Settings

indico.conf is Indico’s main configuration file. Its initial version is usually generated when running indico setup wizard as described in the Installation Guide, but depending on the setup it should be modified later.

The config file is loaded from the path specified in the INDICO_CONFIG environment variable; if no such path is set, the config file (or a symlink to it) is searched in the following places, in order:

<indico_package_path>/indico.conf (development setups only)
~/.indico.conf
/etc/indico.conf

The file is executed as a Python module, so anything that is valid Python 2.7 code can be used in it. When defining temporary variables that are not config options, their name should be prefixed with an underscore; otherwise you will get a warning about unknowing config options being defined.

Authentication

LOCAL_IDENTITIES

This setting controls whether local Indico accounts are available. If no centralized authentication infrastructure (e.g. LDAP, OAuth, or another kind of SSO) is used, local accounts are the only way of logging in to Indico.

Default: True

LOCAL_USERNAMES

This setting controls whether local Indico accounts have usernames for logging in. If disabled, only the email address is used as the “username”, otherwise both can be used.

Default: True

LOCAL_GROUPS

This setting controls whether local Indico groups are available. If no centralized authentication infrastructure that supports groups (e.g. LDAP) is used, local groups are the only way to define groups in Indico, but if you do have central groups it may be useful to disable local ones to have all groups in one central place.

Default: True

LOCAL_REGISTRATION

This setting controls whether people accessing Indico can create a new account. Admins can always create new local accounts, regardless of this setting.

This setting is only taken into account if LOCAL_IDENTITIES are enabled.

Default: True

LOCAL_PASSWORD_MIN_LENGTH

This setting controls the minimum number of characters required for a local account password.

Outside debug mode, this cannot be set to a value less than 8, which is considered the bare minimum for a (somewhat) secure password.

The default value is 8 to avoid suddenly changing it for existing installations which would require users to change their password at the next login. Any new installation has a default of 15, which is the recommendation from the NIST standard.

Default: 8

LOCAL_MODERATION

This setting controls whether a new registration needs to be approved by an admin before the account is actually created.

This setting is only taken into account if LOCAL_IDENTITIES and LOCAL_REGISTRATION are enabled.

Default: False

FAILED_LOGIN_RATE_LIMIT

Applies a rate limit to failed login attempts due to an invalid username or password. When specifying multiple rate limits separated with a semicolon, they are checked in that specific order, which can allow for a short burst of attempts (e.g. a legitimate user trying multiple passwords they commonly use) and then slowing down more strongly (in case someone tries to brute-force more than just a few passwords).

Rate limiting is applied by IP address and only failed logins count against the rate limit. It also does not apply to login attempts using external login systems (SSO) as failures there are rarely related to invalid credentials coming from the user (these would be rejected on the SSO side, which should implement its own rate limiting).

The default allows a burst of 10 attempts, and then only 5 attempts every 15 minutes for the next 24 hours. Setting the rate limit to None disables it.

Default: '5 per 15 minutes; 10 per day'

SIGNUP_RATE_LIMIT

Applies a rate limit to sending verification emails in signup attempts. When specifying multiple rate limits separated with a semicolon, they are checked in that specific order, which can allow for a short burst of attempts.

Rate limiting is applied by IP address and each verification email sent counts against the rate limit.

The default allows a burst of 5 attempts, and then only 2 attempts every hour for the next 24 hours. Setting the rate limit to None disables it.

Default: '2 per hour; 5 per day'

EXTERNAL_REGISTRATION_URL

The URL to an external page where people can register an account that can then be used to login to Indico (usually via LDAP/SSO).

This setting is only taken into account if LOCAL_IDENTITIES are disabled.

Default: None

AUTH_PROVIDERS

A dict defining Flask-Multipass authentication providers used by Indico. The dict specified here is passed to the MULTIPASS_AUTH_PROVIDERS setting of Flask-Multipass.

Default: {}

IDENTITY_PROVIDERS

A dict defining Flask-Multipass identity providers used by Indico to look up user information based on the data provided by an authentication provider. The dict specified here is passed to the MULTIPASS_IDENTITY_PROVIDERS setting of Flask-Multipass.

Default: {}

PROVIDER_MAP

If not specified, authentication and identity providers with the same name are linked automatically. The dict specified here is passed to the MULTIPASS_PROVIDER_MAP setting of Flask-Multipass.

Default: {}

SIGNUP_CAPTCHA

If enabled, a CAPTCHA is required when creating an Indico account to prevent spam bots from registering accounts automatically. Signups through external authentication systems (LDAP, SSO etc.) are not affected by this; they are expected to have their own protection in place to prevent spam signups.

Default: True

Cache

REDIS_CACHE_URL

The URL of the redis server to use for caching.

If the Redis server requires authentication, use a URL like this: redis://unused:password@127.0.0.1:6379/1

If no authentication is used (usually the case with a local Redis server), you can omit the user/password part: redis://127.0.0.1:6379/1

Default: None

Celery

CELERY_BROKER

The URL of the Celery broker (usually Redis of AMQP) used for communication between Indico and the Celery background workers.

