Settings and signing
System administrators manage global behavior under Settings.
General settings
| Setting | Behavior |
|---|---|
| Base URL | The canonical address used in generated links and agent configuration. Do not include a trailing slash. Use this to move agents to an HTTPS address at their next check-in. |
| Trusted Proxies | Comma- or newline-separated proxy IP addresses and CIDR ranges whose X-Forwarded-For and X-Real-IP headers ELM trusts. |
| Number of Snapshots to keep per Content View | Retains 2 to 20 snapshots per view. The default is 10. A snapshot pinned by a downstream content view is preserved. |
| Source Garbage Collection Hour (UTC) | Runs source cleanup once per day. The default is 03:00 UTC. Avoid scheduling source syncs for the same hour. |
| Provision Timeout | Clears a provisioning request that has not started within 1 to 168 hours. The default is 6 hours. |
Source cleanup removes package files that are no longer present in upstream metadata and are not needed by retained snapshots or active pin rules. See Sources.
Repository metadata signing
Under Settings → Signing, import your organization's armored OpenPGP public and private key. ELM can also generate a new key pair when needed.
- The private key must be unprotected by a passphrase.
- ELM encrypts the private key at rest and never returns a stored private key to the browser.
- A newly generated private key is shown once. Save it securely before leaving the page.
- The Sign new Content Views by default setting controls the initial signing choice for new views. You can still enable or disable signing on each view.
Use signing material that follows your organization's certificate, key-management, rotation, and backup requirements.
When a signed content view is composed, ELM:
- Creates a detached signature for
repodata/repomd.xml. - Publishes the public key at the repository root as
gpgkey-elm. - Tells assigned agents to import that key and use
repo_gpgcheck=1.
This verifies repository metadata. It does not sign individual RPMs, and agent-managed repositories continue to use gpgcheck=0 for package signatures.
Back up the signing key and the complete /etc/elm-server.conf securely. Losing the encryption secret or signing private key prevents ELM from using the stored key.
Related
- Enable signing and access control on Content views.
- Configure LDAP and SAML under Authentication.
- Configure external services under Integrations.