The config.py File — pgAdmin 4 9.14 documentation
This page in other versions:
Latest
9.14
9.13
9.12
8.14
7.8
6.21
Development
index
next
previous
pgAdmin 4 9.14 documentation
Getting Started
Deployment
The config.py File
Warning:
This documentation is for a pre-release version of pgAdmin 4
Contents
Getting Started
Deployment
Login Page
Enabling two-factor authentication (2FA)
User Management
Change Ownership Dialog
Change User Password Dialog
Lock/Restore Account
Enabling LDAP Authentication
Enabling Kerberos Authentication
Enabling OAUTH2 and OIDC Authentication
Enabling Webserver Authentication
User Interface
Menu Bar
Toolbar
Object Explorer Filter
Tabbed Browser
Tree Control
Preferences
Keyboard Shortcuts
Search objects
External database for pgAdmin user settings
Connecting To A Server
Managing Cluster Objects
Managing Database Objects
Creating or Modifying a Table
Management Basics
Backup and Restore
Developer Tools
Processes
pgAgent
pgAdmin Project Contributions
Release Notes
Licence
The config.py File
There are multiple configuration files that are read at startup by pgAdmin. These
files are used for configuration options that:
may be required to be set prior to startup of pgAdmin as they control how
the application will operate.
system administrators may wish to control across an organisation to enforce
security policies.
are so rarely or unlikely to be changed that it doesn’t
make sense to allow them to be changed through the user interface.
The configuration files are as follows:
config.py
: This is the main configuration file, and should not be modified.
It can be used as a reference for configuration settings, that may be overridden
in one of the following files.
config_distro.py
: This file is read after
config.py
and is intended for
packagers to change any settings that are required for their pgAdmin distribution.
This may typically include certain paths and file locations. This file is optional,
and may be created by packagers in the same directory as
config.py
if
needed.
config_local.py
: This file is read after
config_distro.py
and is intended
for the owner of the installation to change any default or packaging specific settings
that they may wish to adjust to meet local preferences or standards.This file is optional,
and may be created by users in the same directory as
config.py
if
needed.
config_system.py
: This file is read after
config_local.py
and is
intended for system administrators to include settings that are configured
system-wide from a secure location that users cannot normally modify and that
is outside of the pgAdmin installation. The location for this file varies
based on the platform, and only needs to be created if desired.
Platform
File Location
Linux
/etc/pgadmin/config_system.py
macOS
/Library/Preferences/pgadmin/config_system.py
Windows
%CommonProgramFiles%\pgadmin\config_system.py
Note
If the SERVER_MODE or DATA_DIR settings are changed in
config_distro.py
config_local.py
, or
config_system.py
LOG_FILE, SQLITE_PATH, SESSION_DB_PATH, STORAGE_DIR, KERBEROS_CCACHE_DIR,
and AZURE_CREDENTIAL_CACHE_DIR values will be set based on DATA_DIR unless
values are explicitly overridden for any of the variable in any of the
above file.
The default
config.py
file is shown below for reference:
# -*- coding: utf-8 -*-
##########################################################################
# pgAdmin 4 - PostgreSQL Tools
# Copyright (C) 2013 - 2026, The pgAdmin Development Team
# This software is released under the PostgreSQL Licence
# config.py - Core application configuration settings
##########################################################################
import
builtins
import
logging
import
os
import
sys
from
collections
import
OrderedDict
# We need to include the root directory in sys.path to ensure that we can
# find everything we need when running in the standalone runtime.
root
os
path
dirname
os
path
realpath
__file__
))
if
sys
path
!=
root
sys
path
insert
root
# The config database connection pool size.
# Setting this to 0 will remove any limit.
CONFIG_DATABASE_CONNECTION_POOL_SIZE
# The number of connections allowed to overflow beyond
# the connection pool size.
CONFIG_DATABASE_CONNECTION_MAX_OVERFLOW
100
from
pgadmin.utils
import
env
IS_WIN
fs_short_path
from
version
import
APP_VERSION
APP_RELEASE
APP_REVISION
APP_SUFFIX
APP_VERSION_INT
from
branding
import
APP_NAME
APP_ICON
APP_COPYRIGHT
APP_PATH
APP_WIN_PATH
APP_SHORT_NAME
APP_DEFAULT_EMAIL
##########################################################################
# Misc stuff
##########################################################################
# Path to the online help.
HELP_PATH
'../../../docs/en_US/_build/html/'
# Languages we support in the UI
LANGUAGES
'en'
'English'
'zh_Hans_CN'
'Chinese (Simplified)'
'zh_Hant_TW'
'Chinese (Traditional)'
'cs'
'Czech'
'fr'
'French'
'de'
'German'
'id'
'Indonesian'
'it'
'Italian'
'ja'
'Japanese'
'ko'
'Korean'
'pl'
'Polish'
'pt_BR'
'Portuguese (Brazilian)'
'ru'
'Russian'
'es'
'Spanish'
'sv'
'Swedish'
# DO NOT CHANGE UNLESS YOU KNOW WHAT YOU ARE DOING!
# List of modules to skip when dynamically loading
MODULE_BLACKLIST
'test'
