Configuration

Overview

Each component has its own configuration file. The configuration of Riversoft® STCP DirectLink and of the management components is created from a template installed with the package:

Component	File	Template
Riversoft STCP Gemini API	`/usr/local/stcpgemini-api/configs/config.json`	`example-config.json`
Riversoft Console Portal	`/usr/local/stcpgemini-api/portal/app/configs/config.json`	`example-config.json`
Riversoft STCP DirectLink	`/usr/local/stcpdirectlink/configs/config.json`	`example-config.json`
Riversoft STCP DirectLink Portal	`/usr/local/stcpdirectlink/static/portal/assets/configs/config.json`	`example-config.json`

The parameters of each file are described in the Parameter reference.

Warning

The files contain database passwords, keys and secrets. Replace every sample value, restrict access to the service user and group, and do not version files that contain secrets.

Password encryption key

Passwords and other sensitive data stored in the configuration database (for example, the passwords of users, databases and supervision credentials) are encrypted. All modules that read or write this data must use the same key. Otherwise, a module cannot read the passwords stored by another one.

Module	File	Parameter
Riversoft STCP Gemini Server	`/usr/local/stcp/configs/stcpserver.config.json`	`ApplConfigPassPhrase` (`STCPCore` section)
Riversoft STCP DirectLink	`configs/config.json` of the installation	`applConfigPassPhrase`
Riversoft STCP Gemini Rename	`/usr/local/stcpren/configs/config.json`	`applConfigPassPhrase` (`General` section)
Riversoft STCP Gemini API	`/usr/local/stcpgemini-api/configs/config.json`	`api_secret` (`general` section)

    flowchart LR
    K[Same key] --> G[Gemini Server]
    K --> D[DirectLink]
    K --> R[Gemini Rename]
    K --> A[Gemini API]
    G --> DB[(Configuration database<br/>encrypted passwords)]
    D --> DB
    R --> DB
    A --> DB

Important

Set the key before the first registration and use the same value in all modules of the environment. To change it later, the sensitive data already stored must be encrypted again with the new key, through a procedure performed with a dedicated application. Contact Riversoft support before changing the key.

Use a strong, random value, kept out of the code.
In Riversoft STCP DirectLink, the parameter accepts a secret reference (env:, file: or kms:). Prefer to read the value from an environment variable, a protected file or a secrets vault.
In Riversoft STCP Gemini API, api_secret also signs the access tokens.
Keep the key in the environment’s secure backup: without it, the passwords of a restored database cannot be read.

Configuration sources

Besides the files, Riversoft STCP DirectLink uses the configuration kept in the instance:

Source	Contents
`config.json` file	Riversoft STCP DirectLink’s own configuration: `General`, `Kms`, `Telemetry` and `Service` sections. See Riversoft STCP DirectLink.
Riversoft STCP DirectLink Portal `config.json` file	API address, language, appearance, features and SSO buttons of the portal. See Riversoft STCP DirectLink Portal.
Instance configuration database	JWT, SSO and external lock, managed in the Riversoft Console Portal. See Upgrade and migration.
Instance configuration	Users, schedules, directories, services (address, port and TLS), connectors and API parameters, kept in the Riversoft Console Portal or, on Windows, in Riversoft STCP Enterprise Server.

config.json does not replace the instance configuration.

Riversoft STCP Gemini API

Riversoft STCP Gemini API config.json file: HTTP server, TLS and databases.

Riversoft Console Portal

Riversoft Console Portal config.json file: API address and multiple environments.

Riversoft STCP DirectLink

Riversoft STCP DirectLink config.json file: general parameters, notifications, Turnstile, databases, secrets (KMS), telemetry and service.

Riversoft STCP DirectLink Portal

Riversoft STCP DirectLink Portal config.json file: API address, language, appearance, features and SSO sign-in.

Production checklist

The JSON was validated with jq empty.
The license exists, is valid and has restricted permissions.
applDir and applLockDir exist and are writable by the service user.
applSecret and applConfigPassPhrase were replaced with real values.
applConfigPassPhrase is the same in the other modules of the environment (Riversoft STCP Gemini Server, Riversoft STCP Gemini Rename and the Riversoft STCP Gemini API api_secret). See Password encryption key.
Passwords and tokens were replaced with secret references.
The configuration database and the log database were tested.
The instance configuration contains the required users, schedules and directories.
TLS, API host and certificates were configured on the API service.
Upload, download, links, notifications and password recovery were tested.
Backup and retention were validated before enabling automatic removal.
Telemetry and logs do not expose secrets.
With turnstileEnable on, the secret key is protected and the server can reach challenges.cloudflare.com.
The process was run in the foreground before being installed as a service.
The Riversoft STCP DirectLink Portal config.json points url to the environment API and lists only SSO providers configured in the instance.

Next steps

Start the services: Operation.
Create the instance and change the administrator operator (stcpadmin) password: Administration.