🚀 Get to pre-production in weeks, not months, with private training direct from Jube’s developer — real sovereignty, zero vendor lock-in.

Environment Variables

In Jube, application settings can only be passed via operating system (or container) Environment Variables. The following hardcoded Environment Variables, this would be to say defaults, are available:

Variable	Default Value	Description
ModelSynchronisationWait	10000	The duration in milliseconds between model synchronisation. Many of the entities in model synchronisation require explicit instruction to synchronise, with that instruction being checked for each interval. Model entities which do not require explicit synchronisation will be included for each interval.
EnableNotification	True	A boolean value to indicate if Notifications are enabled in the instance, in which case background threads will be established to relay the notifications created by the model invocation, and that model invocation may be branched to dispatch notifications to the thread.
EnableTtlCounter	True	A boolean value indicating if this instance should start a thread to manage the decrement of TTL Counters.
ConnectionString	null	The connection string to the Postgres database.
CacheConnectionString	null	The connection string to the optional Cache Postgres database. In the absence of value will fall back to ConnectionString.
MigrationConnectionString	null	An optional, separate connection string used only for running Migration on startup (see Architecture), falling back to ConnectionString - with a warning logged - when unset. Useful to grant DDL permissions (CREATE TABLE, CREATE INDEX) only to the credential used for Migration, while ConnectionString itself stays scoped to a restricted, DDL-less runtime user - see the restricted Postgres users note on Deploying with Docker.
ReportConnectionString	null	The connection string to the Reporting Postgres database. In the absence of value there is no fallback value. In practice the connection string might be the same as the main, but be a different account for the purpose of reporting.
EnableSearchKeyCache	True	A boolean value indicating if this instance should start a thread to manage the computation of Abstraction Rules set to Cache, meaning the background computation of aggregation values. Only a single instance may exist.
EnableCasesAutomation	True	A boolean value indicating if this instance should start a thread to manage changing of status in the case records. Only a single instance may exist.
CasesAutomationWait	60000	Subject to EnableCasesAutomation being True, the duration in milliseconds between model case status change and automation.
EnableEntityModel	True	A boolean value to indicate if the models should be synchronised to this instance thus being available for invocation.
ArchiverPersistThreads	4	The number of threads preparing records for bulk insert to the Archive and ArchiveKey tables. In extremely high throughput implementations with thousands of records being inserted, balancing the number of threads inserting records with the amount of records batched to insert allows for write performance optimisation. Zero (0) has the effect of disabling.
ModelInvokeAsynchronousThreads	1	The number of threads allocated to processing model invocation switched to be asynchronous. Zero (0) has the effect of disabling.
BulkCopyThreshold	1000	For each Archiver Persist Thread the number of records to be buffered before a bulk copy is committed. A maximum of ten seconds is allowed from the last message else bulk insert is performed regardless.
ActivationWatcherAllowPersist	True	A boolean value to indicate that the instance may persist activation records to the ActivationWatcher table and also allowing for the instantiation of threads to manage the asynchronous bulk insert.
ActivationWatcherPersistThreads	1	The number of threads preparing records for bulk insert into the ActivationWatcher table. Zero (0) has the effect of disabling.
ActivationWatcherBulkCopyThreshold	100	For each Activation Watcher Persist Thread the number of records to be buffered before a bulk copy is committed.
EnableReprocessing	True	A boolean value to indicate that the reprocessing of model invocation given Archive data, be allowed to create threads.
ReprocessingThreads	1	The number of threads allocated to reprocessing model invocation given Archive data. Zero (0) has the effect of disabling.
ReprocessingBulkLimit	10000	Reprocessing returns data from the Postgres Archive tables in batch, in the order the transactions took place by the date of creation, then invokes the model for each record. The value is the limit for the records to be returned for each batch so not to flood the instance memory.
ThreadPoolManualControl	False	A boolean value to override the .Net Thread Pool with MinThreadPoolThreads and MaxThreadPoolThreads values, else .Net self managed. Managing the thread pool manually can reduce apparent warm up time for the application and reduce risk of thread starvation through threads being closely sized to underlying compute resources. All requests to the Kestrel web server will place demand on the Thread Pool, with each IO demand being made ashncronously (and likely in a seperate thread allocated by the Thread Pool). Model invocation can be decoupled from the thread pool partially via the use of asynchronous model invocation, otherwise it forms part of the request handled by the Kestrel thread.
