Settings

Settings are where you tune Taranac’s behaviour after it is deployed. They live under the Settings group in the admin sidebar, plus a few per-subsystem settings pages reached from AAA and NAC. Everything is stored in one key/value store, so a value set in its home page and the same value seen in the catch-all “all settings” view are the same record — there is one source of truth per setting.

This page maps the settings surface: what each section controls, where the global defaults live, and how a handful of those defaults feed inheritance for the AAA/NAC subsystems.

settings · enable-mode inheritance

tacacs.global_enable_mode

1. User inherit ↓
2. Group inherit ↓
3. Profile inherit ↓
4. Global login_password ✓

effective login_password

Every setting is a typed key in dot-notation (smtp.host, tacacs.global_enable_mode, nac.coa_secret). Each carries a value type (string, int, bool, or json) and two flags that change how it behaves in the UI:

Property	Effect
Encrypted	Secrets (RADIUS/TACACS+ shared keys, LDAP bind passwords, SMTP password, CoA secret) are stored Fernet-encrypted. The UI masks them as •••••••• and only sends a new value when you actually change it.
Internal	Some keys are machine-managed and not shown in the UI at all (for example system.timezone, which is auto-detected from the host OS).

Most settings pages are self-saving: toggles and selects commit immediately, and text/number fields save on Enter or blur. Document-style pages (SMTP, SMS, LDAP, Backup) use a normal form with a Save button that sends only the fields you changed.

The Settings group is organised into a few areas. The table below is the map; each section is detailed afterwards.

Area	Page	Route	What it controls
System	General	/settings/general	Curated global parameters + a hidden “all settings” fallback
System	Workers	/settings/workers	Background scheduler jobs: enable/disable, intervals, run-now
System	Alerts	/settings/alerts	Resource/health alert engine and its email notifications
System	Log Rotation	/settings/log-rotation	Retention for AAA and audit logs (partitions / row deletes)
System	Backup	/settings/backup	KEK-encrypted config archives, schedule, retention
System	Crypto	/settings/crypto	Master key rotation (re-encrypts all stored secrets)
Integrations	LDAP	/settings/ldap	Directories (AD, OpenLDAP, FreeIPA, …), sync, EAP-TLS trust
Integrations	Email	/settings/email	SMTP transport, layout, templates, notification toggles
Integrations	MFA	/settings/mfa	Global MFA mode, providers, enrollment by group
Integrations	SMS · Syslog	/settings/sms, /settings/syslog	Guest-code SMS provider; syslog forwarding
Security	Authentication & Sessions	/settings/authentication	Password policy + session idle/warn timeouts
System	Licensing	/settings/license	Edition/entitlements, installation ID, upload a Pro .lic
System	Cluster	/settings/cluster	High-availability cluster status, nodes, join tokens (Pro)
AAA	TACACS+ / RADIUS	/aaa/settings/...	Per-subsystem daemon and protocol settings
NAC	NAC + PKI	/nac/settings, PKI	Endpoint lifecycle, CoA defaults, EST/PKI

General holds the genuinely global parameters that have no other natural home — things that affect the whole platform rather than one subsystem.

Setting	Default	Notes
system.timezone	host OS	Read-only; auto-detected from the host on every boot. Drives Time Range evaluation and timestamp display. Stored timestamps stay UTC.
system.default_locale	en	Default UI language for new users and for system emails sent without a user context (login screen, invites). One of the loaded locales (en, ru).
system.datetime_format	auto	Display format preset: auto (by locale), iso, dmy, mdy. Affects display only; storage stays UTC.
system.check_updates_enabled	true	Periodically checks the project releases for a newer version and shows admins a notice. Turn off in air-gapped environments to suppress all outbound update checks.
monitoring.collect_interval_seconds	60	How often system/AAA metrics are sampled.
monitoring.history_max_points	1440	Metric history buffer size (1440 = 24h at 60s).