We recommend using Redis as it is the easiest option, but you can check the Celery documentation on brokers for more information on the other possible brokers.

Default: None

CELERY_RESULT_BACKEND

The URL of the Celery result backend. If not set, the same backend as the broker is used. Indico currently does not use task results, and we recommend leaving this setting at its default.

Default: None

CELERY_CONFIG

A dict containing additional Celery settings.

Warning

This is an advanced setting that is rarely needed and we do not recommend using it unless you know exactly what you are doing! Changing Celery settings may break things or result in tasks not being executed without other changes (such as running additional celery workers on different queues).

One use case for this setting is routing certain tasks to a different queue, and then running multiple Celery workers for these queues.

CELERY_CONFIG = {
    'task_routes': {
        'indico_livesync.task.scheduled_update': {'queue': 'livesync'},
    }
}

Default: {}

SCHEDULED_TASK_OVERRIDE

A dict overriding the task schedule for specific tasks.

By default, all periodic tasks are enabled and use a schedule which we consider useful for most cases. Using this setting, you can override the default schedule.

The dict key is the name of the task and the value can be one of the following:

None or False – disables the task completely
A dictionary, as described in the Celery documentation on periodic tasks. The task should not be specified, as it is set automatically.
A timedelta or crontab object which will just override the schedule without changing any other options of the task. Both classes are available in the config file by default.

Note

Use indico celery inspect registered to get a list of task names. Celery must be running for this command to work.

Default: {}

Customization

CUSTOMIZATION_DIR

The base path to the directory containing customizations for your Indico instance.

It is possible to override specific templates and add CSS and JavaScript for advanced customizations. When using this, be advised that depending on the modifications you perform things may break after an Indico update. Make sure to test all your modifications whenever you update Indico!

To include custom CSS and JavaScript, simply put *.css and *.js files into <CUSTOMIZATION_DIR>/css / <CUSTOMIZATION_DIR>/js. If there are multiple files, they will be included in alphabetical order, so prefixing them with a number (e.g. 00-base.css, 10-events.css) is a good idea.

Static files may be added in <CUSTOMIZATION_DIR>/files. They can be referenced in templates through the assets.custom endpoint. In CSS/JS, the URL for them needs to be built manually (/static/custom/files/...).

For template customizations, see the description of CUSTOMIZATION_DEBUG as this setting is highly recommended to figure out where exactly to put customized templates.

Here is an example for a template customization that includes a custom asset and uses inheritance to avoid having to replace the whole template:

{% extends '~footer.html' %}

{% block footer_logo %}
    {%- set filename = 'cern_small_light.png' if dark|default(false) else 'cern_small.png' -%}
    <a href="https://home.cern/" class="footer-logo">
        <img src="{{ url_for('assets.custom', filename=filename) }}" alt="CERN">
    </a>
{% endblock %}

Default: None

CUSTOMIZATION_DEBUG

Whether to log details for all customizable templates the first time they are accessed. The log message contains the path where you need to store the template; this path is relative to <CUSTOMIZATION_DIR>/templates/.

The log message also contains the full path of the original template in case you decide to copy it. However, instead of copying templates it is better to use Jinja inheritance where possible. To make this easier the log entry contains a “reference” path that can be used to reference the original template from the customized one.

Default: False

HELP_URL

The URL used for the “Help” link in the footer.

Default: 'https://learn.getindico.io'

FAVICON_URL

The URL to a custom favicon. If unset, the default monochrome Indico favicon is used.

Default: None

LOGO_URL

The URL to a custom logo. If unset, the default monochrome Indico logo is used.

Default: None

LOGIN_LOGO_URL

The URL to a custom logo used on the login page. If unset, the default Indico logo is used.

Default: None

WALLET_LOGO_URL

The URL to a custom logo used in Google Wallet and Apple Wallet tickets. If unset, a compact version of the default Indico logo is used. The URL must publicly accessible from the Internet and changes typically do not affect existing tickets.

Default: None

CUSTOM_COUNTRIES

A dict with country name overrides. This can be useful if the official ISO name of a country does not match what your Indico instance’s target audience expects for a country, e.g. due to political situations. By setting a country’s name to None you can pretend it does not exist. Custom country names can also be translated by using a dict mapping locale/language codes to the translated country names.

CUSTOM_COUNTRIES = {
    'KP': 'North Korea',
    'US': {
        'en_GB': 'United States of America',  # Translation based on specific locale
        'es': 'Estados Unidos'  # Translation based on language (regardless of specific locale)
    },
    'AQ': None,  # Remove Antarctica from the list
}

Default: {}

CUSTOM_LANGUAGES

A dict with language/territory name overrides. This can be useful if the official territory name that goes along with a language does not match what your Indico instance’s target audience expects for a country, e.g. due to political situations.