MinThreadPoolThreads	30	Given ThreadPoolManualControl being True, the minimum threads in the Thread Pool.
MaxThreadPoolThreads	1000	Given ThreadPoolManualControl being True, the maximum threads in the Thread Pool.
MaximumModelInvokeAsyncQueue	10000	The maximum number of pending asynchronous HTTP Model invocations allowed in queue before further requests are returned with an error.
SMTPHost	null	For notification functionality, the SMTP server host.
SMTPPort	587	The SMTP server port.
SMTPUser	null	Assuming authentication the SMTP server user name.
SMTPPassword	null	The SMTP server password given user name.
SMTPFrom	null	The email address to be sent from.
ClickatellAPIKey	null	For notification functionality, the API key provided by Clickatell for the SMS dispatch service.
HttpAdaptationUrl	http://localhost:5001	As a security measure a prefix to the HTTP Endpoint value entered by the end user in HTTP Adaptation to recall scores.
HttpAdaptationTimeout	1000	The timeout value for HTTP Adaptation endpoint recall.
HttpAdaptationValidateSsl	False	A boolean value to ensure SSL validation for HTTP Adaptation endpoint recall.
EnableSanction	True	A boolean value to indicate if sanctions should be loaded from the database, cached to the instance memory and made available for searching in model invocation or directly.
EnableSanctionLoader	False	A boolean value to indicate that this instance should load the Sanctions tables from local or internet resources. Disabled by default for reasons of security and privacy given outbound request to external HTTP resources.
SanctionLoaderWait	3600000	The duration in milliseconds between polling the file system or internet location for sanctions files. Raised from an earlier 60000 (one minute) default after that interval hit rate limits against a real sanctions source - now polled hourly by default.
NegotiateAuthentication	False	A boolean value to indicate that authentication should take place via Negotiated Authentication (commonly known as Active Directory in Windows networks) rather than JSON Web Token authentication. Very common in corporate environments.
UseMockDataExhaustive	True	A boolean value to indicate that given an Exhaustive training instance having been instructed by the end user, whether the Mock data should be used for training. Mock data is only useful for Demonstration purposes and should routinely be set to False for production use.
AMQP	False	A boolean value to indicate that connections should be established via the AMQPUri connection string to the RabbitMQ server or cluster.
AMQPUri	null	The connection string to the RabbitMQ server or cluster.
JWTValidAudience	http://localhost:5001	The server domain that is allowed for the token.
JWTValidIssuer	http://localhost:5001	The server domain that issued the token.
JWTKey	null	The encryption key for the JWT. This key is created randomly on first startup of the Jube instance, but can be changed. The key value is stored in the Jube.environment file, having being randomly created on application first use.
PasswordHashingKey	null	Passwords are encrypted in an irreversible manner using the Argon2 hashing algorithm, alongside a salting value. The salt value is stored in the Jube.environment file, having being randomly created on application first use.
EnablePublicInvokeController	True	Most HTTP Endpoint require authentication, although an exception is the api/Invoke endpoint which is intended for integration. A boolean value needs to be set to allow the invocation API to be recalled on an open basis, and will in the event of False, return Not Found HTTP Status.
EnableEngine	True	A boolean value to indicate if the engine should be instantiated. The engine contains functionality such as Sanctions, Model Invocation, Archiving, Search Key Caching, Notifications, Case Automation, Counters, Tagging, Reprocessing and Exhaustive Training. In the absence of the engine, only functions required by the user interface are instantiated.
EnableCallback	True	A boolean value to indicate that HTTP callbacks are available - see HTTP Asynchronous Model Invocation. Paired with CallbackTimeout.
EnableMigration	True	A boolean value to indicate whether this instance should perform database Migration on startup - see Architecture. Disable and run the Fluent Migrator Command Line Runner separately where DDL permissions are unavailable at runtime.
