# Host service parameters

Every key on this page is set once per host, at the top of the configuration.
A [!badge variant="success" text="GUI"] key has a field in the interface; a
[!badge variant="warning" text="YAML only"] key is set in the
[Source (YAML) view](../../concepts/yaml-view.md), which accepts the same configuration.

## Web server

One web server runs per host and serves every application on it.

**Example** - every key in this section, with realistic values:

```yaml
webserver: nginx             # nginx | apache2
# da_webserver: nginx_apache # DirectAdmin hosts only - the panel builds its own web server
```

### `webserver`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"]

One of `nginx`, `apache2`. Default `nginx`.

Selects the web server for this host. Nginx suits almost every workload. Choose Apache when an application needs `.htaccess` files or Apache modules.

### `da_webserver`

[!badge variant="info" text="enum"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

One of `apache`, `nginx`, `nginx_apache`. Default: `nginx_apache` when TurboShield is on, otherwise `apache`.

Which web server the DirectAdmin control panel builds and runs. `nginx_apache` puts Nginx in front of Apache, which keeps `.htaccess` support while Nginx serves the traffic. A DirectAdmin host manages its own web server, so it needs a separate setting from `webserver`.

**Note:** only on hosts that run the DirectAdmin control panel. Every other host chooses its web server with `webserver`.

## Databases

Enable the database your application needs and pick its version. You rarely need to set a
memory size. The platform sizes the database to the server's memory for you and re-tunes it
every time you publish, so the sizing grows automatically as the server grows. Only set a
size key when a measurement shows the automatic value is wrong for your workload.

Prefer a version that is still supported. Older versions keep working, but may no longer
receive security updates. The GUI dropdown lists the versions available now.

**Example** - every key in this section, with realistic values:

```yaml
# MySQL (Percona) - most PHP apps
mysql_version: "8.4"           # 5.7 | 8.0 | 8.4
mysql_innodb_size: 8G          # buffer pool, auto-tuned; override with evidence
mysql_bindaddress: 127.0.0.1   # keep restricted to trusted networks
mysql_server: true
# mysql_timezone: Europe/Brussels   # default DB time zone
# Split app/database-server topology instead:
# mysql_server_only: true
# mysql_client_host_name: db1.example.com
# mysql_client_host_ip: 10.0.0.5

# PostgreSQL - Odoo, Medusa and others
postgresql_version: "17"
postgresql_shared_buffers: 8GB
postgresql_extensions: [pg_stat_statements]
postgresql_listen_addresses: localhost
postgresql_extra_access:
  - {type: host, database: appdb, user: reporting, address: 10.0.0.0/24, auth_method: scram-sha-256}
# postgresql_client_only: true
# postgresql_client_host_name: db1.example.com
# postgresql_client_host_ip: 10.0.0.5

# MongoDB
mongodb_version: "8.0"         # 7.0 | 8.0
mongodb_bindip: 127.0.0.1

# Microsoft SQL Server - .NET apps
mssql_version: "2022"          # 2019 | 2022 | 2025 (depends on the server OS)
mssql_edition: Developer       # Developer | Enterprise | Express | Standard | Web
```

### `mysql_version`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"]

One of `5.7`, `8.0`, `8.4`.

Installs MySQL in the given version. Leave it out, or set `0`, to not install it. The database most PHP applications use, including WordPress, Magento and Shopware.

> [!WARNING]
> Changing the major version on a live host is a migration, not a setting. Plan and test it.

### `mysql_innodb_size`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory MySQL uses to cache data and indexes (the InnoDB buffer pool). The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows as the server grows. It is the most effective database performance setting, but only override the automatic value with measured evidence.

### `mysql_bindaddress`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Local only.

Which network addresses MySQL accepts connections on. Give an address, or the keyword `ANY` to listen on every interface. Needed when a separate application server must reach this database.

**Note:** on a host that runs Kubernetes or Docker, MySQL listens on every interface unless you set this key yourself.

> [!WARNING]
> `ANY` puts the database on every interface, including any public one. Exposing a database to the public internet is a serious risk - give a specific private address and restrict access with the firewall.

### `mysql_server`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `true`.

Whether the database server itself is installed. Set it to false on an application server that only needs the client tools.

### `mysql_server_only`

[!badge variant="info" text="boolean"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default `false`.

Installs only the database server, without the local application-side setup. For a dedicated database server that hosts no applications.

### `mysql_client_host_name`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Points this server's database client at a database on another server. Split application and database across two servers.

