Settings

coreX Platform settings are spread across two pages in the UI:

System > Settings — operational settings (GeoIP, session, password policy, SSL Labs, backup/restore, Terraform export)
System > Features — feature flags that enable or disable platform capabilities
Global Options — HAProxy advanced options, cipher suites, custom response pages, and server-timing metrics

This page documents all three. For user accounts and themes, see Users & Settings.

Feature Flags (System > Features)

Feature flags control which platform capabilities are enabled. Each flag is a boolean setting stored in the database. Toggling a flag on or off and saving triggers a config apply — the change takes effect immediately in HAProxy.

JA4 TLS Fingerprinting

Setting	Default	Description
`ja4_enabled`	`true`	Enables JA4 TLS client fingerprinting. The JA4 fingerprint is a stable hash of the TLS ClientHello (version, SNI, cipher count, extension count, ALPN, cipher list, extensions). It cannot be spoofed by the client and is used by security rules, risk scoring, and the CAPTCHA client binding.

Request Fingerprinting

Request fingerprinting builds a multi-dimensional fingerprint of each HTTP request for use by security rules, risk scoring, and API Armor. It has four sub-settings:

Setting	Default	Description
`req_fp_enabled`	`false`	Master toggle for request fingerprinting. Required by Risk Scoring and API Armor.
`req_fp_parse_body`	`false`	Parse request bodies as part of the fingerprint. Disabled unless `req_fp_enabled` is on.
`req_fp_max_body_bytes`	`1048576` (1 MB)	Maximum body size to parse, in bytes. Disabled unless both `req_fp_enabled` and `req_fp_parse_body` are on.
`req_fp_enforce_max_body`	`false`	Reject requests with bodies larger than `req_fp_max_body_bytes` instead of skipping body parsing. Disabled unless both `req_fp_enabled` and `req_fp_parse_body` are on.

Feature dependencies

Some features depend on others. Risk Scoring requires req_fp_enabled. API Armor requires req_fp_enabled and benefits from req_fp_parse_body. JA4-derived risk fields require ja4_enabled. The UI disables sub-settings when their parent feature is off.

Traffic & Performance

Setting	Default	Description
`compression_enabled`	`false`	Enables Brotli, zstd, and Gzip response compression. See Compression.
`disk_cache_enabled`	`false`	Enables the L2 disk cache sidecar (Varnish). See Caching.
`resp_transform_enabled`	`false`	Enables response body transforms (replace, inject, mask). See Response Transforms.
`img_2_webp_enabled`	`false`	Enables on-the-fly image to WebP conversion. See Image Conversion.

Security

Setting	Default	Description
`api_armor_enabled`	`false`	Enables API Armor — GraphQL analysis, JSON schema validation, JWT/API-key auth validation, and behavioral profiling. Requires `req_fp_enabled`. See API Armor.
`mcp_gateway_enabled`	`false`	Enables the MCP Gateway for connecting AI agents. See MCP Gateway.

Restore Client IP

Setting	Default	Description
`restore_client_ip_trusted_network_list`	(empty)	Comma-separated list of Security List names. When a request arrives from an IP in one of these lists, HAProxy restores the original client IP from the `X-Forwarded-For` header (useful when behind a trusted reverse proxy or CDN). If empty, `X-Forwarded-For` is never trusted.

Only trust known proxies

If you add a network list here, any IP in that list can spoof client IPs via the X-Forwarded-For header. Only add lists containing your known reverse proxy or CDN ranges.

System Settings (System > Settings)

GeoIP / MaxMind

Field	Description
MaxMind License Key	Your MaxMind license key for downloading GeoIP and ASN databases. Required for GeoIP-based security rules and the GeoIP security list country-code validation.
Download Now	Triggers an immediate download of the GeoIP and ASN databases. The status card shows the last download time and database file sizes.

The databases are downloaded to GEOIP_DB_PATH and ASN_DB_PATH (configured via environment variables). The downloader runs automatically on startup if a license key is set.

Session

Setting	Default	Range	Description
`session_timeout_minutes`	30	5–1440	How long a JWT session token remains valid, in minutes. After this period, the user must re-authenticate.
`session_warning_seconds`	60	5–120	How many seconds before session expiry to show the inactivity warning banner.

Password Policy

Admin-configurable password complexity requirements and rotation period. Enforced on user creation, password change, and login (for rotation).

Setting	Default	Range	Description
`password_min_length`	8	8–128	Minimum password length.
`password_require_uppercase`	false	bool	Require at least one uppercase letter.
`password_require_lowercase`	false	bool	Require at least one lowercase letter.
`password_require_digit`	false	bool	Require at least one digit.
`password_require_symbol`	false	bool	Require at least one symbol.
`password_rotation_months`	0	0–24	Force password change after this many months. 0 = disabled.