EnableExhaustiveTraining	True	A boolean value to indicate that a thread should be started for the purpose of Exhaustive training. Given the computation expense of Exhaustive training only a single thread is available per instance.
ExhaustiveTrialsLimit	1000	For an Exhaustive training instance, the maximum number of trials to be performed (which is a random selection of input variables. This variable does not govern the evolution of a Neural Networks topology for each trial.
ExhaustiveMinVariableCount	5	For an Exhaustive trial, the minimum number of variables to be trained and topology evolve.
ExhaustiveMaxVariableCount	30	For an Exhaustive trial, the maximum number of variables to be trained and topology evolve.
ExhaustiveTrainingDataSamplePercentage	0.6	To avoid over-fitting, data available is randomly split between training, cross validation and testing. The percentage of data to be allocated to training.
ExhaustiveCrossValidationDataSamplePercentage	0.2	The percentage of data to be allocated to Cross Validation.
ExhaustiveTestingDataSamplePercentage	0.2	The percentage of data to be allocated to Testing.
ExhaustiveValidationTestingActivationThreshold	0.5	The threshold at which a recalled example will be allocated to the positive class.
ExhaustiveTopologySinceImprovementLimit	10	During a trial the internal topology will have processing elements and hidden layers evolved. The evolution process will terminate at the point a number of additional evolutions have taken place without improvement. The value at which evolution should terminate upon no improvement. Lesser performance will always terminate and carry forward as best topology.
ExhaustiveLayerDepthLimit	4	The maximum number of hidden layers in a topology exploration.
ExhaustiveLayerWidthLimitInputLayerFactor	4	A value when multiplied by the number of inputs for the trial represents the maximum number of processing elements for a hidden layer.
ExhaustiveTopologyComplexityLimit	10000	For topology evolution the maximum number of weights allowed before termination and carrying forward of that topology as best.
ExhaustiveActivationFunctionExplorationEpochs	3	The number of epochs to be trained to evaluate then select an Activation Function.
ExhaustiveTopologyExplorationEpochs	3	The number of epochs to be trained to evaluate then evolve further a topology.
ExhaustiveTopologyFinalisationEpochs	20	With topology selected, the number of epochs to create a final model for testing.
ExhaustiveSimulationsCount	100	The number of random simulations to be processed through the final model for the purpose of testing and creation of description statistics for the positive class. Often known as Monte Carlo Model Simulation.
CallbackTimeout	1000	The time in milliseconds before callbacks ready for collection via HTTP are to be removed. Callbacks are only created if HTTP model invocation has been called using the async switch.
StreamingActivationWatcher	True	The default behaviour for the Activation Watcher streaming, in the absence of AMQP having been enabled, is via database streaming notifications. When false indicates that the database ActivationWatcher table, given also ActivationWatcherAllowPersist, should be polled for Watcher messages rather than subscribing to database streaming notifications. Given streaming notifications the message is dispatched to the notification service in the database synchronously. A typical connection string is of the form: HOST_NAME:PORT_NUMBER,password=PASSWORD where HOST_NAME is the host name of your server (e.g. localhost), PORT_NUMBER is the port number Redis is listening on (e.g. 6379) and PASSWORD is your redis server’s password (e.g. secret_password).
WaitPollFromActivationWatcherTable	5000	In the event that of StreamingActivationWatcher and ActivationWatcherAllowPersist the polling interval to relay messaged from the ActivationWatcher database table to the watcher user interface page.
WaitTtlCounterDecrement	1000	In the event of TTLCounter being enabled to signify that the server should be responsible to decrementing TTL counter entries, the wait interval between decrement jobs in milliseconds
RedisConnectionString	localhost	The server or IP address of he Redis cluster in the connection string format supported by the c# Redis client NRedisStack and StackExchange.Redis.
RedisCommandFlag	0	A command that controls the Redis client, pipeline and quorum. PreferMaster=0; 2=FireAndForget;4-DemandMaster; 8=PreferSlave; DemandSlave=12; NoRedirect=64; NoScriptCache=512.
CachePruneServer	True	A flag indicating if this instance is responsible for processing the Time To Live (TTL) deletion in both the Redis or Postgres Database cache.