# DO NOT CHANGE UNLESS YOU KNOW WHAT YOU ARE DOING!
# List of treeview browser nodes to skip when dynamically loading
NODE_BLACKLIST
[]
##########################################################################
# Server settings
##########################################################################
# The server mode determines whether or not we're running on a web server
# requiring user authentication, or desktop mode which uses an automatic
# default login.
# DO NOT DISABLE SERVER MODE IF RUNNING ON A WEBSERVER!!
# We only set SERVER_MODE if it's not already set. That's to allow the
# runtime to force it to False.
# NOTE: If you change the value of SERVER_MODE or DATA_DIR in an included
# config file, you may also need to redefine any values below that are
# derived from it, notably various paths such as LOG_FILE, SQLITE_PATH,
# SESSION_DB_PATH, STORAGE_DIR, KERBEROS_CCACHE_DIR, and
# AZURE_CREDENTIAL_CACHE_DIR
if
not
hasattr
builtins
'SERVER_MODE'
))
or
builtins
SERVER_MODE
is
None
SERVER_MODE
True
else
SERVER_MODE
builtins
SERVER_MODE
# HTTP headers to search for CSRF token when it is not provided in the form.
# Default is ['X-CSRFToken', 'X-CSRF-Token']
WTF_CSRF_HEADERS
'X-pgA-CSRFToken'
# User ID (email address) to use for the default user in desktop mode.
# The default should be fine here, as it's not exposed in the app.
DESKTOP_USER
APP_DEFAULT_EMAIL
# This option allows the user to host the application on a LAN
# Default hosting is on localhost (DEFAULT_SERVER='localhost').
# To host pgAdmin4 over LAN set DEFAULT_SERVER='0.0.0.0' (or a specific
# adaptor address.
# NOTE: This is NOT recommended for production use, only for debugging
# or testing. Production installations should be run as a WSGI application
# behind Apache HTTPD.
DEFAULT_SERVER
'127.0.0.1'
# The default port on which the app server will listen if not set in the
# environment by the runtime
DEFAULT_SERVER_PORT
5050
# This param is used to override the default web server information about
# the web technology and the frameworks being used in the application
# An attacker could use this information to fingerprint underlying operating
# system and research known exploits for the specific version of
# software in use
WEB_SERVER
'Python'
# Enable X-Frame-Option protection.
# Set to one of "SAMEORIGIN", "ALLOW-FROM origin" or "" to disable.
# Note that "DENY" is NOT supported (and will be silently ignored).
# See https://tools.ietf.org/html/rfc7034 for more info.
X_FRAME_OPTIONS
"SAMEORIGIN"
# The Cross-Origin-Opener-Policy allows a website to control whether
# a new top-level document, opened using Window.open() or by navigating
# to a new page, is opened in the same browsing context group (BCG)
# or in a new browsing context group.
# Set to 'unsafe-none', 'same-origin-allow-popups', 'same-origin',
# or 'noopener-allow-popups'
CROSS_ORIGIN_OPENER_POLICY
"same-origin"
# The Content-Security-Policy header allows you to restrict how resources
# such as JavaScript, CSS, or pretty much anything that the browser loads.
# see https://content-security-policy.com/#source_list for more info
# e.g. "default-src https: data: 'unsafe-inline' 'unsafe-eval';"
CONTENT_SECURITY_POLICY
"default-src ws: http: data: blob: 'unsafe-inline'"
" 'unsafe-eval';"
# STRICT_TRANSPORT_SECURITY_ENABLED when set to True will set the
# Strict-Transport-Security header
STRICT_TRANSPORT_SECURITY_ENABLED
False
# The Strict-Transport-Security header tells the browser to convert all HTTP
# requests to HTTPS, preventing man-in-the-middle (MITM) attacks.
# e.g. 'max-age=31536000; includeSubDomains'
STRICT_TRANSPORT_SECURITY
"max-age=31536000; includeSubDomains"
# The X-Content-Type-Options header forces the browser to honor the response
# content type instead of trying to detect it, which can be abused to
# generate a cross-site scripting (XSS) attack.
# e.g. nosniff
X_CONTENT_TYPE_OPTIONS
"nosniff"
# The browser will try to prevent reflected XSS attacks by not loading the
# page if the request contains something that looks like JavaScript and the
# response contains the same data. e.g. '1; mode=block'
X_XSS_PROTECTION
"1; mode=block"
# This param is used to validate ALLOWED_HOSTS for the application
# This will be used to avoid Host Header Injection attack
# ALLOWED_HOSTS = ['225.0.0.0/8', '226.0.0.0/7', '228.0.0.0/6']
# ALLOWED_HOSTS = ['127.0.0.1', '192.168.0.1']
# if ALLOWED_HOSTS= [] then it will accept all ips (and application will be
# vulnerable to Host Header Injection attack)
ALLOWED_HOSTS
[]
# Hashing algorithm used for password storage
SECURITY_PASSWORD_HASH
'pbkdf2_sha512'
