<commit_before>---
layout: "docs"
page_title: "Server Configuration"
sidebar_current: "docs-config"
description: |-
  Vault server configuration reference.
---

# Server Configuration

Outside of development mode, Vault servers are configured using a file.
The format of this file is [HCL](https://github.com/hashicorp/hcl) or JSON.
An example configuration is shown below:

```javascript
backend "consul" {
  address = "127.0.0.1:8500"
  path = "vault"
}

listener "tcp" {
  address = "127.0.0.1:8200"
  tls_disable = 1
}

telemetry {
  statsite_address = "127.0.0.1:8125"
  disable_hostname = true
}
```

After the configuration is written, use the `-config` flag with `vault server`
to specify where the configuration is.

Starting with 0.5.2, limited configuration options can be changed on-the-fly by
sending a SIGHUP to the server process. These are denoted below.

## Reference

* `backend` (required) - Configures the storage backend where Vault data
  is stored. There are multiple options available for storage backends,
  and they're documented below.

* `ha_backend` (optional) - Configures the storage backend where Vault HA
  coordination will take place. Must be an HA-supporting backend using the
  configuration options as documented below. If not set, HA will be attempted
  on the backend given in the `backend` parameter.

* `cluster_name` (optional) - An identifier for your Vault cluster. If omitted,
  Vault will generate a value for `cluster_name`. If connecting to Vault
  Enterprise, this value will be used in the interface.

* `listener` (required) - Configures how Vault is listening for API requests.
  "tcp" and "atlas" are valid values. A full reference for the
   inner syntax is below.

* `cache_size` (optional) - If set, the size of the read cache used
  by the physical storage subsystem will be set to this value. The
  value is in number of entries so the total cache size is dependent
  on the entries being stored. Defaults to 32k entries.

* `disable_cache` (optional) - A boolean. If true, this will disable all caches
  within Vault, including the read cache used by the physical storage
  subsystem. This will very significantly impact performance.

* `disable_mlock` (optional) - A boolean. If true, this will disable the
  server from executing the `mlock` syscall to prevent memory from being
  swapped to disk. This is not recommended in production (see below).

* `telemetry` (optional)  - Configures the telemetry reporting system
  (see below).

* `default_lease_ttl` (optional) - Configures the default lease duration
  for tokens and secrets. This is a string value using a suffix, e.g. "768h".
  Default value is 32 days. This value cannot be larger than `max_lease_ttl`.

* `max_lease_ttl` (optional) - Configures the maximum possible
  lease duration for tokens and secrets. This is a string value using a suffix,
  e.g. "768h". Default value is 32 days.

In production it is a risk to run Vault on systems where `mlock` is
unavailable or the setting has been disabled via the `disable_mlock`.
Disabling `mlock` is not recommended unless the systems running Vault only
use encrypted swap or do not use swap at all.  Vault only supports memory
locking on UNIX-like systems (Linux, FreeBSD, Darwin, etc).  Non-UNIX like
systems (e.g. Windows, NaCL, Android) lack the primitives to keep a process's
entire memory address space from spilling to disk and is therefore automatically
disabled on unsupported platforms.

On Linux, to give the Vault executable the ability to use the `mlock` syscall
without running the process as root, run:

```shell
sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault))
```

## Listener Reference

For the `listener` section, the only required listener is "tcp".
Regardless of future plans, this is the recommended listener,
as it allows for HA mode. If you wish to use the Vault
Enterprise interface in HashiCorp Atlas, you may add an ["atlas" listener block](#connecting-to-vault-enterprise-in-hashicorp-atlas)<commit_msg>Add doc for ui to config page<commit_after>---
layout: "docs"
page_title: "Server Configuration"
sidebar_current: "docs-config"
description: |-
  Vault server configuration reference.
---

# Server Configuration

Outside of development mode, Vault servers are configured using a file.
The format of this file is [HCL](https://github.com/hashicorp/hcl) or JSON.
An example configuration is shown below:

```javascript
backend "consul" {
  address = "127.0.0.1:8500"
  path = "vault"
}

listener "tcp" {
  address = "127.0.0.1:8200"
  tls_disable = 1
}

telemetry {
  statsite_address = "127.0.0.1:8125"
  disable_hostname = true
}
```

After the configuration is written, use the `-config` flag with `vault server`
to specify where the configuration is.

Starting with 0.5.2, limited configuration options can be changed on-the-fly by
sending a SIGHUP to the server process. These are denoted below.

## Reference

* `backend` (required) - Configures the storage backend where Vault data
  is stored. There are multiple options available for storage backends,
  and they're documented below.

* `ha_backend` (optional) - Configures the storage backend where Vault HA
  coordination will take place. Must be an HA-supporting backend using the
  configuration options as documented below. If not set, HA will be attempted
  on the backend given in the `backend` parameter.

* `cluster_name` (optional) - An identifier for your Vault cluster. If omitted,
  Vault will generate a value for `cluster_name`. If connecting to Vault
  Enterprise, this value will be used in the interface.

* `listener` (required) - Configures how Vault is listening for API requests.
  "tcp" and "atlas" are valid values. A full reference for the
   inner syntax is below.

* `cache_size` (optional) - If set, the size of the read cache used
  by the physical storage subsystem will be set to this value. The
  value is in number of entries so the total cache size is dependent
  on the entries being stored. Defaults to 32k entries.

* `disable_cache` (optional) - A boolean. If true, this will disable all caches
  within Vault, including the read cache used by the physical storage
  subsystem. This will very significantly impact performance.

* `disable_mlock` (optional) - A boolean. If true, this will disable the
  server from executing the `mlock` syscall to prevent memory from being
  swapped to disk. This is not recommended in production (see below).

* `telemetry` (optional)  - Configures the telemetry reporting system
  (see below).

* `default_lease_ttl` (optional) - Configures the default lease duration
  for tokens and secrets. This is a string value using a suffix, e.g. "768h".
  Default value is 32 days. This value cannot be larger than `max_lease_ttl`.

* `max_lease_ttl` (optional) - Configures the maximum possible
  lease duration for tokens and secrets. This is a string value using a suffix,
  e.g. "768h". Default value is 32 days.

* `ui` (optional, Vault Enterprise only) - If set `true`, enables the built-in
  web-based UI. Once enabled, the UI will be available to browsers at the
  standard Vault address.

In production it is a risk to run Vault on systems where `mlock` is
unavailable or the setting has been disabled via the `disable_mlock`.
Disabling `mlock` is not recommended unless the systems running Vault only
use encrypted swap or do not use swap at all.  Vault only supports memory
locking on UNIX-like systems (Linux, FreeBSD, Darwin, etc).  Non-UNIX like
systems (e.g. Windows, NaCL, Android) lack the primitives to keep a process's
entire memory address space from spilling to disk and is therefore automatically
disabled on unsupported platforms.

On Linux, to give the Vault executable the ability to use the `mlock` syscall
without running the process as root, run:

```shell
sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault))
```

## Listener Reference

For the `listener` section, the only required listener is "tcp".
Regardless of future plans, this is the recommended listener,
as it allows for HA mode. If you wish to use the Vault
Enterprise interface in HashiCorp Atlas, you may add an ["atlas" listener block](#connecting-to-vault-enterprise-in-hashicorp-atlas)
{'fraction_non_alphanumeric': 0.07212357090732181, 'fraction_numerical': 0.011189491607881293, 'mean_word_length': 4.191287878787879, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '919858', 'n_tokens_mistral': 2373, 'n_tokens_neox': 2268, 'n_words': 1144}