# Silo Console Settings

LLMS index: [llms.txt](/llms.txt)

---

<a id="minio-console-settings"></a>
<a id="minio-server-envvar-console"></a>

## Embedded Console fixes after 0903 {#embedded-compatibility}

Fixes are tracked for [local-proxy source attribution (#147)](https://github.com/pgsty/silo/issues/147) and [ignored WebSocket limits (#148)](https://github.com/pgsty/silo/issues/148). The behavior below requires a build containing both fixes; the 0903 image does not include them.

### Proxy source addresses {#trusted-proxies}

Embedded Console uses `MINIO_API_TRUSTED_PROXIES`; `CONSOLE_TRUSTED_PROXIES` remains standalone-only. Client attribution affects `aws:SourceIp` policies and WebSocket limits.

| Setting | Trusted Console TCP peers | Forwarded-chain entries skipped |
| --- | --- | --- |
| Unset or blank | Loopback (`127.0.0.0/8`, `::1`, including IPv4-mapped addresses) | None |
| IP/CIDR list | Loopback plus listed peers | Explicit list entries only |
| `none` / `off` | None | None |
| Invalid or unreadable | Startup error | None |

Separate list entries with commas, semicolons or whitespace. Specify the actual peer addresses of proxies on other hosts or containers. Local proxies need no setting, but must sanitize forwarded source headers: this behavior trusts local processes. A loopback address inside a header does not automatically become a trusted hop. Standalone Console still requires explicit proxy trust.

The Server's S3 policy is unchanged. With `none`/`off`, S3 also ignores the browser address forwarded by embedded Console, so IP policies through Console see the internal peer. WebSocket Origin checks still require a matching authority; loopback trust alone does not allow arbitrary origins.

### WebSocket connection limits {#websocket-limits}

Set these variables in the Server environment or `MINIO_CONFIG_ENV_FILE`:

| Variable | Default |
| --- | --- |
| `CONSOLE_WS_MAX_CONNECTIONS` | 1024 |
| `CONSOLE_WS_MAX_CONNECTIONS_PER_CLIENT` | 256 |
| `CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS` | 64 |
| `CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS_PER_CLIENT` | 8 |

Public browsing uses one WebSocket per tab. NAT clients share an address; IPv6 clients share a budget per /64. For example, set `CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS_PER_CLIENT=16` to allow more anonymous tabs from one address. Defaults and authenticated capacity reservations remain unchanged.

Values must be integers from 1 to 1048576. Each anonymous cap must be strictly below its corresponding shared cap, and the anonymous per-client cap must not exceed the anonymous total. Unset uses the default; explicitly blank values, literal `env://` references and invalid relationships are errors. Configuration errors exit Server before Console serves requests, although the S3 listener may already have started. Other `CONSOLE_*` operator overrides are still cleared and derived from Server configuration.

## Object sharing {#object-sharing}

> [!NOTE]
> **Console v2.4.1:** [#56](https://github.com/pgsty/silo-console/pull/56) implements the boundary below, released in [v2.4.1](/blog/release/console-2.4.1/). [Server #209](https://github.com/pgsty/silo/pull/209) integrates the corresponding embedded behavior. See the [component notes](/compatibility/versions/#console-sharing).

The fix requires no new setting. Its request restrictions always apply, and normal sharing remains available. `CONSOLE_SHARE_MINIO_URL` continues to select only the generated link format. The anonymous proxy is limited to object-content GET requests:

| Allowed | Rejected |
| --- | --- |
| Configured S3 scheme, host and effective port | Other origins, URL user information and fragments |
| `/valid-bucket/nonempty-object-key` | Root/bucket-only requests, `minio` and `.minio.sys*` system paths, dot path components |
| Signatures, session tokens, versions, object parts and download response options | Query-selected operations: `acl`, `tagging`, `retention`, `legal-hold`, `attributes`, `uploadId`, `lambdaArn`, `torrent`; malformed query encoding |
| Direct backend responses | All 3xx return 502 without following the redirect or forwarding `Location` |

S3 continues to enforce authorization: unsigned public objects are allowed by their policies; private objects require valid authorization. Original URL encoding and signature parameters are preserved. Manual proxying of bucket listings, object subresources or downloads that depend on redirects no longer works through this endpoint.