### `mysql_client_host_ip`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

The address of that remote database server. Used together with `mysql_client_host_name`.

### `mysql_timezone`

[!badge variant="info" text="string"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default: The server's time zone.

Sets the default time zone of the MySQL database server. Make database timestamps match the time zone your application expects, regardless of the server's own time zone.

### `postgresql_version`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"]

For example `16`, `17`, `18` - the GUI dropdown lists the values available now.

Installs PostgreSQL in the given version. The database used by Odoo and Medusa, and an option for several other applications.

> [!WARNING]
> Changing the major version on a live host is a migration. Plan and test it.

### `postgresql_shared_buffers`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory PostgreSQL uses for caching (shared buffers). The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. It is the main PostgreSQL performance setting, but only override the automatic value with measured evidence.

### `postgresql_extensions`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

One of `vector`, `postgis`, `timescaledb`, `pg_stat_statements`. Default `empty`.

Enables extra PostgreSQL extensions. Adds capabilities such as geographic data or vector search.

**Note:** only these four names are accepted. Any other value stops the deployment with an error.

### `postgresql_listen_addresses`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Local only.

Which addresses PostgreSQL accepts connections on. Give an address, or the keyword `ANY` to listen on every interface. Needed for a separate application server.

**Note:** on a host that runs Kubernetes or Docker, PostgreSQL listens on every interface unless you set this key yourself.

> [!WARNING]
> `ANY` puts the database on every interface, including any public one. Give a specific private address and restrict access with the firewall.

### `postgresql_extra_access`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `empty`.

Extra access rules stating which user may reach which database from which address. Grant a specific external system access without opening the database entirely.

### `postgresql_client_only`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `false`.

Installs only the client tools, not the server. For an application server that connects to a database elsewhere.

### `postgresql_client_host_name`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Points this server's database client at a PostgreSQL database on another server. Split application and database across two servers.

**Note:** used with `postgresql_client_only` and `postgresql_client_host_ip`.

### `postgresql_client_host_ip`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

The address of that remote PostgreSQL server. Used together with `postgresql_client_host_name`.

### `mongodb_version`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

One of `7.0`, `8.0`.

Installs MongoDB in the given version. For applications that store documents rather than tables.

### `mongodb_bindip`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Local only.

Which addresses MongoDB accepts connections on. Give a comma-separated list of addresses, or the keyword `ANY` to listen on every interface. Needed for a separate application server.

**Note:** on a host that runs Kubernetes or Docker, MongoDB listens on every interface. Unlike the other databases it does so even when this key is set to `127.0.0.1`, so give a specific private address if you need to keep it narrow.

> [!WARNING]
> `ANY` puts the database on every interface, including any public one. Give specific private addresses and restrict access with the firewall.

### `mssql_version`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

One of `2019`, `2022`, `2025`.

Installs Microsoft SQL Server. Required by .NET applications such as nopCommerce.

**Note:** which versions are available depends on the server operating system.

### `mssql_edition`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

One of `Developer`, `Enterprise`, `Express`, `Standard`, `Web`.

Which SQL Server edition is installed. Editions differ in features and licensing. The GUI dropdown lists the available ones.

## Caching and queues

Caching keeps your application fast, and a message broker lets it process work in the
background. As with the databases, the cache sizes (`redis_memory`, `varnish_cache_size`)
are set to the server's memory automatically and re-tuned on every publish, so they grow
with the server. Only override a size when a measurement shows you need to.

**Example** - every key in this section, with realistic values:

```yaml
redis_enabled: true
redis_memory: 2gb             # cache instance maxmemory
# redis_persistent_memory: 1gb  # persistent (on-disk) instance maxmemory
redis_listen_addresses: localhost
# Varnish is installed by turning on varnish_enabled for an application - there is no host
# key to install it, and the platform chooses the version itself. These only tune it:
varnish_cache_size: 512m
varnish_type: opensource      # opensource | enterprise
# varnish_customvcl: |        # advanced: your own cache rules
#   sub vcl_recv { }
# varnish_modules: false      # advanced: leave out the extra module set (vmods)
# varnish_backend_host: origin.example.com   # advanced: custom origin
# varnish_backend_port: 8080
rabbitmq_version: latest      # latest | a series such as 4.0.x
rabbitmq_plugins: [rabbitmq_shovel, rabbitmq_shovel_management]
```

### `redis_enabled`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"]

Default `true`.

Installs Redis, used for sessions and object caching. Recommended for almost every application, which is why it is on by default.