WaitCachePrune	10000	The time in milliseconds between the cache being pruned for expired payload and latest entries.
Landlord	True	A boolean flag to support multi tenancy administration in the user interface. Landord is configured for the default administrator user only on installation. Landlord permissions are allocated in the Tenant Registry, where a tenant is taken to be super user.
Log4NetConfigFileLocationName	null	Will fall back to programmatic instantiation if unavailable. The XML configuration file allowing for advanced configuration and instantiation of the log4net logging library. This is helpful in the case of configuration of remote logging such as syslog. In the case of the RollingFileAppender all necessary settings are otherwise available via dedicated Environment Variables as follows.
Log4NetLogPath	null	Will fall back to the binary directory as target for logs, which is far from ideal and may not work in containers. The file path to write and rotate log files to, given the absence of the Log4NetConfigFileLocationName environment variable
Log4NetLogMaximumFileSize	500MB	The maximum file size before the logs get rotated to new files, given the absence of the Log4NetConfigFileLocationName environment variable
Log4NetLogMaxSizeRollBackups	100	The maximum number of files to write before they are purged, given the absence of the Log4NetConfigFileLocationName environment variable
Log4NetLogLevel	WARN	The logging level to write log events out, given the absence of the Log4NetConfigFileLocationName environment variable
PreservationSalt	null	For the import and export of definition an environment specific salting value in keeping with the downloaded file bytes encryption scheme
LocalCache	True	To enable the local Least Recently Used (LRU) Cache for payload data in the Jube instance
LocalCacheFill	True	To enable a fill of the local LRU cache from Redis on the startup of the Jube instance based on the most recently used LruJournal keys in Redis, returning at the point the LRU Cache is at capacity as specified in the LocalCacheBytes Environment Variable. Requires LocalCache environment variable to be True.
LocalCacheBytes	1073741824	The maximum size of the local LRU cache before evictions.
RedisMessagePackCompression	True	To enable LZ4BlockArray compression for message pack serialization of Payload data.
RedisStorePayloadCountsAndBytes	False	To enable the informational storage of Payload data counts and bytes for visibility into model usage of Redis. Defaulted off this branch to reduce noise - only useful for multi-tenancy, and even then not always.
RedisPublishSubscribeEvents	False	To enable to publish\subscribe events of updates to the local LRU cache for clustered instances of Jube.
SearchKeyCacheServerIntervalType	h	The interval type for the launching of the search key cache calculation job. Accepted values: n (minutes), h (hours), d (days), m (months) - any other value is treated as d. Note n, not m, is minutes; m is reserved for months.
SearchKeyCacheServerIntervalValue	1	The interval value for the launching of the search key cache calculations job.
AMQPHeartbeatSeconds	30	The time in seconds to for the AMQP client to send heartbeats to the server to avoid the connection being closed.
CaseCreationThreads	4	The number of background thread responsible for the expensive case creation and upward classification processing.
MaxInvokeControllerRequestBytes	4000	The maximum number of bytes that can be JSON parsed for the invocation pipeline, beyond which an exception will be thrown.
PartialResponseMessageSerialisation	True	When true, only return elements in the response payload on the basis of ResponsePayload switch being true in varius model entities, otherwise return the same comprehensive payload as stored in the Archive table. Disabling PartialResponseMessageSerialisation is useful when developing configurations where testing needs total visibility of invocation context payload.
RedisBackplane	True	In a load balanced environment the preference is not to use server affinity for the user interface, but this cases breakage in the Activation Watcher page. In the absence of server affinity Redis can be used as a backplane such that the connection does not need to be stateful.
DataProtectionRedisBackplane	False	In a load balanced environment ASP.NET Core Data Protection keys (e.g. cookie encryption) must be shared across nodes. When enabled, the Data Protection key ring is persisted to Redis using the RedisConnectionString rather than the local file system, so nodes share a consistent application name and key ring.
SecretsPath	null	The file system path to look up secrets, where the file name is the key and the trimmed contents of the file is the value. This has special compatibility with Docker Secrets. If not provided, defaults to the application’s working directory. Secrets are only tokenised where the [@Key@] pattern exists inside the Environment Variable string.