# Minimum password length
PASSWORD_LENGTH_MIN
# Reverse Proxy parameters
# You must tell the middleware how many proxies set each header
# so it knows what values to trust.
# See https://tinyurl.com/yyg7r9av
# for more information.
# Number of values to trust for X-Forwarded-For
PROXY_X_FOR_COUNT
# Number of values to trust for X-Forwarded-Proto.
PROXY_X_PROTO_COUNT
# Number of values to trust for X-Forwarded-Host.
PROXY_X_HOST_COUNT
# Number of values to trust for X-Forwarded-Port.
PROXY_X_PORT_COUNT
# Number of values to trust for X-Forwarded-Prefix.
PROXY_X_PREFIX_COUNT
# NOTE: CSRF_SESSION_KEY, SECRET_KEY and SECURITY_PASSWORD_SALT are no
# longer part of the main configuration, but are stored in the
# configuration databases 'keys' table and are auto-generated.
# COMPRESSION
COMPRESS_MIMETYPES
'text/html'
'text/css'
'text/xml'
'text/javascript'
'application/json'
'application/javascript'
COMPRESS_LEVEL
COMPRESS_MIN_SIZE
500
# Set the cache control max age for static files in flask to 1 year
SEND_FILE_MAX_AGE_DEFAULT
31556952
# This will be added to static urls as url parameter with value as
# APP_VERSION_INT for cache busting on version upgrade. If the value is set as
# None or empty string then it will not be added.
# eg - http:localhost:5050/pgadmin.css?intver=3.13
APP_VERSION_PARAM
'ver'
# Add the internal version param to below extensions only
APP_VERSION_EXTN
'.css'
'.js'
'.html'
'.svg'
'.png'
'.gif'
'.ico'
# Data directory for storage of config settings etc. This shouldn't normally
# need to be changed - it's here as various other settings depend on it.
# On Windows, we always store data in %APPDATA%\$(APP_WIN_PATH). On other
# platforms, if we're in server mode we use /var/lib/$(APP_PATH),
# otherwise ~/.$(APP_PATH)
if
IS_WIN
# Use the short path on windows
DATA_DIR
os
path
realpath
os
path
join
fs_short_path
env
'APPDATA'
)),
APP_WIN_PATH
else
if
SERVER_MODE
DATA_DIR
os
path
join
'/var/lib/'
APP_PATH
else
DATA_DIR
os
path
realpath
os
path
expanduser
'~/'
'.'
APP_PATH
'/'
# An optional login banner to show security warnings/disclaimers etc. at
# login and password recovery etc. HTML may be included for basic formatting,
# For example:
# LOGIN_BANNER = "

Authorised Users Only!

" \
# "Unauthorised use is strictly forbidden."
LOGIN_BANNER
""
##########################################################################
# Log settings
##########################################################################
# Debug mode?
DEBUG
False
# Application log level - one of:
# CRITICAL 50
# ERROR 40
# WARNING 30
# SQL 25
# INFO 20
# DEBUG 10
# NOTSET 0
CONSOLE_LOG_LEVEL
logging
WARNING
FILE_LOG_LEVEL
logging
WARNING
# Log format.
JSON_LOGGER
False
CONSOLE_LOG_FORMAT_JSON
OrderedDict
([
"time"
"asctime"
),
"message"
"message"
),
"level"
"levelname"
])
FILE_LOG_FORMAT_JSON
OrderedDict
([
"time"
"asctime"
),
"message"
"message"
),
"level"
"levelname"
])
CONSOLE_LOG_FORMAT
%(asctime)s
%(levelname)s
\t
%(name)s
\t
%(message)s
FILE_LOG_FORMAT
%(asctime)s
%(levelname)s
\t
%(name)s
\t
%(message)s
# Log file name. This goes in the data directory, except on non-Windows
# platforms in server mode.
if
SERVER_MODE
and
not
IS_WIN
LOG_FILE
os
path
join
'/var/log'
APP_PATH
APP_SHORT_NAME
'.log'
else
LOG_FILE
os
path
join
DATA_DIR
APP_SHORT_NAME
'.log'
# Log rotation setting
# Log file will be rotated considering values for LOG_ROTATION_SIZE
# & LOG_ROTATION_AGE. Rotated file will be named in format
# - LOG_FILE.Y-m-d_H-M-S
LOG_ROTATION_SIZE
10
# In MBs
LOG_ROTATION_AGE
1440
# In minutes
LOG_ROTATION_MAX_LOG_FILES
90
# Maximum number of backups to retain
##########################################################################
# Server Connection Driver Settings
##########################################################################
# The default driver used for making connection with PostgreSQL
PG_DEFAULT_DRIVER
'psycopg3'
# Maximum allowed idle time in minutes before which releasing the connection
# for the particular session. (in minutes)
MAX_SESSION_IDLE_TIME
60
##########################################################################
# External Database Settings
# All configuration settings are stored by default in the SQLite database.
# In order to use external databases like PostgreSQL sets the value of
# CONFIG_DATABASE_URI like below:
# dialect+driver://username:password@host:port/database
# PostgreSQL:
# postgresql://username:password@host:port/database
# Specify Schema Name
# postgresql://username:password@host:port/database?options=-csearch_path=pgadmin
# Using PGPASS file
# postgresql://username@host:port?options=-csearch_path=pgadmin
##########################################################################
CONFIG_DATABASE_URI
''
