Configuration reference
This page is for operators who deploy the UI and developers who build it. The UI is a static web app that reads its settings in the browser, so none of them can be a secret.
Runtime settings (config.json)
When it loads, the UI fetches config.json from its own address. Each key the file doesn't set keeps the default below. In the container image, mount the file at /app/config.json. When the UI was built with VITE_API_URL, it doesn't fetch config.json at all.
| Setting | Purpose | Type | Default | Example |
|---|---|---|---|---|
API_URL | The address of the API, without /api. The UI calls it from the browser, so it must be reachable from your users' machines, and the API must allow the UI's address in CCF_API_ALLOWED_ORIGINS. Empty sends requests to the UI's own address. | string | "" | "API_URL": "https://ccf-api.example.com" |
FILTER_COMPONENT_LINKING_ENABLED | Shows the screens that link evidence filters to system components, the Dashboards drawer of a component and the Components field of the filter form. (new in 2.12) | bool | false | "FILTER_COMPONENT_LINKING_ENABLED": true |
LOGIN_BANNER | A notice shown above the sign-in form, which users can close. Once closed, it stays hidden in that browser until its text changes. Empty shows no banner. | string | "" | "LOGIN_BANNER": "Authorized use only." |
LOGIN_BANNER_SEVERITY | The style of the sign-in banner. One of info, warn, error or success; any other value shows info. | string | "info" | "LOGIN_BANNER_SEVERITY": "warn" |
Build-time variables
Vite builds these into the app when you run npm run build, so a change needs a new build. Set them in the build's environment.
| Setting | Purpose | Type | Default | Example |
|---|---|---|---|---|
VITE_API_URL | Builds the UI with this API address. A UI built with it never fetches config.json, and uses the built-in defaults for the other runtime settings unless their own variables below are set. | string | none | VITE_API_URL=http://localhost:8080 |
VITE_FILTER_COMPONENT_LINKING_ENABLED | Overrides FILTER_COMPONENT_LINKING_ENABLED. Only true and false count; any other value leaves the runtime setting in charge. (new in 2.12) | bool | none | VITE_FILTER_COMPONENT_LINKING_ENABLED=true |
VITE_LOGIN_BANNER | Overrides LOGIN_BANNER. Set it to an empty string to build a UI without a banner, whatever config.json says. | string | none | VITE_LOGIN_BANNER="Staging: data is reset every night." |
VITE_LOGIN_BANNER_SEVERITY | Overrides LOGIN_BANNER_SEVERITY when it's one of info, warn, error or success. | string | none | VITE_LOGIN_BANNER_SEVERITY=warn |