JempFileLegacyEncryptionFallback	True	Preservation (.jemp) export files are AES encrypted with a random Initialisation Vector (IV) per file. Files exported before this hardening used a fixed IV, which is a weaker scheme. When True, import falls back to the legacy fixed-IV scheme if random-IV decryption fails, so older exports remain importable. Set to False once no legacy exports remain in use to remove the fallback attempt entirely.
ApiHmacKey	null	The HMAC-SHA256 secret used to sign and verify UserRegistryApiKey API keys (Base62-encoded, versioned payload). Must be set to a strong, unique, per-environment value before issuing API keys. Changing this value invalidates every API key issued under the old value immediately and with no overlap window - there is no dual-key transition support, so rotating it is an all-keys-dead-at-once event, not a graceful rollover. Plan API key reissuance for every integration before rotating this in a live environment.
RedisHsetOffloadToPostgres	False	When True, Redis HSET-shaped cache writes (see Cache Concepts) are instead served from a Postgres CacheSetHash table, using a covering index over Key, Field and each of the typed value columns to avoid heap access. This may outperform Redis for this access pattern on server-grade Postgres hardware, at the cost of moving load onto the primary database rather than Redis.
SecureHttpCookie	False	A boolean value to mark the authentication cookie as Secure, meaning the browser will only transmit it over HTTPS. Should be True for any environment served over HTTPS, which should be all environments other than local development.
ElementSymmetricEncryptionKey	SuperSecretEncryptionKeyGoesHere	The symmetric key used by the AES string encryption helper available to Inline Scripts, for encrypting individual payload elements at the point of use (for example, before writing a value to a Search Key). NOTE: this ships with a well-known placeholder default - it must be changed to a securely generated, per-environment value before any Inline Script relies on it, otherwise encrypted values are trivially reversible by anyone with a copy of this documentation.
ParserAssertSelectOnly	True	A boolean value that, when True, enforces the SQL soft parser’s SELECT-only validation across every dynamic SQL execution path (Case Search, Exhaustive configuration, saved case searches, and so on). Setting this to False bypasses that validation and exists only to make certain test scenarios easier to construct. Must be True for every production workload - see Software Validations.
EnableMultifactorAuthentication	False	A boolean value to enable RSA SecurID-led Multi-Factor Authentication (MFA) as a second authentication step, enforced regardless of whether the first step was Negotiate or Username and Password authentication. Not applicable to OAuth sign-in, which is assumed to always offload MFA to the identity provider itself.
MultifactorAuthenticationEndpoint	http://localhost:5001/api/mfa	The RSA Authentication Manager (SecurID) endpoint used to validate the one-time passcode. Points at the bundled mock endpoint by default (accepts only the OTP value 123456), for environments without access to a real RSA sandbox.
MultifactorAuthenticationApplicationId	MyApplicationGuidOrSomeSuch	The application identifier RSA Authentication Manager was configured with for this integration. Replace with the real application identifier issued for your RSA Authentication Manager tenant.
MultifactorAuthenticationClientKey	SomethingSecretForTheClientKeyHeader	A shared secret sent as a client-key header on every request to MultifactorAuthenticationEndpoint. Replace with a securely generated value shared with the RSA Authentication Manager deployment; the placeholder default must not reach production.
PasswordAttempts	3	The number of consecutive incorrect password attempts allowed before the user account is locked out.
CacheTtlDeleteLimit	1000	The per-cycle deletion batch limit (a SQL/sorted-set range LIMIT, not a Redis HSCAN) for the general cache-prune background task that removes reference-date-expired entries from the Payload and Payload-Latest caches, so a large expired backlog drains over several bounded passes rather than being loaded into memory in one operation. Despite the name, this is not specific to TTL Counters - see TtlCounterEntryDeleteLimit below for that.
TtlCounterEntryDeleteLimit	1000	The maximum number of expired TTL Counter entries processed per administration cycle, so a large backlog drains over several cycles rather than flooding a single concurrent-task burst. This is the TTL-Counter-specific equivalent of CacheTtlDeleteLimit above, and is a separate setting.