##########################################################################
# User account and settings storage
##########################################################################
# The default path to the SQLite database used to store user accounts and
# settings. This default places the file in the same directory as this
# config file, but generates an absolute path for use througout the app.
SQLITE_PATH
env
'SQLITE_PATH'
or
os
path
join
DATA_DIR
APP_SHORT_NAME
'.db'
# SQLITE_TIMEOUT will define how long to wait before throwing the error -
# OperationError due to database lock. On slower system, you may need to change
# this to some higher value.
# (Default: 500 milliseconds)
SQLITE_TIMEOUT
500
# Allow database connection passwords to be saved if the user chooses.
# Set to False to disable password saving.
ALLOW_SAVE_PASSWORD
True
# Maximum number of history queries stored per user/server/database
MAX_QUERY_HIST_STORED
20
##########################################################################
# Server-side session storage path
# SESSION_DB_PATH (Default: $HOME/.pgadmin4/sessions)
##########################################################################
# We use SQLite for server-side session storage. There will be one
# SQLite database object per session created.
# Specify the path used to store your session objects.
# If the specified directory does not exist, the setup script will create
# it with permission mode 700 to keep the session database secure.
# On certain systems, you can use shared memory (tmpfs) for maximum
# scalability, for example, on Ubuntu:
# SESSION_DB_PATH = '/run/shm/pgAdmin4_session'
##########################################################################
SESSION_DB_PATH
os
path
join
DATA_DIR
'sessions'
SESSION_COOKIE_NAME
'pga4_session'
# Session digest method
SESSION_DIGEST_METHOD
'hashlib.sha1'
##########################################################################
# Mail server settings
##########################################################################
# These settings are used when running in web server mode for confirming
# and resetting passwords etc.
# See: http://pythonhosted.org/Flask-Mail/ for more info
MAIL_SERVER
'localhost'
MAIL_PORT
25
MAIL_USE_SSL
False
MAIL_USE_TLS
False
MAIL_USERNAME
''
MAIL_PASSWORD
''
MAIL_DEBUG
False
# Flask-Security overrides Flask-Mail's MAIL_DEFAULT_SENDER setting, so
# that should be set as such:
SECURITY_EMAIL_SENDER
'no-reply@localhost'
##########################################################################
# Mail content settings
##########################################################################
# These settings define the content of password reset emails
SECURITY_EMAIL_SUBJECT_PASSWORD_RESET
"Password reset instructions for
%s
APP_NAME
SECURITY_EMAIL_SUBJECT_PASSWORD_NOTICE
"Your
%s
password has been reset"
APP_NAME
SECURITY_EMAIL_SUBJECT_PASSWORD_CHANGE_NOTICE
"Your password for
%s
has been changed"
APP_NAME
##########################################################################
# Email address validation
##########################################################################
CHECK_EMAIL_DELIVERABILITY
False
SECURITY_EMAIL_VALIDATOR_ARGS
"check_deliverability"
CHECK_EMAIL_DELIVERABILITY
ALLOW_SPECIAL_EMAIL_DOMAINS
[]
# Disables global deliverable check while email validation
GLOBALLY_DELIVERABLE
True
##########################################################################
# Upgrade checks
##########################################################################
# Check for new versions of the application?
UPGRADE_CHECK_ENABLED
True
# Where should we get the data from?
UPGRADE_CHECK_URL
'https://www.pgadmin.org/versions.json'
# What key should we look at in the upgrade data file?
UPGRADE_CHECK_KEY
'pgadmin4'
# Which CA file should we use?
# Default to cacert.pem in the same directory as config.py et al.
CA_FILE
os
path
join
os
path
dirname
os
path
realpath
__file__
)),
"cacert.pem"
# Check if the detected browser is supported
CHECK_SUPPORTED_BROWSER
True
##########################################################################
# Storage Manager storage url config settings
# If user sets STORAGE_DIR to empty it will show all volumes if platform
# is Windows, '/' if it is Linux, Mac or any other unix type system.
# For example:
# 1. STORAGE_DIR = get_drive("C") or get_drive() # return C:/ by default
# where C can be any drive character such as "D", "E", "G" etc
# 2. Set path manually like
# STORAGE_DIR = "/path/to/directory/"
##########################################################################
STORAGE_DIR
os
path
join
DATA_DIR
'storage'
##########################################################################
# Default locations for binary utilities (pg_dump, pg_restore etc)
# These are intentionally left empty in the main config file, but are
# expected to be overridden by packagers in config_distro.py.
# A default location can be specified for each database driver ID, in
# a dictionary. Either an absolute or relative path can be specified.
# Version-specific defaults can also be specified, which will take priority
# over un-versioned paths.
# In cases where it may be difficult to know what the working directory
# is, "$DIR" can be specified. This will be replaced with the path to the
# top-level pgAdmin4.py file. For example, on macOS we might use:
# $DIR/../../SharedSupport
##########################################################################
DEFAULT_BINARY_PATHS
"pg"
""
"pg-13"
""
"pg-14"
""
"pg-15"
""
"pg-16"
""
"pg-17"
""
"pg-18"
""
"ppas"
""
"ppas-13"
""
"ppas-14"
""
"ppas-15"
""
"ppas-16"
""
"ppas-17"
""
"ppas-18"
""
