Configuration

Three separate things, often confused: what the operator sets for the whole instance, what the process is told through its environment, and what each account chooses for itself.

config.toml

Written to ~/.config/ontoplano/config.toml on first run, and edited by the operator or through /admin. Its shape is the OntoplanoConfig interface, so this table is that interface.

[server]

[database]

[week]

[registration]

requireVerifiedEmail

Whether an account must confirm its address before it can use anything. Off by default: on a box for one household the mail may not be set up at all, and an account that cannot confirm cannot get in.

[account]

allowEmailChange

Whether a person may move their account to another address.

Off unless the instance says otherwise: an email address is what an account is here — it signs in and it receives the reset link — so letting it be changed is the operator's call, not the account holder's.

[reports]

clientErrors

Whether the app may ask people to send in client-side errors.

Off by default: a stack trace is somebody's data leaving their browser, so the instance opts in, and then each person is asked once and can say no. Nothing is ever sent before both have said yes.

feedbackEmail

Where a report or a suggestion is mailed, beside being recorded.

Empty means nowhere: the instance keeps them in its own table and the operator reads them in /admin, which is the right default for somebody running this for a household. An instance with somebody actually listening names an address here.

[ui]

[legal]

[pricing]

[review]

[media]

maxKilobytes

The biggest single picture this instance accepts, in kilobytes.

Enforced on the server against the bytes actually received, not against what the browser said it was sending. Pictures are rows in the same SQLite file as everything else, so this is also the number that decides how fast that file grows.

importFiles

How many files one folder import may carry.

A tree chosen in the picker is a number the person did not type, and a hundred thousand of them would be read into this process's memory one request at a time. The ceiling is named so the preview can say what it left out rather than silently stopping at some number.

[newsletter]

enabled

Whether this instance keeps a list of people to tell when it changes.

Off unless the instance says otherwise, like every other feature that collects an address from somebody who is not an account holder: a self-hosted install has nothing to announce, and a subscribe form on it is a box that fills up with whatever crawlers put in it.

On, it opens one public endpoint — /api/subscribe — which takes an address, sends one confirmation, and does nothing at all until that link is followed.

origin

The site allowed to post the form, if the form is not on this host.

ontoplano.com is a different origin from app.ontoplano.com, so the footer form is a cross-origin POST and the browser will not send it without being told. Empty means same-origin only, which is what a self-hosted instance wants even with the list turned on.

[instance]

devTools

Whether this instance carries the workbenches under /dev.

Off everywhere unless somebody turns it on. They are not screens of the app, and an instance somebody else runs has no reason to carry them or to know they exist. There are none at the moment.

Here rather than in an environment variable because this is a thing the instance allows, and everything an instance allows is in this one file.

jobReplay

Whether the reminders job will work from a moment it is given.

Ordinarily the pass uses the clock. With this on, /api/jobs/reminders accepts ?at= and considers due whatever was due then — which is how a box that was down for an hour catches up, and how the suite walks a reminder from the form to the badge without waiting on a clock.

Off here, because it is a capability rather than a fix: a caller holding the health token could otherwise make tomorrow's reminders arrive today. Bounded — the query that finds candidates still uses the real clock and looks no more than a day ahead — but not nothing, and not something a production instance has any use for.

selfHost

Whether this is somebody's own copy rather than one that is sold.

Off by default, which treats an instance as hosted — the answer with the fewer consequences for an instance that forgot to say.

tagline

The one line under the name on the signed-out front page.

Here rather than in the component because it is the operator's sentence, not the app's: somebody running this for a household or a team should be able to say what their instance is without editing Svelte. Empty falls back to the line below.

language

The language this instance falls back to.

Not "the language of the app" — every account picks its own, and a browser that asks for one this app has gets it. This is the answer when neither of those applies: a stranger whose browser asked for something untranslated, and the address on an email to somebody who never said. An instance run for a Brazilian household should say pt-BR here and never think about it again.

Environment

Every ONTOPLANO_* variable the code actually reads, and where it is read. A variable that stops being consulted leaves this table by itself, which is the point — an env var nobody reads any more is the kind of thing that stays in a deployment script for years.

Per-account settings

Rows in user_settings, one per account per key. These are choices a person makes about their own copy of the app, not the operator.