### `redis_memory`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory the cache instance may use. Rarely needs changing. The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. The automatic value accounts for disk use as well as memory.

> [!WARNING]
> Raising it also increases disk use. Override the automatic value only after measuring.

### `redis_persistent_memory`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory the persistent Redis instance may use - the instance that keeps its data on disk. The platform sizes this to the server's memory automatically and re-tunes it on every publish. Override only after measuring, for workloads that persist a lot of cache or session data.

> [!WARNING]
> Raising it also increases disk use.

### `redis_listen_addresses`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Only `internal`. Default: Local only.

Which addresses Redis accepts connections on. Leave it unset to stay on localhost; `internal` also binds the host's private network addresses. Needed when another server must reach the cache.

**Note:** `internal` is the only accepted value. Anything else, including `any`, stops the deployment with an error. On a host that runs Kubernetes or Docker, Redis uses `internal` unless you set this key yourself.

> [!WARNING]
> Keep it restricted to trusted networks. Setting `internal` turns off the Redis protected mode, and so does running Kubernetes or Docker on the host.

### `varnish_version`

[!badge variant="info" text="string"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

For example `7.6`, `8.0` - the GUI dropdown lists the values available now. Default: Chosen by the platform.

Pins the version of the full-page cache. You almost never set this. Nothing has to be set at host level to run Varnish. Turning on `varnish_enabled` for any application installs it, and the platform picks the version itself: 8.0, or 7.6 on Debian 11 and older, or 6.0 for the Enterprise edition. Setting this key by hand only does anything on a host where no application has `varnish_enabled` at all. That installs the cache before anything uses it.

> [!WARNING]
> As soon as one application on the host has `varnish_enabled`, the platform's own choice replaces whatever you put here, and it does not warn you that it did.

### `varnish_cache_size`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory the full-page cache may use. The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. A larger cache holds more pages, but takes memory from the applications, so only override the automatic value after measuring.

### `varnish_type`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

One of `opensource`, `enterprise`. Default `opensource`.

Which edition of the cache is installed. The commercial edition adds features that need a licence.

**Note:** `enterprise` only works when Hosted Power has put a licence in place for this host. Without it the deployment stops with an error, so leave it on `opensource` unless the licence has been arranged.

### `varnish_customvcl`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Replaces the generated cache rules with your own. For caching behavior the standard configuration cannot express.

> [!WARNING]
> Custom cache rules are easy to get wrong and can serve the wrong content to visitors.

### `varnish_modules`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `true`.

Installs the extra Varnish module set (vmods) alongside the cache. Custom VCL often calls functions that only exist in these modules.

**Note:** open-source Varnish only. The Enterprise edition ships its own modules and ignores this key.

### `varnish_backend_host`

[!badge variant="info" text="string"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default: The local application.

Points the cache at a custom backend host instead of the local application. Put the full-page cache in front of an origin that runs on another server.

**Note:** set together with `varnish_backend_port`; the custom backend is only used when both are set.

### `varnish_backend_port`

[!badge variant="info" text="integer"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

The port of the custom cache backend host. Used together with `varnish_backend_host`.

### `rabbitmq_version`

[!badge variant="info" text="string"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

For example `latest`, `4.0.x` - the GUI dropdown lists the values available now. Default `latest`.

Pins the message broker to a specific version. Match a version your application is tested against.

### `rabbitmq_plugins`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `empty`.

Enables extra broker plugins. Adds protocols or management features your application needs.

## Search

A search engine powers product and content search. Magento requires one; most other
applications do not need it. The heap size is set to the server's memory automatically and
re-tuned on every publish, so it grows with the server. Only set a heap key when a
measurement shows you need to.

**Example** - every key in this section, with realistic values:

```yaml
# Use either Elasticsearch or OpenSearch on a host, not both.
elasticsearch_version: "8.x"       # required by Magento 2
elasticsearch_heap_size: 2g
elasticsearch_plugins: [analysis-icu]
# elasticsearch_kibana: true       # Kibana web interface
# elasticsearch_network_host: INTERNAL   # private network only, never public
# opensearch_version: "2.x"
# opensearch_heap_size: 2g
# opensearch_plugins: [analysis-icu]
# opensearch_dashboards: true
# opensearch_dashboards_usermanagement: true   # login for the dashboards
```

### `elasticsearch_version`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"]

For example `8.x`, `9.x` - the GUI dropdown lists the values available now.

Installs Elasticsearch in the given version. Required by Magento 2 and used by Akeneo for catalog search.