##########################################################################
# Admin can specify fixed binary paths to prevent users from changing.
# It will take precedence over DEFAULT_BINARY_PATHS.
FIXED_BINARY_PATHS
"pg"
""
"pg-13"
""
"pg-14"
""
"pg-15"
""
"pg-16"
""
"pg-17"
""
"pg-18"
""
"ppas"
""
"ppas-13"
""
"ppas-14"
""
"ppas-15"
""
"ppas-16"
""
"ppas-17"
""
"ppas-18"
""
##########################################################################
# Test settings - used primarily by the regression suite, not for users
##########################################################################
# The default path for SQLite database for testing
TEST_SQLITE_PATH
os
path
join
DATA_DIR
'test_pgadmin4.db'
##########################################################################
# Allows flask application to response to the each request asynchronously
##########################################################################
THREADED_MODE
True
##########################################################################
# Do not allow SQLALCHEMY to track modification as it is going to be
# deprecated in future
##########################################################################
SQLALCHEMY_TRACK_MODIFICATIONS
False
##########################################################################
# Number of records to fetch in one page in query tool when query result
# set is large and is divided in multiple pages
##########################################################################
DATA_RESULT_ROWS_PER_PAGE
1000
##########################################################################
# Allow users to display Gravatar image for their username in Server mode
##########################################################################
SHOW_GRAVATAR_IMAGE
True
##########################################################################
# Set cookie path and options
##########################################################################
COOKIE_DEFAULT_PATH
'/'
COOKIE_DEFAULT_DOMAIN
None
SESSION_COOKIE_DOMAIN
None
SESSION_COOKIE_SAMESITE
'Lax'
SESSION_COOKIE_SECURE
False
SESSION_COOKIE_HTTPONLY
True
#########################################################################
# Skip storing session in files and cache for specific paths
#########################################################################
SESSION_SKIP_PATHS
'/misc/ping'