The access boundary applies whenever sharing is available. A prototype included
`CONSOLE_SHARE_ENABLED=off`, but that switch and its frontend and embedded-Server
plumbing were removed: disabling an entire feature is a separate product
requirement, while the proxy must enforce its scope without extra configuration.
`CONSOLE_SHARE_MINIO_URL` therefore remains a link-format setting, not an access
control. Requiring signature-shaped parameters would not protect public metrics,
and a separate Console MAC or link registry is not needed for this bounded object
download contract. The encoded URL is not authenticated as Console-issued.

These checks add local parsing and comparisons, without extra S3/IAM requests,
stored tokens, new signing keys or whole-object buffering. New query-selected S3
operations must be reviewed against the deny list and regression tests. The
[issue decision record](https://github.com/pgsty/silo-console/issues/52) documents
the threat model, alternatives and compatibility tradeoffs. Thanks to
[Jiri Pejchal (@jiri-pejchal)](https://github.com/jiri-pejchal) for reporting the
internal-metrics exposure.

## Console settings reference {#settings-reference}

> [!NOTE]
> **Upstream MinIO change: RELEASE.2025-05-24T17-08-30Z**
>
> Upstream MinIO reduced its Console to object browsing. SILO Console retains the administrative interface, including user management; see [Console compatibility](/compatibility/console/).
>
> The inherited settings below must be interpreted for the deployed Server and Console versions.

This page covers settings that manage access and behavior for the MinIO Console.

You can establish or modify settings by defining:

- an *environment variable* on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
- a *configuration setting* using [`mc admin config set`](/reference/minio-mc-admin/mc-admin-config/#mc.admin.config.set).

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

> [!WARNING]
> **Important**
>
> Each configuration setting controls fundamental MinIO behavior and functionality. MinIO **strongly recommends** testing configuration changes in a lower environment, such as DEV or QA, before applying to production.

## Browser Settings {#browser-settings}

The following settings control behavior for the embedded MinIO Console.

### MinIO Console {#minio-console}

*Optional*

**Environment Variable**

##### `MINIO_BROWSER` {#envvar.MINIO_BROWSER}

*envvar*

Specify `off` to disable the embedded MinIO Console.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Animation {#animation}

*Optional*

**Environment Variable**

##### `MINIO_BROWSER_LOGIN_ANIMATION` {#envvar.MINIO_BROWSER_LOGIN_ANIMATION}

*envvar*

> [!NOTE]
> **Added: MinIO**
>
> Server RELEASE.2023-05-04T21-44-30Z

Specify `off` to disable the animated login screen for the MinIO Console. Defaults to `on`.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Browser Redirect {#browser-redirect}

*Optional*

**Environment Variable**

##### `MINIO_BROWSER_REDIRECT` {#envvar.MINIO_BROWSER_REDIRECT}

*envvar*

> > [!NOTE]
> > **Added: MinIO**
> >
> > Server RELEASE.2023-09-16T01-01-47Z

Specify whether requests from a web browser automatically redirect to the Console address. Defaults to `true`.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Browser Redirect URL {#browser-redirect-url}

*Optional*

**Environment Variable**

##### `MINIO_BROWSER_REDIRECT_URL` {#envvar.MINIO_BROWSER_REDIRECT_URL}

*envvar*

Specify the Fully Qualified Domain Name (FQDN) the MinIO Console listens for incoming connections on.

If you want to host the MinIO Console exclusively from a reverse-proxy service, you must specify the hostname managed by that service.

For example, consider a reverse proxy configured to route `https://example.net/minio/` to the MinIO Console. You must set this environment variable to match that hostname for the Console to both listen and respond to requests using that hostname.

If you omit this variable, the Console listens and responds to all IP addresses or hostnames associated to the host machine on which the MinIO Server runs.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Session Duration {#session-duration}

*Optional*

**Environment Variable**

##### `MINIO_BROWSER_SESSION_DURATION` {#envvar.MINIO_BROWSER_SESSION_DURATION}

*envvar*

> [!NOTE]
> **Added: MinIO**
>
> Server RELEASE.2023-08-23T10-07-06Z

Specify the duration of a browser session for working with the MinIO Console.

