Settings

Settings (/admin/settings) is where an operator checks what this instance is actually running with. Most of it is a read-only mirror of configuration — the values come from appsettings.json and environment variables, and the only way to change them is to change the configuration and restart. See Configuration for the keys behind every row.

Certificates and Guardrails used to be tabs here; both now have their own pages — see Certificates and Guardrails. Of what’s left, one tab is more than a mirror: Data performs deletions.

Tab	Direct route	Editable
Overview	/admin/settings	No
Authentication	—	No
Limits	/admin/limits	Yes — see Policies
Data	—	Destructive

Overview

A status strip across the top, then the values behind it.

Shown	Comes from
Encryption ✓ / not set	Encryption:MasterKey. An all-zero placeholder key reads as not set
n admins	The number of addresses in Admin:Emails
Database: provider	Database:Provider

The admin pill is a config count, not a role count

It counts entries in Admin:Emails — the bootstrap list — not accounts holding the admin role. To see who actually has admin, filter the Roles column on Accounts.

The Database section repeats the provider and the connection string with its credentials masked. Encryption reports whether the master key is present, never its value. Admin lists the bootstrap addresses verbatim.

Authentication

Also read-only: whether the JWT signing key is configured, the issuer and audience, and the two token lifetimes (access token in minutes, refresh token in days). Under OAuth Providers, each of Google, Microsoft, and Entra ID reads Configured or Not configured based on whether a client id is present — the pill in the strip counts them, OAuth: 2 of 3.

A provider showing Not configured is invisible on the sign-in page. For the Entra setup, see Entra OAuth.

Limits

Rate limits, quotas, and identity policy. This tab embeds the same editor documented on its own page: see Policies for every field, and for which settings need a restart.

Also reachable directly

/admin/limits opens Settings straight onto this tab.

Data

Workspace-wide deletions, one button per storage area. There is no undo.

Area	Deletes
Users	Every account, and by cascade everything owned by one — templates, providers, sessions, memories, todos, kanban columns, devices, tokens, sync state
Templates / Providers / Sessions / Memories	That collection, across all users
Todos & Kanban	Todo items and kanban columns
Devices & E2EE	Every device row and wrapped user master key, and resets the E2EE flag on every user
Sync State	Sync cursors and the sync event log
Token Usage	The token usage log

Each button asks twice — a confirmation, then a final warning naming the area — and the result bar reports how many rows went. Wipes that change what a client would pull also invalidate the affected users’ sync versions, so clients re-pull instead of getting a stale 304.

Devices & E2EE breaks encrypted accounts

Wiping devices deletes the wrapped master keys with them. Every E2EE user has to onboard a device again, and anything that was encrypted with a key no longer wrapped anywhere is unrecoverable. This is a recovery-of-last-resort action, not a cleanup.

Wipes are written to the server log with the acting administrator’s address. They do not appear in the audit log — the rows the audit log would reference may no longer exist.

The Storage Areas list is fixed in the page rather than queried, which is why it is the one table in the admin UI with no Refresh button.