Configuration reference

The server's own settings come from command-line flags, environment variables or the configuration file config.yaml, in increasing order of precedence: default, configuration file, environment variable, command-line flag. Certificates, providers and other settings of the panel are managed in the interface and are not covered here.

Settings

Flag	Environment	config.yaml	Default
-data-dir	JEC_DATA_DIR		data (/data in the image)
-listen	JEC_LISTEN	listen	:8080
-base-url	JEC_BASE_URL	base_url	the address the server sees
-hsts	JEC_HSTS	hsts	false
-trusted-proxies	JEC_TRUSTED_PROXIES	trusted_proxies	none
-dns-resolvers	JEC_DNS_RESOLVERS	dns_resolvers	the system's
-log-level	JEC_LOG_LEVEL	log.level	info
-log-format	JEC_LOG_FORMAT	log.format	text (or json)
-config	JEC_CONFIG		<data-dir>/config.yaml, if it exists
	JEC_SECRET_KEY		<data-dir>/secret.key

jec <command> -h lists the flags of a command. An example configuration file:

listen: ":8080"
base_url: https://certs.example.com
trusted_proxies: 172.16.0.0/12
dns_resolvers: 223.5.5.5,119.29.29.29
log:
  level: info
  format: json

Behind a reverse proxy

Reverse proxy and CDN has complete configurations for Caddy and nginx, also behind a CDN.

• JEC_BASE_URL: the URL users open, such as https://certs.example.com, or https://example.com/certs/ for a sub-path. With an https URL, the session cookie is sent over HTTPS only. Notifications link to the pages they concern only when this is set.
• JEC_TRUSTED_PROXIES: the addresses or CIDR ranges of the reverse proxies, separated by commas, such as 127.0.0.1, or 172.16.0.0/12 for the networks of containers, as docker-compose.yml sets by default. For requests from them, JEC reads the client address from X-Forwarded-For; without it, everyone behind the proxy shares the proxy's address, and one person's failed sign-ins lock out everyone.
• JEC_HSTS: set it to true only when the panel is always reached over HTTPS; browsers then refuse plain HTTP to it for a year.

DNS resolvers

JEC_DNS_RESOLVERS sets recursive DNS resolvers, such as 223.5.5.5,119.29.29.29, with or without a port. To check a validation record, JEC first finds its zone through them, then queries the zone's authoritative servers directly. It is needed only when the machine's own resolver answers incorrectly, as with split-horizon DNS; JEC refuses to start with an address that is not valid.

Master key

Private keys and credentials are encrypted in the database with AES-256-GCM. The master key is secret.key in the data directory by default, created on first start. It can also be passed in JEC_SECRET_KEY: 32 random bytes in base64, as generated by openssl rand -base64 32, through the environment only. JEC refuses to start when the master key does not match the key the database was encrypted with. See Data and backups for backing it up.

Time zone

The daily check time of renewals, the times in notifications and the times in the interface all use the panel's time zone. It is chosen under Appearance on the Settings page, and follows the server's by default (the TZ environment variable; docker-compose.yml sets Asia/Shanghai).

Proxies

JEC's common HTTP client, used by most notification channels and deploy targets, does not read the proxies of the environment (HTTP_PROXY, HTTPS_PROXY), so that services within the same country are not reached through a proxy. Provider types that reach services abroad accept a proxy of their own in their advanced settings, http://, https:// or socks5://. ACME accounts without a proxy of their own, lego's DNS providers and the check for updates use the proxies of the environment.