Workers is the control panel for Taranac’s background scheduler (APScheduler). It lists every job, grouped by category (Config, Monitoring, Maintenance, Notifications, Identity, NAC, Captive Portal, PKI), and shows whether the scheduler is running.

Per job you get:

• Status — Active / Paused / Disabled.
• Pause / Resume — runtime only; resets on restart.
• Run Now — fire the job immediately.
• Enable / Disable — persisted, survives restart. Only available for toggleable jobs (those backed by an enable key). Always-on jobs (metric collection, token cleanup, log partitioning, PKI maintenance) have no toggle.
• Interval editor — inline edit for interval jobs (seconds/minutes/hours), respecting each job’s minimum. Cron jobs show their schedule as read-only text.

A single enable key can gate several jobs at once. For example, notifications.enabled controls both the notification worker and its cleanup job; alerts.enabled controls alert evaluation and resolved-alert cleanup. LDAP sync jobs are an exception — they are enabled from the LDAP config, not here.

Alerts configures the engine that watches resource and service health and opens/closes stateful alerts. It also drives the email notifications for those alerts. Settings split into three groups.

Engine

Setting	Default	Meaning
alerts.enabled	true	Master on/off for the whole engine.
alerts.eval_interval_seconds	—	How often thresholds are evaluated (min 10s).
alerts.sustained_minutes	—	A breach must persist this long before an alert opens (debounce).
alerts.resolved_retention_days	—	Delete resolved alerts after N days; 0 = keep forever.
alerts.event_ttl_minutes	—	Event-type alerts auto-resolve after this idle period.

Resource thresholds — warning and critical percentages for disk, CPU, memory and swap (0–100; 0 disables that threshold).

Notifications

Setting	Meaning
alerts.notify_email_enabled	Send alert emails at all.
alerts.notify_recipients	One address per line.
alerts.notify_min_severity	Minimum severity to notify on: info / warning / error / critical.
alerts.notify_on_resolve	Also email when an alert resolves.
alerts.email_failure_threshold	Open an alert after N consecutive SMTP failures.
alerts.repeat_*_minutes	Re-notify cadence for unacknowledged critical/error/warning alerts (0 = off).

The Alerts engine: thresholds, debounce and email notification settings on one page.

Log Rotation manages retention for the high-volume AAA logs and the audit log. Tables are grouped by domain (TACACS+, RADIUS, NAC, Captive Portal, Security, Identity). Two mechanisms are used:

• Partition — PostgreSQL monthly table partitioning (shows partition count, oldest/newest month, and what will be dropped next run).
• Row delete — approximate row count and oldest record.

Click a retention value to edit it inline; 0 means “keep forever”. Header actions let you Run partition job (pre-create upcoming monthly partitions) and Run cleanup (drop partitions/rows past retention) on demand. Audit-log archival (audit_log.archive_enabled, audit_log.archive_path) and audit retention (audit_log.retention_days) are configured here too.

Backup creates KEK-encrypted configuration archives. By design there is no restore button in the UI: recovery is CLI-only and destructive, and the page instead shows a step-by-step recovery guide.

Setting	Default	Meaning
schedule_enabled	—	Master toggle for automatic backups.
interval_hours	min 1	Hours between scheduled backups (only when scheduling is on).
retention_count	min 1	Maximum archives kept on disk; older ones are pruned. Applies to manual backups too.
include_certs	—	Pack the TLS certificate volume into the archive.
include_daemon_configs	—	Pack the generated TACACS+/RADIUS/NAC daemon config files.
include_host_files	—	Pack .env and the Docker Compose file (host secrets).

The database dump is always included. Each archive records its app_version and the key fingerprint used to encrypt it.

Backup & Recovery: schedule and retention, the archive list, and a CLI-only recovery guide.

LDAP configures the directories used for authentication and for synchronising users, groups and computers — Active Directory, OpenLDAP, FreeIPA, Google Workspace Secure LDAP or any other LDAP server. Each directory is a separate configuration card with Edit / Delete / Test Connection actions. Creating one starts with picking its type, which is permanent and decides both which tabs the configuration has and which authentication methods it can offer.