**Note:** the value is a release channel such as `8.x`, not an exact version. To not install it, omit the key or set an empty string `""` - never the integer `0`, which fails the deployment.

> [!WARNING]
> Changing the major version usually means rebuilding your indexes.

### `elasticsearch_heap_size`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory the search engine may use (the JVM heap). The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. Too little makes search slow; too much starves the rest of the server, so only override the automatic value after measuring.

### `elasticsearch_plugins`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `empty`.

Installs extra search plugins. Adds language-specific analysis for better search results.

### `elasticsearch_kibana`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `false`.

Installs the Kibana web interface for Elasticsearch, reachable at `https://<host>/kibana`. Inspect indexes and run queries in a browser.

**Note:** an `elasticsearch_version` must be set. The web server proxies the path and asks for a login first - use one of the host's system user accounts.

### `elasticsearch_network_host`

[!badge variant="info" text="string"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default `localhost`.

Which address Elasticsearch listens on - `localhost`, `INTERNAL` for private-network addresses, or a specific address. Reach the search engine from another server on a private network.

**Note:** `INTERNAL` resolves to the loopback addresses plus the host's private IPv4 addresses - the same keyword `redis_listen_addresses` uses.

> [!WARNING]
> Never bind it to a public address.

### `opensearch_version`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"]

For example `2.x`, `3.x` - the GUI dropdown lists the values available now.

Installs OpenSearch in the given version. An alternative search engine, used by Shopware among others.

**Note:** use either Elasticsearch or OpenSearch on a host, not both. The value is a release channel such as `2.x`; to not install it, omit the key or set an empty string `""`, never the integer `0`.

### `opensearch_heap_size`

[!badge variant="info" text="string"] [!badge variant="secondary" text="size (MB/GB)"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default: Tuned to the server.

How much memory OpenSearch may use (the JVM heap). Set to the server's memory automatically and re-tuned on every publish, so it grows with the server. Same trade-off as the Elasticsearch heap - only override the automatic value after measuring.

### `opensearch_plugins`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `empty`.

Installs extra OpenSearch plugins. Adds language-specific analysis.

### `opensearch_dashboards`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `false`.

Installs the OpenSearch web interface, reachable at `https://<host>/dashboards`. Inspect indexes and run queries in a browser.

**Note:** the web server proxies the path and asks for a login first - use one of the host's system user accounts.

### `opensearch_dashboards_usermanagement`

[!badge variant="info" text="boolean"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default `false`.

Turns on login and user management for the OpenSearch dashboards. Protect the dashboards with authentication and user accounts.

**Note:** `opensearch_dashboards` must be enabled.

## Host-wide runtime and packages

Settings that apply to the whole server rather than to one application.

**Example** - every key in this section, with realistic values:

```yaml
php_main_version: "8.4"           # PHP used on the command line
# php_versions: ["8.3", "8.4"]    # install extra PHP versions side by side
# php_ioncube_enabled: true       # ionCube loader for encoded/licensed apps
composer_version: lts             # latest | lts | 2 | 2.2
# composer_keep_updated: true     # auto-update the Composer binary
os_extra_packages: [imagemagick, jq]
system_packages_upgrade_time: "03:30"
maintenance:                      # window for updates that need a reboot
  - day: 4                        # 1 = Sunday ... 7 = Saturday
    hour: 22                      # 0-23
supervisor_enabled: false
```

### `php_versions`

[!badge variant="info" text="list"] [!badge variant="warning" text="YAML only"]

For example `['8.3', '8.4']` - the GUI dropdown lists the values available now. Default: The versions your applications use.

Which PHP versions are installed and available on the server. Run applications that need different PHP versions side by side. Normally derived from your applications; set it to install an extra version explicitly.

### `php_ioncube_enabled`

[!badge variant="info" text="boolean"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default `false`.

Installs the ionCube loader for PHP. Required to run commercial PHP software distributed as encrypted, licensed code.

### `php_main_version`

[!badge variant="info" text="string"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

For example `8.2`, `8.3`, `8.4` - the GUI dropdown lists the values available now. Default: The lowest version any application uses.

Which PHP version is used on the command line. Matters when you run scripts over SSH and several PHP versions are installed.

### `composer_keep_updated`

[!badge variant="info" text="boolean"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default `true`.

Keeps the Composer binary automatically updated. Always run a current Composer without updating it by hand.

### `composer_version`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"]

One of `latest`, `lts`, `2`, `2.2`. Default `lts`.

Which Composer version is installed. Some applications need a specific Composer version to install correctly.