##########################################################################
# Session expiration support
##########################################################################
# SESSION_EXPIRATION_TIME is the interval in Days. Session will be
# expire after the specified number of *days*.
SESSION_EXPIRATION_TIME
# Make SESSION_EXPIRATION_TIME to 1 week in DESKTOP mode
if
not
SERVER_MODE
SESSION_EXPIRATION_TIME
# CHECK_SESSION_FILES_INTERVAL is interval in Hours. Application will check
# the session files for cleanup after specified number of *hours*.
CHECK_SESSION_FILES_INTERVAL
24
# USER_INACTIVITY_TIMEOUT is interval in Seconds. If the pgAdmin screen is left
# unattended for seconds then the user will
# be logged out. When set to 0, the timeout will be disabled.
# If pgAdmin doesn't detect any activity in the time specified (in seconds),
# the user will be forcibly logged out from pgAdmin. Set to zero to disable
# the timeout.
# Note: This is applicable only for SERVER_MODE=True.
USER_INACTIVITY_TIMEOUT
# OVERRIDE_USER_INACTIVITY_TIMEOUT when set to True will override
# USER_INACTIVITY_TIMEOUT when long running queries in the Query Tool
# or Debugger are running. When the queries complete, the inactivity timer
# will restart in this case. If set to False, user inactivity may cause
# transactions or in-process debugging sessions to be aborted.
OVERRIDE_USER_INACTIVITY_TIMEOUT
True
##########################################################################
# SSH Tunneling supports only for Python 2.7 and 3.4+
##########################################################################
SUPPORT_SSH_TUNNEL
True
# Allow SSH Tunnel passwords to be saved if the user chooses.
# Set to False to disable password saving.
ALLOW_SAVE_TUNNEL_PASSWORD
False
##########################################################################
# Master password is used to encrypt/decrypt saved server passwords
# Applicable for desktop mode only
##########################################################################
MASTER_PASSWORD_REQUIRED
True
##########################################################################
##########################################################################
# Allow to save master password which is used to encrypt/decrypt saved
# passwords in the os level secret like Keychain, password store etc.
# Disabling this will require user to enter master password
# if MASTER_PASSWORD_REQUIRED is set to True. Note: this is applicable only
# in case of Desktop mode.
##########################################################################
USE_OS_SECRET_STORAGE
True
##########################################################################
# pgAdmin encrypts the database connection and ssh tunnel password using a
# master password or pgAdmin login password (for other authentication sources)
# before storing it in the pgAdmin configuration database.
# Below setting is used to allow the user to specify the path to a script
# or program that will return an encryption key which will be used to
# encrypt the passwords. This setting is used only in server mode when
# auth sources are oauth, Kerberos, and webserver.
# You can pass the current username as an argument to the external script
# by specifying %u in config value.
# E.g. - MASTER_PASSWORD_HOOK = '/passwdgen_script.sh %u'
##########################################################################
MASTER_PASSWORD_HOOK
None
##########################################################################
# Allows pgAdmin4 to create session cookies based on IP address, so even
# if a cookie is stolen, the attacker will not be able to connect to the
# server using that stolen cookie.
# Note: This can cause problems when the server is deployed in dynamic IP
# address hosting environments, such as Kubernetes or behind load
# balancers. In such cases, this option should be set to False.
##########################################################################
ENHANCED_COOKIE_PROTECTION
True
##########################################################################
# External Authentication Sources
##########################################################################
# Default setting is internal
# External Supported Sources: ldap, kerberos, oauth2
# Multiple authentication can be achieved by setting this parameter to
# ['ldap', 'internal'] or ['oauth2', 'internal'] or
# ['webserver', 'internal'] etc.
# pgAdmin will authenticate the user with ldap/oauth2 whatever first in the
# list, in case of failure the second authentication option will be considered.
AUTHENTICATION_SOURCES
'internal'
##########################################################################
# MAX_LOGIN_ATTEMPTS which sets the number of failed login attempts that
# are allowed. If this value is exceeded the account is locked and can be
# reset by an administrator. By setting the variable to the value zero
# this feature is deactivated.
##########################################################################
MAX_LOGIN_ATTEMPTS
##########################################################################
# Only consider password to check the failed login attempts, email is
# excluded from this check
LOGIN_ATTEMPT_FIELDS
'password'
##########################################################################
# LDAP Configuration
##########################################################################
# After ldap authentication, user will be added into the SQLite database
# automatically, if set to True.
# Set it to False, if user should not be added automatically,
# in this case Admin has to add the user manually in the SQLite database.
LDAP_AUTO_CREATE_USER
True
# Connection timeout
LDAP_CONNECTION_TIMEOUT
10
# Server connection details (REQUIRED)
# example: ldap://: or ldap://:
LDAP_SERVER_URI
'ldap://:'
# The LDAP attribute containing user names. In OpenLDAP, this may be 'uid'
# whilst in AD, 'sAMAccountName' might be appropriate. (REQUIRED)
LDAP_USERNAME_ATTRIBUTE
''
##########################################################################
# 3 ways to configure LDAP as follows (Choose anyone):
# 1. Dedicated User binding
# LDAP Bind User DN Example: cn=username,dc=example,dc=com
# Set this parameter to allow the connection to bind using a dedicated user.
# After the connection is made, the pgadmin login user will be further
# authenticated by the username and password provided
# at the login screen.
LDAP_BIND_USER
None
# LDAP Bind User Password
LDAP_BIND_PASSWORD
None
# OR ####################
# 2. Anonymous Binding
# Set this parameter to allow the anonymous bind.
# After the connection is made, the pgadmin login user will be further
# authenticated by the username and password provided
LDAP_ANONYMOUS_BIND
False
# OR ####################
# 3. Bind as pgAdmin user
# BaseDN (REQUIRED)
# AD example:
# (&(objectClass=user)(memberof=CN=MYGROUP,CN=Users,dc=example,dc=com))
# OpenLDAP example: CN=Users,dc=example,dc=com
LDAP_BASE_DN
''
# Configure the bind format string
# Default: LDAP_BIND_FORMAT="
# {LDAP_USERNAME_ATTRIBUTE}={LDAP_USERNAME},{LDAP_BASE_DN}"
# The current available options are:
# LDAP_USERNAME_ATTRIBUTE, LDAP_USERNAME, LDAP_BASE_DN
# Example: LDAP_BIND_FORMAT="myldapuser@sales.example.com"
# LDAP_BIND_FORMAT="NET\\myldapuser"
LDAP_BIND_FORMAT
{LDAP_USERNAME_ATTRIBUTE}
{LDAP_USERNAME}
{LDAP_BASE_DN}
##########################################################################
# Search ldap for further authentication (REQUIRED)
# It can be optional while bind as pgAdmin user
LDAP_SEARCH_BASE_DN
''
# The LDAP attribute indicates whether the DN (Distinguished Names)
# are case sensitive or not
LDAP_DN_CASE_SENSITIVE
False
# Filter string for the user search.
# For OpenLDAP, '(cn=*)' may well be enough.
# For AD, you might use '(objectClass=user)' (REQUIRED)
LDAP_SEARCH_FILTER
'(objectclass=*)'
# Search scope for users (one of BASE, LEVEL or SUBTREE)
LDAP_SEARCH_SCOPE
'SUBTREE'
# Use TLS? If the URI scheme is ldaps://, this is ignored.
LDAP_USE_STARTTLS
False
# TLS/SSL certificates. Specify if required, otherwise leave empty
LDAP_CA_CERT_FILE
''
LDAP_CERT_FILE
''
LDAP_KEY_FILE
''
# TLS/SSL certificate Validation (True/False),
# Make it false if certificate validation is not required.
LDAP_CERT_VALIDATE
True
##########################################################################
# Some flaky LDAP servers returns malformed schema. If True, no exception
# will be raised and schema is thrown away but authentication will be done.
# This parameter should remain False, as recommended.
LDAP_IGNORE_MALFORMED_SCHEMA
False
##########################################################################
# Kerberos Configuration
##########################################################################
KRB_APP_HOST_NAME
DEFAULT_SERVER
# If the default_keytab_name is not set in krb5.conf or
# the KRB_KTNAME environment variable is not set then, explicitly set
# the Keytab file
KRB_KTNAME
''