MinIO supports the following units of time measurement:

- `s` - seconds, “60s”
- `m` - minutes, “60m”
- `h` - hours, “24h”
- `d` - days, “7d”

Defaults to `12h`.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Log Query URL {#log-query-url}

*Optional*

**Environment Variable**

##### `MINIO_LOG_QUERY_URL` {#envvar.MINIO_LOG_QUERY_URL}

*envvar*

Specify the URL of a PostgreSQL service to which MinIO writes [Audit logs](/operations/monitoring/minio-logging/#minio-logging-publish-audit-logs). The embedded MinIO Console provides a Log Search tool that allows querying the PostgreSQL service for collected logs.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Content Security Policy {#content-security-policy}

*Optional*

Configure MinIO Console to generate a [Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) header in HTTP responses. Defaults to `default-src 'self' 'unsafe-eval' 'unsafe-inline';`

**Environment Variable**

##### `MINIO_BROWSER_CONTENT_SECURITY_POLICY` {#envvar.MINIO_BROWSER_CONTENT_SECURITY_POLICY}

*envvar*

```shell
export MINIO_BROWSER_CONTENT_SECURITY_POLICY="default-src 'self' 'unsafe-eval' 'unsafe-inline';"
```

**Configuration Setting**

##### `browser csp_policy` {#mc-conf.browser.csp_policy}

*mc-conf*

```shell
mc admin config set browser \
   csp_policy="default-src 'self' 'unsafe-eval' 'unsafe-inline';" \
   [ARGUMENT=VALUE ...]
```

### Strict Transport Security {#strict-transport-security}

*Optional*

Configure MinIO console to generate a [Strict-Transport-Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) header in HTTP responses.

To generate the header, you **must** set a duration using either [`MINIO_BROWSER_HSTS_SECONDS`](#envvar.MINIO_BROWSER_HSTS_SECONDS) or [`hsts_seconds`](#mc-conf.browser.hsts_seconds). Other HSTS settings are optional.

**Environment Variables**

##### `MINIO_BROWSER_HSTS_SECONDS` {#envvar.MINIO_BROWSER_HSTS_SECONDS}

*envvar*

The `max_age` the configured policy remains in effect, in seconds. Defaults to `0`, disabled. You **must** configure a *non-zero* duration to enable the `Strict-Transport-Security` header.

```shell
export MINIO_BROWSER_HSTS_SECONDS=31536000
```

##### `MINIO_BROWSER_HSTS_INCLUDE_SUB_DOMAINS` {#envvar.MINIO_BROWSER_HSTS_INCLUDE_SUB_DOMAINS}

*envvar*

Set to `on` to also apply the configured HSTS policy to all MinIO Console subdomains. Defaults to `off`.

```shell
export MINIO_BROWSER_HSTS_INCLUDE_SUB_DOMAINS="on"
```

##### `MINIO_BROWSER_HSTS_PRELOAD` {#envvar.MINIO_BROWSER_HSTS_PRELOAD}

*envvar*

Set to `on` to direct the client browser to add the MinIO Console domain to its HSTS preload list. Defaults to `off`.

```shell
export MINIO_BROWSER_HSTS_PRELOAD="on"
```

**Configuration Settings**

The following configuration settings require a service restart to take effect. To restart the service, use [`mc admin service restart`](/reference/minio-mc-admin/mc-admin-service/#mc.admin.service.restart).

##### `browser hsts_seconds` {#mc-conf.browser.hsts_seconds}

*mc-conf*

The `max_age` the configured policy remains in effect, in seconds. Defaults to `0`, disabled. You **must** configure a *non-zero* duration to enable the `Strict-Transport-Security` header.

```shell
mc admin config set browser \
   hsts_seconds="31536000" \
   [ARGUMENT=VALUE ...]
```

##### `browser hsts_include_subdomains` {#mc-conf.browser.hsts_include_subdomains}

*mc-conf*

Set to `on` to also apply the configured HSTS policy to all MinIO Console subdomains. Defaults to `off`.

```shell
mc admin config set browser \
   hsts_include_subdomains="on" \
   hsts_seconds="31536000" \
   [ARGUMENT=VALUE ...]
```

##### `browser hsts_preload` {#mc-conf.browser.hsts_preload}

*mc-conf*

Set to `on` to direct the client browser to add the MinIO Console domain to its HSTS preload list. Defaults to `off`.

```shell
mc admin config set browser \
   hsts_preload="on" \
   hsts_seconds="31536000" \
   [ARGUMENT=VALUE ...]
```

#### Examples {#examples}

The following examples show the rendered header for the given configuration settings. The equivalent environment variables generate the same result. All examples use a value of `31536000`, which is the number of seconds in a calendar year (365 days).

