecimal string. Store securely and back up for disaster recovery.

Type: string

Default: ""

---

security.password.min_length

info

Deprecated since UDMG 3.3.0. These configuration arguments remain in the default HCL file for backward compatibility. For the current Password Policy configuration, see Password Policy.

---

security.password.min_lower_case

info

Deprecated since UDMG 3.3.0. These configuration arguments remain in the default HCL file for backward compatibility. For the current Password Policy configuration, see Password Policy.

---

security.password.min_numbers

info

Deprecated since UDMG 3.3.0. These configuration arguments remain in the default HCL file for backward compatibility. For the current Password Policy configuration, see Password Policy.

---

security.password.min_symbols

info

Deprecated since UDMG 3.3.0. These configuration arguments remain in the default HCL file for backward compatibility. For the current Password Policy configuration, see Password Policy.

---

security.password.min_upper_case

info

Deprecated since UDMG 3.3.0. These configuration arguments remain in the default HCL file for backward compatibility. For the current Password Policy configuration, see Password Policy.

---

security.work_directory_key_display

If enabled, the work_directory_path is exposed under the UDMG REST API.

Type: bool

Default: false

---

tls

The tls block applies to all services (API, Observability, WTC, HookServer, AS2, etc.). Only FTP can override these global TLS settings, using tls.allow_protocol_override.ftp.

---

tls.allow_protocol_override.ftp

Allows FTP to override TLS settings.

Type: bool

Default: false

---

tls.cipher_suites

Optional list of cipher suites to use. Leave empty for secure defaults. If not specified, uses secure cipher suites recommended by Go crypto/tls providing forward secrecy and modern cryptographic standards.

Type: List of strings

Default: []

Example: ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"]

---

tls.curve_preferences

Optional list of curve preferences. Leave empty for secure defaults.

Options:

• "CurveP256"
• "CurveP384"
• "CurveP521"
• "X25519"
• "X25519MLKEM768"

Type: List of strings

Default: ["X25519", "CurveP256", "CurveP384"]

---

tls.max_version

Maximum TLS version to support.

Options:

• 1.0
• 1.1
• 1.2
• 1.3 (recommended)

Type: string

Default: "1.3"

---

tls.min_version

Minimum TLS version to support.

Options:

• 1.0
• 1.1
• 1.2 (recommended)
• 1.3

Type: string

Default: "1.2"

---

transfer

The transfer block configures file transfer retry behavior and status checking intervals. These settings apply only when UDMG acts as a Client.

---

transfer.check_interval

Interval at which UDMG polls for pending transfers that were scheduled through the Transfers Schedules Endpoint.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "1m"

---

transfer.max_retries

The maximum number of times a transfer will be retried after a connection or transfer error. Each retry restarts the transfer from the beginning. Once this limit is reached, the transfer is marked as failed.

Type: number

Default: 3

---

transfer.max_retry_delay

The maximum wait time allowed between retries after a connection or transfer error. Each retry restarts the transfer from the beginning. This value acts as an upper limit when exponential backoff is applied.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "1h"

---

transfer.retry_backoff

The exponential backoff factor applied to the retry delay. After each failed attempt, the wait time is multiplied by this factor, up to the limit set by transfer.max_retry_delay. Each retry restarts the transfer from the beginning.

Delay for retry attempt n = retry_delay x (retry_backoff ^ n), where n is the retry attempt number, starting at 0.

Example with retry_delay = 5m:

• retry_backoff = 1 → 5m, 5m, 5m, ...
• retry_backoff = 2 → 5m, 10m, 20m, ...
• retry_backoff = 3 → 5m, 15m, 45m, 135m, ...

Type: number

Default: 2.0

---

transfer.retry_delay

The base wait time before retrying a transfer after a connection or transfer error. Each retry restarts the transfer from the beginning.

For allowed time units, see Time Duration Format and Allowed Units.

Type: string

Default: "5m"

---

uac

The uac block configures publishing Universal Events from UDMG to Universal Controller. For more information, refer to Universal Event Integration.