PasswordAsymmetricEncryption	False	A boolean value to enable RSA asymmetric encryption of the password field in transit, on top of the existing SHA-256 wire hash (see WirePasswordHash below). When True, the browser encrypts the password with PasswordAsymmetricEncryptionPublicKey before sending it, and the server decrypts it with PasswordAsymmetricEncryptionPrivateKey. Jube refuses to start with this set to True unless both key Environment Variables below are also explicitly set - see PasswordAsymmetricEncryptionPrivateKey.
PasswordAsymmetricEncryptionPrivateKey	null	The Base64-encoded PEM private key used to decrypt the password field when PasswordAsymmetricEncryption is True. Generate a fresh, per-environment RSA keypair for this - Jube validates at startup that this and PasswordAsymmetricEncryptionPublicKey are both set whenever PasswordAsymmetricEncryption is True, and refuses to start otherwise, so a shared or default keypair can no longer be used by omission.
PasswordAsymmetricEncryptionPublicKey	null	The Base64-encoded PEM public key the browser encrypts the password with. See PasswordAsymmetricEncryptionPrivateKey - both must be set together, and Jube will not start with PasswordAsymmetricEncryption True and either one missing.
SessionCookie	True	A boolean value to control whether the authentication cookie is a session cookie. When True, the cookie is not persisted and the user is signed out when the browser is closed; when False, the cookie persists per its normal expiry regardless of the browser closing.
AssumeLocalDateInPayloadExtraction	True	A boolean value controlling how dates without explicit timezone information, extracted during payload extraction (Request XPath, Inline Functions, Inline Scripts), are interpreted. When True they are assumed to be in the server’s local time and converted to UTC accordingly; when False they are assumed to already be UTC. Set to match the timezone convention of the systems sending transactions to Jube.
ActivationRuleIdempotency	False	A boolean value to enable idempotency guarantees on Activation Rules - TTL Counter increments, Case Creation and Notification dispatch are each applied at most once per transaction lifecycle, even under reprocessing or retry. Idempotency records are only written to Redis when this is True, so leave it False in memory-constrained deployments that do not use Reprocessing, to avoid the extra Redis writes. Idempotency Set keys in Redis have no TTL of their own and are only removed when the underlying transaction’s payload is deleted, so enabling this on a deployment that never deletes/expires payloads will accumulate idempotency keys for as long as the payload itself is retained.
LruJournalMaxAgeInterval	h	The interval unit for how long an entry may remain in the LruJournal Redis sorted set - used only to prime the local LRU cache on startup (LocalCacheFill) - before a background task prunes it. Paired with LruJournalMaxAgeValue below. Accepted values: n (minutes), h (hours) - any other value, including d, is treated as days. Similar to, but not identical to, SearchKeyCacheServerIntervalType above - this one has no dedicated m (months) case.
LruJournalMaxAgeValue	1	The interval value paired with LruJournalMaxAgeInterval, e.g. 1 and h together mean entries older than one hour are pruned.
WaitLruJournalPrune	10000	The interval in milliseconds between background LruJournal pruning cycles, which evict entries older than LruJournalMaxAgeInterval/LruJournalMaxAgeValue. The same age check also runs a second time during cache warming itself, so a slow prune cycle cannot cause a stale entry to be used to prime the cache.
WaitHashCacheAssemblyObservability	60000	The interval in milliseconds between snapshots of the compiled rule assembly cache (HashCacheAssembly) to the HashCacheAssemblyInstance/HashCacheAssemblyInstanceJournal/HashCacheAssemblyInstanceEntry tables - see Rule Compilation Algorithm.
SMTPUseDefaultCredentials	False	A boolean value to indicate that the SMTP client should use the process’s default network credentials rather than SMTPUser/SMTPPassword. Useful where the SMTP relay trusts the sending host/network rather than requiring explicit credentials.
SMTPEnableSsl	True	A boolean value to indicate that the SMTP client should negotiate SSL/TLS with the SMTP server.