### `os_extra_packages`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"]

Default `empty`.

Installs extra operating-system packages. Add a tool or library your application needs, without root access.

### `system_packages_upgrade_time`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

When automatic package updates are installed. These are routine updates that do not need a reboot. Move updates to a quiet moment for your business.

### `maintenance`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"]

Default: a weekly window managed by the platform.

Sets the weekly window when the platform applies updates that need a reboot. Pick a low-traffic moment so a reboot does not interrupt visitors during your busy hours.

**Note:** each entry has a day (1 = Sunday through 7 = Saturday) and an hour (0-23). Set it from the Advanced tab, which offers day and hour dropdowns.

### `supervisor_enabled`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `false`.

Installs a process manager for long-running background processes. An alternative to user system services for keeping workers running.

## Mail

TurboStack signs outgoing mail with DomainKeys Identified Mail (DKIM), so a receiving server
can check that a message really came from your domain. A separate setting turns a host into a
mail testing host, where messages are collected on the server instead of being delivered. Both
live on the **Advanced** tab, under **Mail Settings**. For the DNS side of mail authentication,
see [Email deliverability](../../technologies/mail/deliverability.md).

**Example** - every key in this section, with realistic values:

```yaml
dkim:
  keys:
    - fqdn: example.com          # sign mail sent from this domain
    - fqdn: shop.example.com
      selector: shop2026         # optional, default is cloud
# Development and staging hosts only - collect mail instead of delivering it:
mail_devtool: mailpit           # mailpit | mailhog
# mailhog_install: true         # written by the interface toggle; mail_devtool does the work
```

### `dkim.keys`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"]

Default `empty`.

The mail domains this host signs outgoing mail for. A signing key pair is generated on the server for each entry, and existing keys are never overwritten. Signed mail is far more likely to reach the inbox instead of the spam folder.

**Note:** `dkim` must be a map that contains a `keys` list. The older `dkim: true` form is refused and stops the deployment. After the key is generated, publish the matching public record in the Domain Name System (DNS).

### `dkim.keys.fqdn`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="danger" text="required"]

The mail domain this key signs for, written in full. Tells the platform which sender domain the key belongs to.

**Note:** required for every entry. An entry without it stops the deployment.

### `dkim.keys.selector`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `cloud`.

The label that identifies this key in DNS. The record you publish is the selector, followed by `._domainkey.` and the domain. Lets one domain hold more than one key, which is what makes it possible to replace a key without a gap in signing.

### `mail_devtool`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

One of `mailpit`, `mailhog`.

Installs a mail testing tool with a web interface that collects the messages your applications send. See exactly what your application sends, including the full message, without anything reaching a real recipient.

**Note:** only the two values above are accepted; anything else stops the deployment. The platform also points PHP at the collector by default.

> [!WARNING]
> Use this on development and staging hosts only. While it is set, mail your applications send is kept on the server instead of being delivered.

### `mailhog_install`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `false`.

Records that mail collecting is switched on for this host. The interface writes it when you enable **Enable mail capturing and mail testing**, which then shows the `mail_devtool` field. Only meaningful together with `mail_devtool`.

**Note:** on its own this key installs nothing. `mail_devtool` is what selects and installs the tool, so set that as well.

## Advanced database monitoring

Advanced database monitoring collects query-level statistics from the databases on this host
and sends them to a central collection server, where slow queries, locks and load are kept over
time. Set it up on the **Advanced** tab, under **Advanced Database Monitoring**.

**Example** - every key in this section, with realistic values:

```yaml
pmm_master:
  server_hostname: monitor.example.com   # the server that collects the statistics
pmm_sampling_rate: 50                    # record one query in every fifty
```

### `pmm_master.server_hostname`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

The collection server this host sends its database statistics to. Setting it is what switches advanced database monitoring on. Find the queries that make a database slow, with history you can compare against a quiet period.

**Note:** at least one database must be configured on the host. Without one, the panel stays empty.

### `pmm_sampling_rate`

[!badge variant="info" text="integer"] [!badge variant="secondary" text="count"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Default `50`.

How often a query is recorded. A value of `50` records one query in every fifty, not one in two. Lower it for a more complete picture on a quiet database, raise it to keep the measuring itself cheap on a busy one.

**Note:** only used together with `pmm_master.server_hostname`.

## Related

- [YAML configuration reference](index.md)
- [The Source (YAML) view](../../concepts/yaml-view.md)
- [Publishing changes](../../platform/hosts/publishing.md)