---

uac.enable

Enables or disables globally the feature to publish Universal Event.

Type: bool

Default: false

---

uac.event_name

The default Universal Event Template name used by Publish Event Tasks when no task-level event name override is configured.

Type: string

Default: ""

---

uac.event_ttl

An optional Time-To-Live for the Universal Event (in minutes).

Type: string

Default: ""

---

uac.override_publish_event

Enables Publish Event Tasks to override the default Universal Event configuration defined in the uac block.

Type: bool

Default: false

---

uac.password

The default password used by Publish Event Tasks to authenticate with the Universal Controller REST API when no task-level Credentials override is configured.

Type: string

Default: ""

---

uac.urls

A list of URIs for the Publish Universal Event API on the target Universal Controllers. UDMG will attempt to connect to these in order if one fails.

• Example: ["http://host1/uc", "https://host2/uc"]

Type: List of strings

Default: []

---

uac.username

The default username used by Publish Event Tasks to authenticate with the Universal Controller REST API when no task-level Credentials override is configured. The user must have the required permissions to call the Universal Event Web Services.

Type: string

Default: ""

---

wtc

The wtc block configures the Web Transfer Client (WTC) service, which provides HTTPS-based browser file transfer capabilities.

---

wtc.default_domain

Specifies the default UDMG Domain that the root WTC URL (for example, https://example.com:4433) redirects to when no domain path is provided.

Type: string

Default: "primary"

---

wtc.enable

Enables or disables the WTC service. When disabled, the WTC listener does not start.

Type: bool

Default: false

---

wtc.inet

The IP address that the WTC listener binds to.

Use "0.0.0.0" to listen on all network interfaces, or specify a local IP address to restrict the listener to that interface.

Type: string

Default: "0.0.0.0"

---

wtc.log_level

Log level for WTC operations.

Options:

• "" (inherits from global logger)
• "debug"
• "info"
• "warn"
• "error"

Type: string

Default: ""

---

wtc.max_public_connections

Defines the maximum number of concurrent connections allowed for Shared Public Links (Web Transfer Client).

The counter is maintained per UDMG Server node and is not shared across a Cluster.

info

For more information, refer to Maximum Public Connections (WTC)

Type: number

Default: 1000

---

wtc.port

The TCP port number on which the WTC service listens for HTTPS connections. Must be between 1 and 65535.

Type: string

Default: "8443"

---

wtc.secure.enable

Enables HTTPS for the Web Transfer Client (WTC).

When set to true, WTC serves all traffic over TLS and requires wtc.secure.pub_key and wtc.secure.priv_key.

Type: bool

Default: false

---

wtc.secure.priv_key

Path to the private key file (PEM format) associated with wtc.secure.pub_key. Required if wtc.secure.enable is true.

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

wtc.secure.pub_key

Path to the SSL/TLS certificate file (PEM format) presented to clients for HTTPS connections. Required if wtc.secure.enable is true.

info

The path is relative to the work_directory_path unless an absolute path is provided. For more details, see Paths.

Type: string

Default: ""

---

wtc.spec

Enables or disables serving the OpenAPI specification at /spec and /swagger/index.html.

Type: bool

Default: false

Custom Functions

The configuration loader in UDMG provides a set of custom functions (these are not part of standard HCL syntax). You can use them to dynamically generate values inside the Configuration File.

Function	Description	Usage	Result
upper	Converts a string to upper case.	${upper("string")}	"STRING"
lower	Converts a string to lower case.	${lower("STRING")}	"string"
env	Retrieves an environment variable, with a mandatory fallback default.	${env("HOSTNAME", "default")}	"my-hostname" or "default" if unset

For the env function, a default value is mandatory. If the referenced environment variable does not exist, UDMG uses the provided default instead of throwing an error.

Example of env function usage

database {
  engine   = "postgres"
  hostname = "localhost"
  user     = "udmg"
  password = "${env("DB_PASSWORD", "default-password")}"
}