# Server configuration The LXD server can be configured through a set of key/value configuration options. The key/value configuration is namespaced. The following options are available: - [Core configuration](#server-options-core) - [ACME configuration](#server-options-acme) - [OpenID Connect configuration](#server-options-oidc) - [Cluster configuration](#server-options-cluster) - [Images configuration](#server-options-images) - [Loki configuration](#server-options-loki) - [Miscellaneous options](#server-options-misc) See [How to configure the LXD server](https://canonical.com/lxd/docs/default/howto/server_configure/index.html.md#server-configure) for instructions on how to set the configuration options. #### NOTE Options marked with a `global` scope are immediately applied to all cluster members. Options with a `local` scope must be set on a per-member basis. ## Core configuration The following server options control the core daemon configuration: `core.bgp_address` Address to bind the BGP server to [](#server-core:core.bgp_address) | **Key:** | `core.bgp_address` | |-------------|----------------------| | **Type:** | string | | **Scope:** | local | See [How to configure LXD as a BGP server](https://canonical.com/lxd/docs/default/howto/network_bgp/index.html.md#network-bgp). `core.bgp_asn` BGP Autonomous System Number for the local server [](#server-core:core.bgp_asn) | **Key:** | `core.bgp_asn` | |--------------|------------------| | **Type:** | string | | **Default:** | `0` | | **Scope:** | global | `core.bgp_routerid` A unique identifier for the BGP server [](#server-core:core.bgp_routerid) | **Key:** | `core.bgp_routerid` | |-------------|-----------------------| | **Type:** | string | | **Scope:** | local | The identifier must be formatted as an IPv4 address. `core.debug_address` Address to bind the [`pprof`](https://pkg.go.dev/net/http/pprof) debug server to (HTTP) [](#server-core:core.debug_address) | **Key:** | `core.debug_address` | |-------------|------------------------| | **Type:** | string | | **Scope:** | local | `core.dns_address` Address to bind the authoritative DNS server to [](#server-core:core.dns_address) | **Key:** | `core.dns_address` | |-------------|----------------------| | **Type:** | string | | **Scope:** | local | See [Enable the built-in DNS server](https://canonical.com/lxd/docs/default/howto/network_zones/index.html.md#network-dns-server). `core.https_address` Address to bind for the remote API (HTTPS) [](#server-core:core.https_address) | **Key:** | `core.https_address` | |-------------|------------------------| | **Type:** | string | | **Scope:** | local | See [How to expose LXD to the network](https://canonical.com/lxd/docs/default/howto/server_expose/index.html.md#server-expose). `core.https_allowed_credentials` Whether to set `Access-Control-Allow-Credentials` [](#server-core:core.https_allowed_credentials) | **Key:** | `core.https_allowed_credentials` | |--------------|------------------------------------| | **Type:** | bool | | **Default:** | `false` | | **Scope:** | global | If enabled, the `Access-Control-Allow-Credentials` HTTP header value is set to `true`. `core.https_allowed_headers` `Access-Control-Allow-Headers` HTTP header value [](#server-core:core.https_allowed_headers) | **Key:** | `core.https_allowed_headers` | |-------------|--------------------------------| | **Type:** | string | | **Scope:** | global | `core.https_allowed_methods` `Access-Control-Allow-Methods` HTTP header value [](#server-core:core.https_allowed_methods) | **Key:** | `core.https_allowed_methods` | |-------------|--------------------------------| | **Type:** | string | | **Scope:** | global | `core.https_allowed_origin` `Access-Control-Allow-Origin` HTTP header value [](#server-core:core.https_allowed_origin) | **Key:** | `core.https_allowed_origin` | |-------------|-------------------------------| | **Type:** | string | | **Scope:** | global | `core.https_trusted_proxy` Trusted servers to provide the client’s address via the PROXY protocol [](#server-core:core.https_trusted_proxy) | **Key:** | `core.https_trusted_proxy` | |-------------|------------------------------| | **Type:** | string | | **Scope:** | global | Specify a comma-separated list of IP addresses of trusted servers that provide the client’s address through the PROXY protocol connection header. `core.metrics_address` Address to bind the metrics server to (HTTPS) [](#server-core:core.metrics_address) | **Key:** | `core.metrics_address` | |-------------|--------------------------| | **Type:** | string | | **Scope:** | local | See [How to monitor metrics](https://canonical.com/lxd/docs/default/metrics/index.html.md#metrics). `core.metrics_authentication` Whether to enforce authentication on the metrics endpoint [](#server-core:core.metrics_authentication) | **Key:** | `core.metrics_authentication` | |--------------|---------------------------------| | **Type:** | bool | | **Default:** | `true` | | **Scope:** | global | `core.proxy_http` HTTP proxy to use [](#server-core:core.proxy_http) | **Key:** | `core.proxy_http` | |-------------|---------------------| | **Type:** | string | | **Scope:** | global | If this option is not specified, LXD falls back to the `HTTP_PROXY` environment variable (if set). `core.proxy_https` HTTPS proxy to use [](#server-core:core.proxy_https) | **Key:** | `core.proxy_https` | |-------------|----------------------| | **Type:** | string | | **Scope:** | global | If this option is not specified, LXD falls back to the `HTTPS_PROXY` environment variable (if set). `core.proxy_ignore_hosts` Hosts that don’t need the proxy [](#server-core:core.proxy_ignore_hosts) | **Key:** | `core.proxy_ignore_hosts` | |-------------|-----------------------------| | **Type:** | string | | **Scope:** | global | Specify this option in a similar format to `NO_PROXY` (for example, `1.2.3.4,1.2.3.5`) If this option is not specified, LXD falls back to the `NO_PROXY` environment variable (if set). `core.remote_token_expiry` Time after which a remote add token expires [](#server-core:core.remote_token_expiry) | **Key:** | `core.remote_token_expiry` | |--------------|------------------------------| | **Type:** | string | | **Default:** | `15d` | | **Scope:** | global | `core.shutdown_timeout` How long to wait before shutdown [](#server-core:core.shutdown_timeout) | **Key:** | `core.shutdown_timeout` | |--------------|---------------------------| | **Type:** | integer | | **Default:** | `5` | | **Scope:** | global | Specify the number of minutes to wait for running operations to complete before the LXD server shuts down. `core.storage_buckets_address` Address to bind the storage object server to (HTTPS) [](#server-core:core.storage_buckets_address) | **Key:** | `core.storage_buckets_address` | |-------------|----------------------------------| | **Type:** | string | | **Scope:** | local | See [How to manage storage buckets](https://canonical.com/lxd/docs/default/howto/storage_buckets/index.html.md#howto-storage-buckets). `core.syslog_socket` Whether to enable the syslog unixgram socket listener [](#server-core:core.syslog_socket) | **Key:** | `core.syslog_socket` | |--------------|------------------------| | **Type:** | bool | | **Default:** | `false` | | **Scope:** | local | Set this option to `true` to enable the syslog unixgram socket to receive log messages from external processes. `core.trust_ca_certificates` Whether to automatically trust clients signed by the CA [](#server-core:core.trust_ca_certificates) | **Key:** | `core.trust_ca_certificates` | |--------------|--------------------------------| | **Type:** | bool | | **Default:** | `false` | | **Scope:** | global | `core.trust_password` Password to be provided by clients to set up a trust [](#server-core:core.trust_password) | **Key:** | `core.trust_password` | |-------------|-------------------------| | **Type:** | string | | **Scope:** | global | ## ACME configuration The following server options control the [ACME](https://canonical.com/lxd/docs/default/authentication/index.html.md#authentication-server-certificate) configuration: `acme.agree_tos` Agree to ACME terms of service [](#server-acme:acme.agree_tos) | **Key:** | `acme.agree_tos` | |--------------|--------------------| | **Type:** | bool | | **Default:** | `false` | | **Scope:** | global | `acme.ca_url` URL to the directory resource of the ACME service [](#server-acme:acme.ca_url) | **Key:** | `acme.ca_url` | |--------------|--------------------------------------------------| | **Type:** | string | | **Default:** | `https://acme-v02.api.letsencrypt.org/directory` | | **Scope:** | global | `acme.domain` Domain for which the certificate is issued [](#server-acme:acme.domain) | **Key:** | `acme.domain` | |-------------|-----------------| | **Type:** | string | | **Scope:** | global | `acme.email` Email address used for the account registration [](#server-acme:acme.email) | **Key:** | `acme.email` | |-------------|----------------| | **Type:** | string | | **Scope:** | global | ## OpenID Connect configuration The following server options configure external user authentication through [OpenID Connect authentication](https://canonical.com/lxd/docs/default/authentication/index.html.md#authentication-openid): `oidc.audience` Expected audience value for the application [](#server-oidc:oidc.audience) | **Key:** | `oidc.audience` | |-------------|-------------------| | **Type:** | string | | **Scope:** | global | This value is required by some providers. `oidc.client.id` OpenID Connect client ID [](#server-oidc:oidc.client.id) | **Key:** | `oidc.client.id` | |-------------|--------------------| | **Type:** | string | | **Scope:** | global | `oidc.client.secret` OpenID Connect client secret [](#server-oidc:oidc.client.secret) | **Key:** | `oidc.client.secret` | |-------------|------------------------| | **Type:** | string | | **Scope:** | global | `oidc.groups.claim` A claim used for mapping identity provider groups to LXD groups. [](#server-oidc:oidc.groups.claim) | **Key:** | `oidc.groups.claim` | |-------------|-----------------------| | **Type:** | string | | **Scope:** | global | Specify a custom token claim to denote groups defined at the identity provider. The contents of this claim can be mapped to LXD groups for managing access control. The value of the claim is expected to be a JSON string array. `oidc.issuer` OpenID Connect Discovery URL for the provider [](#server-oidc:oidc.issuer) | **Key:** | `oidc.issuer` | |-------------|-----------------| | **Type:** | string | | **Scope:** | global | `oidc.scopes` Space-separated list of OpenID Connect scopes [](#server-oidc:oidc.scopes) | **Key:** | `oidc.scopes` | |--------------|---------------------------------------| | **Type:** | space-delimited string | | **Default:** | `openid email offline_access profile` | | **Scope:** | global | A list of OpenID Connect scopes to request from the identity provider. This must include the `openid` and `email` scopes. The remaining optional scopes are `offline_access` and `profile`. If you remove the `offline_access` scope, users might be required to log in more frequently. If you remove the `profile` scope, user information may not be displayed in LXD UI (or in `lxc auth identity` commands). You may add additional scopes if this is required by your identity provider, or if necessary for configuration of [identity provider groups](https://canonical.com/lxd/docs/default/explanation/authorization/index.html.md#identity-provider-groups). #### IMPORTANT Setting `oidc.client.secret` may prevent CLI clients from authenticating depending on the Identity Provider policies. Set this key only if required by the Identity Provider. ## Cluster configuration The following server options control [Clustering](https://canonical.com/lxd/docs/default/clustering/index.html.md#clustering): `cluster.healing_threshold` Threshold when to evacuate an offline cluster member [](#server-cluster:cluster.healing_threshold) | **Key:** | `cluster.healing_threshold` | |--------------|-------------------------------| | **Type:** | integer | | **Default:** | `0` | | **Scope:** | global | Specify the number of seconds after which an offline cluster member is to be evacuated. To disable evacuating offline members, set this option to `0`. `cluster.https_address` Address to use for clustering traffic [](#server-cluster:cluster.https_address) | **Key:** | `cluster.https_address` | |-------------|---------------------------| | **Type:** | string | | **Scope:** | local | See [Separate REST API and clustering networks](https://canonical.com/lxd/docs/default/howto/cluster_config_networks/index.html.md#cluster-https-address). `cluster.images_minimal_replica` Number of cluster members that replicate an image [](#server-cluster:cluster.images_minimal_replica) | **Key:** | `cluster.images_minimal_replica` | |--------------|------------------------------------| | **Type:** | integer | | **Default:** | `3` | | **Scope:** | global | Specify the minimal number of cluster members that keep a copy of a particular image. Set this option to `1` for no replication, or to `-1` to replicate images on all members. `cluster.join_token_expiry` Time after which a cluster join token expires [](#server-cluster:cluster.join_token_expiry) | **Key:** | `cluster.join_token_expiry` | |--------------|-------------------------------| | **Type:** | string | | **Default:** | `3H` | | **Scope:** | global | `cluster.max_standby` Number of database stand-by members [](#server-cluster:cluster.max_standby) | **Key:** | `cluster.max_standby` | |--------------|-------------------------| | **Type:** | integer | | **Default:** | `2` | | **Scope:** | global | Specify the maximum number of cluster members that are assigned the database stand-by role. This must be a number between `0` and `5`. `cluster.max_voters` Number of database voter members [](#server-cluster:cluster.max_voters) | **Key:** | `cluster.max_voters` | |--------------|------------------------| | **Type:** | integer | | **Default:** | `3` | | **Scope:** | global | Specify the maximum number of cluster members that are assigned the database voter role. This must be an odd number >= `3`. `cluster.offline_threshold` Threshold when an unresponsive member is considered offline [](#server-cluster:cluster.offline_threshold) | **Key:** | `cluster.offline_threshold` | |--------------|-------------------------------| | **Type:** | integer | | **Default:** | `20` | | **Scope:** | global | Specify the number of seconds after which an unresponsive member is considered offline. ## Images configuration The following server options configure how to handle [Images](https://canonical.com/lxd/docs/default/images/index.html.md#images): `images.auto_update_cached` Whether to automatically update cached images [](#server-images:images.auto_update_cached) | **Key:** | `images.auto_update_cached` | |--------------|-------------------------------| | **Type:** | bool | | **Default:** | `true` | | **Scope:** | global | `images.auto_update_interval` Interval at which to look for updates to cached images [](#server-images:images.auto_update_interval) | **Key:** | `images.auto_update_interval` | |--------------|---------------------------------| | **Type:** | integer | | **Default:** | `6` | | **Scope:** | global | Specify the interval in hours. To disable looking for updates to cached images, set this option to `0`. `images.compression_algorithm` Compression algorithm to use for new images [](#server-images:images.compression_algorithm) | **Key:** | `images.compression_algorithm` | |--------------|----------------------------------| | **Type:** | string | | **Default:** | `gzip` | | **Scope:** | global | Possible values are `bzip2`, `gzip`, `lzma`, `xz`, or `none`. `images.default_architecture` Default architecture to use in a mixed-architecture cluster [](#server-images:images.default_architecture) | **Key:** | `images.default_architecture` | |-------------|---------------------------------| | **Type:** | string | `images.remote_cache_expiry` When an unused cached remote image is flushed [](#server-images:images.remote_cache_expiry) | **Key:** | `images.remote_cache_expiry` | |--------------|--------------------------------| | **Type:** | integer | | **Default:** | `10` | | **Scope:** | global | Specify the number of days after which the unused cached image expires. ## Loki configuration The following server options configure the external log aggregation system: `loki.api.ca_cert` CA certificate for the Loki server [](#server-loki:loki.api.ca_cert) | **Key:** | `loki.api.ca_cert` | |-------------|----------------------| | **Type:** | string | | **Scope:** | global | `loki.api.url` URL to the Loki server [](#server-loki:loki.api.url) | **Key:** | `loki.api.url` | |-------------|------------------| | **Type:** | string | | **Scope:** | global | Specify the protocol, name or IP and port. For example `https://loki.example.com:3100`. LXD will automatically add the `/loki/api/v1/push` suffix so there’s no need to add it here. `loki.auth.password` Password used for Loki authentication [](#server-loki:loki.auth.password) | **Key:** | `loki.auth.password` | |-------------|------------------------| | **Type:** | string | | **Scope:** | global | `loki.auth.username` User name used for Loki authentication [](#server-loki:loki.auth.username) | **Key:** | `loki.auth.username` | |-------------|------------------------| | **Type:** | string | | **Scope:** | global | `loki.instance` Name to use as the instance field in Loki events. [](#server-loki:loki.instance) | **Key:** | `loki.instance` | |--------------|-----------------------------------------------| | **Type:** | string | | **Default:** | Local server host name or cluster member name | | **Scope:** | global | This allows replacing the default instance value (server host name) by a more relevant value like a cluster identifier. `loki.labels` Labels for a Loki log entry [](#server-loki:loki.labels) | **Key:** | `loki.labels` | |-------------|-----------------| | **Type:** | string | | **Scope:** | global | Specify a comma-separated list of values that should be used as labels for a Loki log entry. `loki.loglevel` Minimum log level to send to the Loki server [](#server-loki:loki.loglevel) | **Key:** | `loki.loglevel` | |--------------|-------------------| | **Type:** | string | | **Default:** | `info` | | **Scope:** | global | `loki.types` Events to send to the Loki server [](#server-loki:loki.types) | **Key:** | `loki.types` | |--------------|---------------------| | **Type:** | string | | **Default:** | `lifecycle,logging` | | **Scope:** | global | Specify a comma-separated list of events to send to the Loki server. The events can be any combination of `lifecycle`, `logging`, and `ovn`. ## Miscellaneous options The following server options configure server-specific settings for [Instances](https://canonical.com/lxd/docs/default/instances/index.html.md#instances), MAAS integration, [OVN](https://canonical.com/lxd/docs/default/reference/network_ovn/index.html.md#network-ovn) integration, [Backups](https://canonical.com/lxd/docs/default/backup/index.html.md#backups) and [Storage](https://canonical.com/lxd/docs/default/storage/index.html.md#storage): `backups.compression_algorithm` Compression algorithm to use for backups [](#server-miscellaneous:backups.compression_algorithm) | **Key:** | `backups.compression_algorithm` | |--------------|-----------------------------------| | **Type:** | string | | **Default:** | `gzip` | | **Scope:** | global | Possible values are `bzip2`, `gzip`, `lzma`, `xz`, or `none`. `instances.migration.stateful` Whether to set `migration.stateful` to `true` for the instances [](#server-miscellaneous:instances.migration.stateful) | **Key:** | `instances.migration.stateful` | |--------------|----------------------------------| | **Type:** | bool | | **Default:** | `false` | | **Scope:** | global | You can override this setting for relevant instances, either in the instance-specific configuration or through a profile. `instances.nic.host_name` How to set the host name for a NIC [](#server-miscellaneous:instances.nic.host_name) | **Key:** | `instances.nic.host_name` | |--------------|-----------------------------| | **Type:** | string | | **Default:** | `random` | | **Scope:** | global | Possible values are `random` and `mac`. If set to `random`, use the random host interface name as the host name. If set to `mac`, generate a host name in the form `lxd` (MAC without leading two digits). `instances.placement.scriptlet` Instance placement scriptlet for automatic instance placement [](#server-miscellaneous:instances.placement.scriptlet) | **Key:** | `instances.placement.scriptlet` | |-------------|-----------------------------------| | **Type:** | string | | **Scope:** | global | When using custom automatic instance placement logic, this option stores the scriptlet. See [Instance placement scriptlet](https://canonical.com/lxd/docs/default/explanation/clusters/index.html.md#clustering-instance-placement-scriptlet) for more information. `maas.api.key` API key to manage MAAS [](#server-miscellaneous:maas.api.key) | **Key:** | `maas.api.key` | |-------------|------------------| | **Type:** | string | | **Scope:** | global | `maas.api.url` URL of the MAAS server [](#server-miscellaneous:maas.api.url) | **Key:** | `maas.api.url` | |-------------|------------------| | **Type:** | string | | **Scope:** | global | `maas.machine` Name of this LXD host in MAAS [](#server-miscellaneous:maas.machine) | **Key:** | `maas.machine` | |--------------|------------------| | **Type:** | string | | **Default:** | host name | | **Scope:** | local | `network.ovn.ca_cert` OVN SSL certificate authority [](#server-miscellaneous:network.ovn.ca_cert) | **Key:** | `network.ovn.ca_cert` | |--------------|--------------------------------------------------| | **Type:** | string | | **Default:** | Content of `/etc/ovn/ovn-central.crt` if present | | **Scope:** | global | `network.ovn.client_cert` OVN SSL client certificate [](#server-miscellaneous:network.ovn.client_cert) | **Key:** | `network.ovn.client_cert` | |--------------|--------------------------------------------| | **Type:** | string | | **Default:** | Content of `/etc/ovn/cert_host` if present | | **Scope:** | global | `network.ovn.client_key` OVN SSL client key [](#server-miscellaneous:network.ovn.client_key) | **Key:** | `network.ovn.client_key` | |--------------|-------------------------------------------| | **Type:** | string | | **Default:** | Content of `/etc/ovn/key_host` if present | | **Scope:** | global | `network.ovn.integration_bridge` OVS integration bridge to use for OVN networks [](#server-miscellaneous:network.ovn.integration_bridge) | **Key:** | `network.ovn.integration_bridge` | |--------------|------------------------------------| | **Type:** | string | | **Default:** | `br-int` | | **Scope:** | global | `network.ovn.northbound_connection` OVN northbound database connection string [](#server-miscellaneous:network.ovn.northbound_connection) | **Key:** | `network.ovn.northbound_connection` | |--------------|---------------------------------------| | **Type:** | string | | **Default:** | `unix:/var/run/ovn/ovnnb_db.sock` | | **Scope:** | global | `storage.backups_volume` Volume to use to store backup tarballs [](#server-miscellaneous:storage.backups_volume) | **Key:** | `storage.backups_volume` | |-------------|----------------------------| | **Type:** | string | | **Scope:** | local | Specify the volume using the syntax `POOL/VOLUME`. `storage.images_volume` Volume to use to store the image tarballs [](#server-miscellaneous:storage.images_volume) | **Key:** | `storage.images_volume` | |-------------|---------------------------| | **Type:** | string | | **Scope:** | local | Specify the volume using the syntax `POOL/VOLUME`. ## Related topics How-to guides: - [How to configure the LXD server](https://canonical.com/lxd/docs/default/howto/server_configure/index.html.md#server-configure)