# After kerberos authentication, user will be added into the SQLite database
# automatically, if set to True.
# Set it to False, if user should not be added automatically,
# in this case Admin has to add the user manually in the SQLite database.
KRB_AUTO_CREATE_USER
True
KERBEROS_CCACHE_DIR
os
path
join
DATA_DIR
'krbccache'
#############################################################################
# Create local directory to store azure credential cache
#############################################################################
AZURE_CREDENTIAL_CACHE_DIR
os
path
join
DATA_DIR
'azurecredentialcache'
##########################################################################
# OAuth2 Configuration
##########################################################################
# Multiple OAUTH2 providers can be added in the list like [{...},{...}]
# All parameters are required
OAUTH2_CONFIG
# The name of the of the oauth provider, ex: github, google
'OAUTH2_NAME'
None
# The display name, ex: Google
'OAUTH2_DISPLAY_NAME'
''
# Oauth client id
'OAUTH2_CLIENT_ID'
None
# Oauth secret
'OAUTH2_CLIENT_SECRET'
None
# URL to generate a token,
# Ex: https://github.com/login/oauth/access_token
'OAUTH2_TOKEN_URL'
None
# URL is used for authentication,
# Ex: https://github.com/login/oauth/authorize
'OAUTH2_AUTHORIZATION_URL'
None
# server metadata url might optional for your provider
'OAUTH2_SERVER_METADATA_URL'
None
# Oauth base url, ex: https://api.github.com/
'OAUTH2_API_BASE_URL'
None
# Name of the Endpoint, ex: user
'OAUTH2_USERINFO_ENDPOINT'
None
# Oauth scope, ex: 'openid email profile'
# Note that an 'email' claim is required in the resulting profile
'OAUTH2_SCOPE'
None
# The claim which is used for the username. If the value is empty the
# email is used as username, but if a value is provided,
# the claim has to exist.
'OAUTH2_USERNAME_CLAIM'
None
# Font-awesome icon, ex: fa-github
'OAUTH2_ICON'
None
# UI button colour, ex: #0000ff
'OAUTH2_BUTTON_COLOR'
None
# The additional claims to check on user ID Token or Userinfo response.
# This is useful to provide additional authorization checks
# before allowing access.
# Example for GitLab: allowing all maintainers teams, and a specific
# developers group to access pgadmin:
# 'OAUTH2_ADDITIONAL_CLAIMS': {
# 'https://gitlab.org/claims/groups/maintainer': [
# 'kuberheads/applications',
# 'kuberheads/dba',
# 'kuberheads/support'
# ],
# 'https://gitlab.org/claims/groups/developer': [
# 'kuberheads/applications/team01'
# ],
# }
# Example for AzureAD:
# 'OAUTH2_ADDITIONAL_CLAIMS': {
# 'groups': ["0760b6cf-170e-4a14-91b3-4b78e0739963"],
# 'wids': ["cf1c38e5-3621-4004-a7cb-879624dced7c"],
# }
'OAUTH2_ADDITIONAL_CLAIMS'
None
# Set this variable to False to disable SSL certificate verification
# for OAuth2 provider.
# This may need to set False, in case of self-signed certificates.
# Ref: https://github.com/psf/requests/issues/6071
'OAUTH2_SSL_CERT_VERIFICATION'
True
# set this variable to invalidate the session of the oauth2 provider
# Example for keycloak:
# 'OAUTH2_LOGOUT_URL':
# 'https://example.com/realms/master/protocol/openid-connect/logout?post_logout_redirect_uri={redirect_uri}&id_token_hint={id_token}'
'OAUTH2_LOGOUT_URL'
None
# After Oauth authentication, user will be added into the SQLite database
# automatically, if set to True.
# Set it to False, if user should not be added automatically,
# in this case Admin has to add the user manually in the SQLite database.
OAUTH2_AUTO_CREATE_USER
True
##########################################################################
# Webserver Configuration
##########################################################################
WEBSERVER_AUTO_CREATE_USER
True
# REMOTE_USER variable will be used to check the environment variable
# is set or not first, if not available,
# request header will be checked for the same.
# Possible values: REMOTE_USER, HTTP_X_FORWARDED_USER, X-Forwarded-User
WEBSERVER_REMOTE_USER
'REMOTE_USER'
##########################################################################
# Two-factor Authentication Configuration
##########################################################################
# Set it to True, to enable the two-factor authentication
MFA_ENABLED
True
# Set it to True, to ask the users to register forcefully for the
# two-authentication methods on logged-in.
MFA_FORCE_REGISTRATION
False
# pgAdmin supports Two-factor authentication by either sending an one-time code
# to an email, or using the TOTP based application like Google Authenticator.
MFA_SUPPORTED_METHODS
"email"
"authenticator"