A config’s edit view spans up to five tabs:

• Users & Groups — servers, bind DN/password, search filters, sync schedule and behaviour (create users, disable missing, remove stale), priority for multi-domain ordering, and the RBAC model assigned to synced users (with optional per-group mapping).
• Computers — computer sync filters and attribute mapping, including the LDAP attribute holding the MAC address. Active Directory only.
• MS-CHAPv2 — domain membership for this node, so PEAP-MSCHAPv2 logins can be verified by a domain controller. Active Directory only.
• EAP-TLS — client-certificate validation for this directory: CA certificate, identity matching, and CRL/OCSP revocation checking.
• Sync History — past sync runs with counters and status.

Operations available inline: Test Connection, Sync Preview (a categorised diff before committing), and Trigger Sync.

The directory configurations on one installation — Active Directory, OpenLDAP and FreeIPA, each tagged with its type.

Email is a three-tab page plus the notification toggles.

• SMTP — transport: host/port, optional auth, encryption (None / STARTTLS / SSL-TLS), from-address and name, timeout. Two test actions verify a connection and send a test message.
• Header & Footer — a subject prefix (e.g. [Taranac]) and HTML header/footer wrapped around every template, with {{ app_name }} / {{ current_year }} variables and a live preview.
• Templates — per-type, per-language subject and HTML body, with preview and “reset to default”.
• Notifications — toggles for each kind of system email (email.welcome_enabled, email.password_reset_enabled, email.mfa_setup_link_enabled, the certificate-download email, and so on). These gate whether Taranac sends each notification at all.

The AAA (TACACS+, RADIUS) and NAC subsystems have their own settings pages. Most of those keys are protocol/daemon tuning, but a few act as global defaults that feed inheritance — the value used when a more specific level (User, Group, Profile, or Device) says “inherit”.

tacacs.global_enable_mode is the end of the enable-password inheritance chain. When a User, Group or Profile is set to inherit, the effective enable behaviour falls through to this global value.

Mode	Behaviour
login_password (default)	Use the user’s login credentials for enable.
custom	Use a separate password — tacacs.global_enable_password (encrypted), only consulted in this mode.
deny	Block enable outright.

Other global AAA defaults include the shared secrets (tacacs.global_key, radius.global_secret) used when a device does not define its own, the listener ports, brute-force protection, and per-subsystem log retention.

For NAC, the global Change-of-Authorization (CoA) defaults define how Taranac sends disconnect/re-auth requests to network devices when a device has no per-device override.

Setting	Default	Notes
nac.coa_port	3799	Default CoA port; a device can override it.
nac.coa_secret	auto-generated	Default CoA shared secret (encrypted), generated on first start. Override per device via the device’s coa_secret.
nac.default_auth_method	—	Default endpoint auth method when policy does not specify one.

These follow the same inheritance idea: set sensible global defaults once, then override only on the specific devices that differ.

You want to…	Go to
Change a value that has a named home	That subsystem’s page (Email, MFA, Alerts, AAA, NAC) — not the General “all settings” list
Tune how often a background job runs	Workers
Stop/start a recurring job permanently	Workers (enable/disable toggle)
Keep logs longer or shorter	Log Rotation
Set the org-wide enable-password fallback	AAA → TACACS+ (tacacs.global_enable_mode)
Set a default CoA secret for all NAC devices	NAC settings (nac.coa_secret)
Change the UI default language	General (system.default_locale)
Rotate the encryption master key	Crypto
Protect the configuration before a risky change	Backup → Create backup now

• Alerts — the alert engine and notifications in depth
• Backup & upgrades — archives and the recovery procedure
• TACACS+ and RADIUS — protocol settings and enable-mode inheritance
• NAC overview — endpoint lifecycle and CoA
• LDAP directories — directory integration and sync
• Licensing & editions — Community vs Pro, the installation ID and .lic upload
• High availability — the multi-node cluster the Cluster page manages
• Get Taranac on GitHub