Password expiry enforcement

When password_rotation_months is set, the backend injects a pwd_exp claim into the JWT on login/refresh. A middleware blocks all non-auth API calls with 403 password_change_required until the user changes their password. The frontend shows a blocking modal — the user cannot navigate away until they set a new password.

SSL Labs

Setting	Default	Range	Description
`ssllabs_max_scans_per_host`	5	1–100	Maximum number of completed SSL Labs scans to retain per host. Older completed scans are pruned. In-progress scans are never deleted.

See Certificates & TLS for the SSL Labs scanning feature.

Terraform Export

Exports the current coreX Platform configuration as a Terraform project (.tf files for all resources and a terraform.tfstate file). Useful for adopting Terraform management of an existing UI-configured deployment.

Option	Description
Include secrets	Include secret values (passwords, API keys, tokens) in the exported state. Off by default — secrets are exported as empty strings.
Include certificates	Export `corex_certificate` resources with private keys. Off by default.
Include users & identities	Export `corex_user` and `corex_mcp_identity` resources. Off by default — includes user passwords and MCP tokens.
Include system secrets	Export singleton secrets (CAPTCHA secrets, MaxMind license key, etc.). Off by default.

The export downloads a ZIP file containing main.tf, terraform.tfstate, and a providers.tf. See Terraform Provider for how to use the exported files.

System Backup & Restore

Export

Creates a full backup of the coreX Platform database and configuration files as a password-protected ZIP archive.

Option	Description
Include secrets	Include secret values (passwords, API keys, tokens, certificate private keys) in the export. On by default.
Include metrics	Include historical metric snapshots and WAF metric events. Off by default — these are large and can be regenerated.
Password	Optional password to encrypt the archive. If set, the same password is required to restore.

Restore

Uploads a previously-exported ZIP archive and restores the database and configuration files.

Restore overwrites everything

Restore replaces all database tables and configuration files with the contents of the archive. The current state is lost. The UI requires you to type RESTORE to confirm. After restore, the page reloads and the config is automatically applied.

Global Options

The Global Options page (Global Options in the sidebar) has three tabs: Advanced, Ciphers, and Custom Pages.

Advanced Tab (admin only)

HAProxy Global Options

A free-form editor for HAProxy global section directives. Supports adding, editing, and removing arbitrary key-value options that are emitted in the global section of the generated HAProxy config. Common uses include tuning maxconn, nbthread, tune.bufsize, and other performance parameters.

Changes to global options trigger a config apply — the banner appears and you must click Apply Changes to push the new config to HAProxy.

Server-Timing Metrics

Setting	Default	Description
`server_timing_metrics_enabled`	false	Adds `Server-Timing: total;dur=..., connect;dur=..., response;dur=...` to all responses. Visible in browser DevTools and via the Resource Timing API. When Page Protect beacon trust is also enabled, HTML responses get a combined header with both cxid and timing metrics.

Ciphers Tab

Manages cipher suite configurations for TLS listeners. See Certificates & TLS for details.

Custom Pages Tab

Manages custom error pages returned for specific HTTP status codes. See Listeners & Backends for how custom error pages are assigned to listeners.

Step-by-Step: Enable a Feature

Navigate to System > Features
Find the feature you want to enable (e.g. api_armor_enabled)
Check the box and click Save
Review any dependency warnings (e.g. API Armor requires req_fp_enabled)
If dependencies are missing, enable them first and save
Click Apply Changes in the top banner to push the new config to HAProxy

Feature flags trigger config apply

Saving a feature flag does not automatically apply the config. You still need to click Apply Changes in the top banner. This gives you a chance to make multiple changes (e.g. enable both req_fp_enabled and api_armor_enabled) before applying them all at once.

Verification

Test a feature flag:
- Enable compression_enabled and save
- Click Apply Changes
- Verify the compression section appears in the sidebar
- Make a request and check the Content-Encoding response header
Test password policy:
- Set password_min_length to 16 and password_require_symbol to true
- Save
- Try to create a user with a short password — expect a validation error
Test session timeout:
- Set session_timeout_minutes to 5
- Save
- Log in and verify the token expires after 5 minutes
Test backup/restore:
- Export a backup with a password
- Make a config change
- Restore the backup — verify the change is reverted

Next Steps

Users & Settings — User accounts, roles, 2FA, and themes
Terraform Provider — Use the exported Terraform files
System Page — Stick-tables, Valkey inspector, and HA dashboard
Architecture — How feature flags affect the request pipeline