# Settings

> SecureBaseline Cloud system settings - data retention policies, performance tuning, logging levels, and notification preferences

Source: https://opennix.org/en/docs/haas/settings/

## Overview

The Settings page allows administrators to configure system-wide options including data retention, performance parameters, and logging levels.

## Navigation

**Menu**: System > Settings

## Page Layout

A single card with centered content (max-width 800px) containing:

| Control | Location | Description |
|---------|----------|-------------|
| Reload | Card header | Reload settings from server |
| Save All | Card header | Save all modified settings |
| Form | Card body | Settings form with sections |

The **Save All** button is disabled until changes are made.

## Configuration Sections

### Data Retention

Controls how long data is kept in the system.

| Setting | Field | Range | Description |
|---------|-------|-------|-------------|
| Retention Days | retention_days | 7-365 | Days to keep soft-deleted records |
| Audit Retention Days | audit_retention_days | 7-365 | Days to keep audit logs |

**Retention Days**: When records are deleted, they are soft-deleted first. After this many days, they are permanently purged from the database.

**Audit Retention Days**: Audit log entries older than this period can be cleaned up using the Cleanup button on the Audit Logs page.

### Performance

Controls system performance and resource usage.

| Setting | Field | Range | Description |
|---------|-------|-------|-------------|
| Rate Limit (req/sec) | rate_limit_per_second | 10-1000 | Maximum API requests per second per client |
| Worker Concurrency | worker_concurrency | 1-50 | Number of parallel jobs the worker processes |
| Auto-refresh Interval | auto_refresh_interval | 5-60 | Seconds between UI auto-refresh |

**Rate Limit**: Protects the API from overload. Clients exceeding this limit receive HTTP 429 (Too Many Requests) errors. Higher values allow more throughput but may strain server resources.

**Worker Concurrency**: Higher values process more jobs simultaneously but use more CPU and memory. Set based on server capacity and typical workload.

**Auto-refresh Interval**: How often the UI automatically updates when viewing active scans or jobs. Lower values provide more real-time updates but increase API load.

### Logging

Controls application logging behavior.

| Setting | Field | Range | Description |
|---------|-------|-------|-------------|
| Log Level | log_level | Select | Application logging verbosity |
| Max Upload Size (MB) | max_upload_size_mb | 1-100 | Maximum file size for uploads |

**Log Level Options**:

| Level | Description | Use Case |
|-------|-------------|----------|
| debug | Verbose output including detailed diagnostics | Troubleshooting |
| info | Normal operational messages | Production |
| warn | Warning conditions that may need attention | Reduced noise |
| error | Error conditions only | Minimal logging |

**Max Upload Size**: Limits the size of uploaded files such as SSH private keys.

## Known Issues

The **Known Issues** section allows you to exclude specific CIS rules from compliance score calculation and remediation scripts.

### Why Use Known Issues

- **False positives**: Rules that always fail due to environment specifics
- **Non-applicable rules**: Rules not relevant to your infrastructure
- **Accepted risks**: Rules intentionally not implemented for business reasons
- **Temporary exclusions**: Rules requiring remediation later

### Known Issues Table

| Column | Description |
|--------|-------------|
| Rule ID | CIS rule identifier pattern (supports * for wildcard) |
| Description | Reason for adding to the list |
| Enabled | Toggle to activate/deactivate |
| Actions | Delete button |

### Adding a Known Issue

1. Click **Add Known Issue**
2. Fill in the fields:
   - **Rule ID**: Exact ID or pattern with wildcard (e.g., `xccdf_org.ssgproject.*audit*`)
   - **Description**: Explanation of why the rule is excluded
3. Click **Add**

### Wildcard Patterns

The `*` character is supported for partial ID matching:

| Pattern | Matches |
|---------|---------|
| `xccdf_org.ssgproject.content_rule_audit_*` | All audit rules |
| `*_partition_*` | All partition rules |
| `xccdf_org.ssgproject.content_rule_file_*` | All file rules |

### System Impact

When a rule is in the known issues list:

1. **Adjusted Score**: Compliance score is recalculated without excluded rules
2. **Remediation Scripts**: Excluded rules are not included in generated Ansible playbooks
3. **Display**: The remediation jobs table shows:
   - Rules to fix: X (actual count)
   - Excluded (Known Issues): Y

### Example Usage

If audit rules systematically fail due to your environment:

1. Add pattern `*audit*` with description "Audit rules not applicable in containerized environment"
2. Enable the toggle
3. Compliance score will be adjusted
4. Remediation scripts will not include audit rules

## Saving Settings

Settings are modified locally until explicitly saved:

1. Modify desired settings using the form controls
2. The **Save All** button becomes enabled
3. Click **Save All** button
4. Each setting is saved to the server
5. Success message shows count of saved settings
6. Settings take effect immediately (some may require service restart)

## Reloading Settings

Click **Reload** button to:
- Discard any unsaved changes
- Fetch current values from server
- Reset the form to server state

## Theme and Language

### Theme Toggle

The theme toggle is available in the main navigation:

1. Click the theme icon in the navigation bar
2. Switch between light and dark mode
3. Preference is saved in browser local storage
4. Persists across sessions

### Language Selector

1. Click the language dropdown (EN/RU) in the navigation bar
2. Select preferred language
3. Interface updates immediately
4. Preference is saved in local storage

## Best Practices

### Data Retention

- Set retention based on compliance requirements (PCI-DSS, HIPAA, GDPR)
- Longer retention uses more database storage
- Consider legal/regulatory requirements for your industry
- Audit retention typically should be longer (90+ days)

### Performance Tuning

| Workload | Rate Limit | Worker Concurrency |
|----------|------------|-------------------|
| Light (<100 hosts) | 100 | 3-5 |
| Medium (100-500 hosts) | 200 | 5-10 |
| Heavy (>500 hosts) | 500+ | 10-20 |

Recommendations:
- Increase worker concurrency for faster job processing
- Decrease if system shows high CPU/memory usage
- Monitor queue depth on Jobs page
- Balance throughput vs resource usage

### Logging

- Use **debug** only for troubleshooting specific issues
- Use **info** for normal production operations
- Use **warn** or **error** to reduce log volume
- Ensure log rotation is configured at OS level

### Regular Review

- Review settings quarterly or after infrastructure changes
- Adjust based on observed usage patterns
- Monitor system performance metrics
- Update retention before compliance audits

## Troubleshooting

### Settings Not Saving

1. Check network connection (browser dev tools)
2. Verify user has admin permissions
3. Check browser console for JavaScript errors
4. Try refreshing the page
5. Verify API server is accessible

### Rate Limit Issues

If users are being rate limited (HTTP 429 errors):
1. Check current rate limit setting
2. Increase rate limit temporarily
3. Review client behavior for excessive requests
4. Check for automated scripts or misconfigured tools
5. Consider implementing client-side request throttling

### Worker Performance

If jobs are slow or backing up:
1. Check current worker concurrency setting
2. Increase concurrency if server has capacity
3. Check server resources (CPU, RAM) for bottlenecks
4. Review job queue depth on Jobs page
5. Check for failed jobs that may need investigation
6. Verify network connectivity to managed hosts

### Logging Issues

If logs are too verbose or consuming disk space:
1. Set log level to **warn** or **error**
2. Verify log rotation is configured (logrotate)
3. Monitor disk space
4. Consider centralized logging (syslog, Loki)
5. Archive old logs before deletion

## API Reference

Settings can also be managed via API:

Get all settings:
```
GET /api/v1/settings
```

Update a setting:
```
PUT /api/v1/settings/{key}
Content-Type: application/json
{"value": "new_value"}
```

Known Issues:
```
GET /api/v1/known-issues
POST /api/v1/known-issues
DELETE /api/v1/known-issues/{id}
POST /api/v1/known-issues/{id}/toggle
```

## Related Pages

- [Audit Logs](/en/docs/haas/audit-logs/) - Uses audit_retention_days setting
- [Jobs](/en/docs/haas/jobs/) - Uses worker_concurrency setting
- [Compliance Scanning](/en/docs/haas/compliance-scanning/) - Uses auto_refresh_interval setting

## Security Features

### Credential Encryption

All SSH keys and passwords stored in the database are encrypted with AES-256-GCM using the `ENCRYPTION_KEY` environment variable. This key is automatically generated during first boot and stored securely.

- Encryption is transparent - credentials are encrypted on save and decrypted on use
- Existing base64-encoded credentials are automatically migrated to AES-256-GCM on API startup
- The encryption key is a 64-character hex string (32 bytes)

### FSTEC BDU Sync

The Russian FSTEC vulnerability database (BDU) syncs automatically:

- **On API startup** - initial sync
- **Every 24 hours** - periodic background sync
- **Manual trigger** - available via admin API: `POST /api/v1/admin/fstec-sync`
- **Status check** - `GET /api/v1/admin/fstec-sync/status`

### CVE Database Sync

CVE databases are pre-loaded in the VM image. The vulnerability scanning engine validates all 8 databases on startup and syncs missing ones automatically.

Manual sync is available via admin API: `POST /api/v1/admin/cve-sync`