# NOTE: Please set the 'Mail server settings' to use 'email' as two-factor
# authentication method.
# Subject for the email verification code
# Default: - Verification Code
# e.g. pgAdmin 4 - Verification Code
MFA_EMAIL_SUBJECT
None
##########################################################################
# PSQL tool settings
##########################################################################
# This will enable PSQL tool in pgAdmin when running in server mode.
# PSQL is always enabled in Desktop mode, however in server mode it is
# disabled by default because users can run arbitrary commands on the
# server through it.
ENABLE_PSQL
False
##########################################################################
# ENABLE_BINARY_PATH_BROWSING setting is used to enable the browse button
# while selecting binary path for the database server in server mode.
# In Desktop mode it is always enabled and setting is of no use.
##########################################################################
ENABLE_BINARY_PATH_BROWSING
False
##########################################################################
# In server mode, the SHARED_STORAGE setting is used to enable shared storage.
# Specify the name, path, and restricted_access values that should be shared
# between users. When restricted_access is set to True, non-admin users cannot
# upload/add, delete, or rename files/folders in shared storage, only admins
# can do that. Users must provide the absolute path to the folder, and the name
# can be anything they see on the user interface.
# [{ 'name': 'Shared 1', 'path': '/shared_folder',
# 'restricted_access': True/False}]
##########################################################################
SHARED_STORAGE
[]
#############################################################################
# AUTO_DISCOVER_SERVERS setting is used to enable the pgAdmin to discover the
# database server automatically on the local machine.
# When it is set to False, pgAdmin will not discover servers installed on
# the local machine.
#############################################################################
AUTO_DISCOVER_SERVERS
True
#############################################################################
# SERVER_HEARTBEAT_TIMEOUT is used to send the server heartbeat to server
# from the client. This will resolve the orphan database issue once
# browser tab is closed.
#############################################################################
SERVER_HEARTBEAT_TIMEOUT
30
# In seconds
#############################################################################
# ENABLE_SERVER_PASS_EXEC_CMD is used to enable/disable Password exec command
# field in server properties. This is used to specify a shell command to be
# executed to retrieve a password to be used for server authentication.
# This setting is applicable only for server mode.
#############################################################################
ENABLE_SERVER_PASS_EXEC_CMD
False
#############################################################################
# Maximum number of Tags allowed on a server node
##############################################################################
MAX_SERVER_TAGS_ALLOWED
#############################################################################
# Number of records to fetch in one batch for server logs.
##############################################################################
ON_DEMAND_LOG_COUNT
10000
##########################################################################
# AI/LLM Settings
##########################################################################
# Master switch to enable/disable LLM features entirely.
# When False, all AI/LLM features are disabled and cannot be enabled
# by users through preferences. When True, users can configure their
# preferred LLM provider in preferences.
LLM_ENABLED
True
# Default LLM Provider
# Specifies which LLM provider to use by default when LLM_ENABLED is True.
# Users can override this in their preferences.
# Valid values: 'anthropic', 'openai', 'ollama', 'docker', or '' (disabled)
DEFAULT_LLM_PROVIDER
''
# Anthropic Configuration
# URL for the Anthropic API endpoint. Leave empty to use the default
# (https://api.anthropic.com/v1). Set a custom URL to use an
# Anthropic-compatible API provider.
ANTHROPIC_API_URL
''
# Path to a file containing the Anthropic API key. The file should contain
# only the API key with no additional whitespace or formatting.
# Default: ~/.anthropic-api-key
# Note: The API key may be optional when using a custom API URL with a
# provider that does not require authentication.
ANTHROPIC_API_KEY_FILE
'~/.anthropic-api-key'
# The Anthropic model to use for AI features.
# Examples: claude-sonnet-4-20250514, claude-3-5-haiku-20241022
ANTHROPIC_API_MODEL
''
# OpenAI Configuration
# URL for the OpenAI API endpoint. Leave empty to use the default
# (https://api.openai.com/v1). Set a custom URL to use any
# OpenAI-compatible API provider (e.g., LiteLLM, LM Studio, EXO).
# Include the /v1 path prefix if required by your provider
# (e.g., http://localhost:1234/v1).
OPENAI_API_URL
''
# Path to a file containing the OpenAI API key. The file should contain
# only the API key with no additional whitespace or formatting.
# Default: ~/.openai-api-key
# Note: The API key may be optional when using a custom API URL with a
# provider that does not require authentication.
OPENAI_API_KEY_FILE
'~/.openai-api-key'
# The OpenAI model to use for AI features.
# Examples: gpt-4o, gpt-4o-mini, gpt-4-turbo
OPENAI_API_MODEL
''
# Ollama Configuration
# URL for the Ollama API endpoint. Leave empty to disable Ollama.
# Typical value: http://localhost:11434
OLLAMA_API_URL
''
# The Ollama model to use for AI features.
# Examples: llama3.2, codellama, mistral
OLLAMA_API_MODEL
''
# Docker Model Runner Configuration
# Docker Desktop 4.40+ includes a built-in model runner with an
# OpenAI-compatible API. No API key is required.
# URL for the Docker Model Runner API endpoint. Leave empty to disable.
# Typical value: http://localhost:12434
# Tip: You can also use the OpenAI provider with a custom API URL for any
# OpenAI-compatible endpoint, including Docker Model Runner.
DOCKER_API_URL
''
# The Docker Model Runner model to use for AI features.
# Examples: ai/qwen3-coder, ai/llama3.2
DOCKER_API_MODEL
''
# Maximum Tool Iterations
# The maximum number of tool call iterations allowed during an AI conversation.
# This prevents runaway conversations that could consume excessive resources.
# Users can override this in their preferences.
MAX_LLM_TOOL_ITERATIONS
20
#############################################################################
# Patch the default config with custom config and other manipulations
#############################################################################
from
pgadmin.evaluate_config
import
evaluate_and_patch_config
locals
()
update
evaluate_and_patch_config
locals
()))