OutboundHttpRsaAmCertificateBypass	False	A boolean value to bypass all TLS certificate validation for outbound HTTP requests to the RSA Authentication Manager MFA endpoint. Intended for sandbox/UAT RSA deployments behind a self-signed or otherwise unverifiable certificate chain. Do not enable in production - prefer OutboundHttpRsaAmCertificateThumbprint below, which trusts one specific certificate rather than disabling validation entirely. Currently implemented for the RSA token endpoint only.
OutboundHttpRsaAmCertificateThumbprint	null	A SHA1 certificate thumbprint to explicitly trust for outbound HTTP requests to the RSA Authentication Manager MFA endpoint, for chains that do not terminate at a verifiable root but where disabling validation entirely (OutboundHttpRsaAmCertificateBypass) is not acceptable. Scoped to the RSA MFA client only (Jube.Mfa/Mfa.cs) - not applied to HTTP Adaptation or any other outbound webhook, each of which has its own independent, unrelated TLS handling.
OAuthAuthentication	False	A boolean value to enable OAuth 2.0 / OpenID Connect (authorization code flow with PKCE) as a third authentication scheme, alongside Username/Password and Negotiate. See Authentication Concepts. Mutually exclusive with NegotiateAuthentication - both cannot be True at once - and Username/Password authentication (including password changes) is disabled whenever either is True.
OAuthAuthority	null	The OpenID Connect authority (issuer) URL of the identity provider, used for OIDC discovery.
OAuthClientId	null	The OAuth client identifier registered with the identity provider for this Jube instance.
OAuthClientSecret	null	The OAuth client secret registered with the identity provider for this Jube instance.
OAuthForceRedirect	null	On conclusion of the full OAuth authentication the redirect url that will override anything passed for redirection.
OAuthForceGet	False	A boolean value to force the OAuth/OIDC callback to use GET/query-string responses instead of the default form_post response mode, for identity providers that require it.
SanctionsLevenshteinMaxDistanceRatio	0.3	The server-wide default for the maximum Levenshtein edit-distance-to-token-length ratio permitted for a sanctions token match, before per-model MaxDistanceRatio override. See Sanction Searching.
SanctionsLevenshteinMaxCoverageRatio	2.0	The server-wide default for the maximum coverage ratio permitted for a sanctions token match, before per-model MaxCoverageRatio override. See Sanction Searching.
UseForwardedHeaders	True	A boolean value to enable ASP.NET Core’s forwarded-headers middleware, transposing X-Forwarded-For/X-Forwarded-Proto headers from an upstream reverse proxy or load balancer onto the request context. Important for OAuth redirect URIs and remote-IP logging to be correct when Jube sits behind a proxy.

Environment Variables passed to Jube at startup will override the hardcoded defaults above. Environment Variables are not written to disk in any form, and their contents are available only in the Jube application’s memory and operating system session.

The Environment Variable string can be tokenised, and secrets can be swapped in from a file topology at a given path, where the file name is the key and the contents of the file is the value. This approach provides full compatibility with Docker Secrets, which mounts secrets as files using tmpfs (memory-mounted file system). For example, given the token [@RedisPassword@], a file called RedisPassword and the contents of that file being localhost, the Environment Variable may be passed as RedisConnectionString=[@RedisPassword@]. At startup the token is detected, extracted and replaced with the contents of the file RedisPassword mounted by Docker Secrets. Tokens that resolve are replaced in place; those that do not are left unchanged and an error is written to STDOUT. This approach ensures that only genuinely secret information is stored in Docker Secrets, with more verbose Environment Variable strings being safe to live outside declared secrets, allowing for clearer intent and greater maintainability. Secrets are processed at startup and before logging, with any errors written to STDOUT rather than the logging library.

This mechanism is entirely free-form: there is no fixed or hardcoded list of recognised token names anywhere in Jube. Any Environment Variable’s string value is scanned for the [@...@] pattern, and whatever name appears between the brackets is looked up directly as a file name under SecretsPath - the token name and the Environment Variable it appears in are otherwise unrelated to each other and to any specific secret Jube ships with. Naming a new secret file and referencing it as [@ThatFileName@] from any Environment Variable is enough to wire it in; no code change is needed to add support for a new token.