`hsts_seconds`

> ```shell
> mc admin config set ALIAS browser hsts_seconds=31536000
> ```
>
> ```shell
> Strict-Transport-Security: max-age=31536000
> ```

`hsts_include_subdomains`

> ```shell
> mc admin config set ALIAS browser hsts_seconds=31536000 hsts_include_subdomains=on
> ```
>
> ```shell
> Strict-Transport-Security: max-age=31536000; includeSubDomains
> ```

`hsts_preload`

> ```shell
> mc admin config set ALIAS browser hsts_seconds=31536000 hsts_include_subdomains=on hsts_preload=on
> ```
>
> ```shell
> Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
> ```

### Referrer Policy {#referrer-policy}

*Optional*

Configure MinIO Console to generate a [Referrer-Policy](https://www.w3.org/TR/referrer-policy/) header in HTTP responses. Defaults to `strict-origin-when-cross-origin`.

**Environment Variable**

##### `MINIO_BROWSER_REFERRER_POLICY` {#envvar.MINIO_BROWSER_REFERRER_POLICY}

*envvar*

```shell
export MINIO_BROWSER_REFERRER_POLICY="strict-origin-when-cross-origin"
```

**Configuration Setting**

##### `browser referrer_policy` {#mc-conf.browser.referrer_policy}

*mc-conf*

```shell
mc admin config set browser \
   referrer_policy="strict-origin-when-cross-origin" \
   [ARGUMENT=VALUE ...]
```

## Prometheus Settings {#prometheus-settings}

The following settings manage how MinIO interacts with your Prometheus service.

### Prometheus URL {#prometheus-url}

*Optional*

**Environment Variable**

##### `MINIO_PROMETHEUS_URL` {#envvar.MINIO_PROMETHEUS_URL}

*envvar*

Specify the URL for a Prometheus service configured to [scrape MinIO metrics](/operations/monitoring/collect-minio-metrics-using-prometheus/#minio-metrics-collect-using-prometheus).

The MinIO Console populates the **Dashboard** with cluster metrics using the `minio-job` Prometheus scraping job.

If you are using a standalone MinIO Console process, this variable corresponds with `CONSOLE_PROMETHEUS_URL`.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Prometheus Job ID {#prometheus-job-id}

*Optional*

**Environment Variable**

##### `MINIO_PROMETHEUS_JOB_ID` {#envvar.MINIO_PROMETHEUS_JOB_ID}

*envvar*

Specify the custom Prometheus job ID used for [scraping MinIO metrics](/operations/monitoring/collect-minio-metrics-using-prometheus/#minio-metrics-collect-using-prometheus).

MinIO defaults to `minio-job`.

If you are using a standalone MinIO Console process, this variable corresponds with `CONSOLE_PROMETHEUS_JOB_ID`.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.

### Prometheus Auth Token {#prometheus-auth-token}

*Optional*

**Environment Variable**

##### `MINIO_PROMETHEUS_AUTH_TOKEN` {#envvar.MINIO_PROMETHEUS_AUTH_TOKEN}

*envvar*

Specify the [basic auth token](https://prometheus.io/docs/guides/basic-auth/) the Console should use to connect to a Prometheus service.

For example, a basic auth token you might use could resemble the following:

```text
eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJwcm9tZXRoZXVzIiwic3ViIjoibWluaW8iLCJleHAiOjQ4NTAwMzg0MDJ9.GZCKR3d0FH2TCvNHSd39HaVfSuQVVV0s8glICBDmhT51V6CQ_hw8gTYlKHJmcpR8aHkqiJwCqcYJhaMmqwe00XY
```

If you are using a standalone MinIO Console process, this variable corresponds with `CONSOLE_PROMETHEUS_AUTH_TOKEN`.

**Configuration Setting**

This setting does not have a configuration variable setting. Use the Environment Variable instead.