For example, to replace “Chinese (Simplified)” with “Chinese (China)”, you would use:

CUSTOM_LANGUAGES = {'zh_Hans_CN': ('Chinese', 'Simplified')}

Note that the language and territory name should be written in that particular language to be consistent with the defaults. So in the example above, you would write “Chinese” and “Simplified” in Simplified Chinese.

Setting the territory (second element in the tuple) to None will hide it and only show the language name itself. Setting the dict value to None will effectively hide the language altogether.

Default: {}

ALLOWED_LANGUAGES

A set of allowed language names. This can be useful if only specific languages should be available in your Indico instance, instead of all languages for which Indico provides translations.

For example, if you want to display only English and Spanish you can use:

ALLOWED_LANGUAGES = {'en_GB', 'es_ES'}

Default: None

CHECKIN_APP_URL

The URL of the mobile checkin app. The app is purely client-side and only communicates with your Indico instance, so even when using the default app (which is hosted in CERN’s datacenter in Switzerland) no data about your events or participants is sent to CERN, the Indico dev team or anyone else. If you wish to use a custom app nonetheless, you can find its source code on GitHub and deploy it wherever you want. Note that you need to add the URL of the app to the “Allowed authorization callback URLs” of the OAuth app named “Checkin App” in the Indico admin area.

Default: 'https://checkin.getindico.io'

Database

SQLALCHEMY_DATABASE_URI

The URI used to connect to the PostgreSQL database. For a local database, you can usually omit everything besides the database name: postgresql:///indico

If the database requires authentication and/or runs on a separate host, this form should be used: postgresql://user:password@hostname/dbname

SQLALCHEMY_POOL_SIZE

This setting configures SQLAlchemy’s connection pool. For details, check the SQLAlchemy connection pool documentation.

Default: 5

SQLALCHEMY_POOL_RECYCLE

This setting configures SQLAlchemy’s connection pool. For details, check the SQLAlchemy connection pool documentation.

Default: 120

SQLALCHEMY_POOL_TIMEOUT

This setting configures SQLAlchemy’s connection pool. For details, check the SQLAlchemy connection pool documentation.

Default: 10

Development

Warning

Do not turn on development settings in production. While we are not aware of serious security issues caused by these settings, they may slow down Indico or remove redundancies and thus make Indico not as stable as one would expect it to be in a production environment.

DEBUG

Enables debugging mode. If enabled, assets are not minified, error messages are more verbose and various other features are configured in a developer-friendly way.

Do not enable debug mode in production.

Default: False

DB_LOG

Enables real-time database query logging. When enabled, all database queries are sent to a socket where they can be read by the db_log.py script. To use the database logger, run bin/utils/db_log.py (only available when running Indico from a Git clone) in a separate terminal and all requests and verbose queries will be displayed there.

Default: False

PROFILE

Enables the Python profiler. The profiler output is stored in <TEMP_DIR>/*.prof.

Default: False

SMTP_USE_CELERY

If disabled, emails will be sent immediately instead of being handed to a Celery background worker. This is often more convenient during development as you do not need to run a Celery worker while still receiving emails sent from Indico. Disabling it may result in emails not being sent if the mail server is unavailable or some other failure happens during email sending. Because of this, the setting should never be disabled in a production environment.

Default: True

COMMUNITY_HUB_URL

The URL of the community hub. This should only be changed when using a local instance of Mereswine to debug the interface between Indico and Mereswine.

Default: 'https://hub.getindico.io'

SYSTEM_NOTICES_URL

The URL of a YAML file with system notices. This should only be changed during development (to test custom notices) or set to None to opt-out from ever fetching or displaying system notices.

Default: 'https://getindico.io/notices.yml'

DISABLE_CELERY_CHECK

Disables the warning about Celery not running or being outdated. When set to None, the warning is disabled when DEBUG is enabled; otherwise this setting enables/disables the warning regardless of debug mode.

Default: None

Directories

CACHE_DIR

The directory in which various data is cached temporarily. Must be accessible by the web server.

Default: '/opt/indico/cache'

LOG_DIR

The directory in which log files are stored. Can be overridden by using absolute paths in logging.yaml.

Default: '/opt/indico/log'

TEMP_DIR

The directory in which various temporary files are stored. Must be accessible by the web server.

Default: '/opt/indico/cache'

Emails

EMAIL_BACKEND

Qualified import name for the email sending backend. It can be set to any email backend compatible with Django Mail.

Default: 'indico.vendor.django_mail.backends.smtp.EmailBackend'

EMAIL_LOG_STORAGE

The name of the storage backend used to store email attachments when an email is logged in the context of an event.

If not set, email attachments are not stored.

Default: None

SMTP_SERVER

The hostname and port of the SMTP server used for sending emails.

Default: ('localhost', 25)

SMTP_LOGIN

The username to send if the SMTP server requires authentication.

Default: None

SMTP_PASSWORD

The password to send if the SMTP server requires authentication.

Default: None

SMTP_USE_TLS

If enabled, STARTTLS will be used to use an encrypted SMTP connection. This setting is mutually exclusive with SMTP_USE_SSL (SMTPS).

Default: False

SMTP_USE_SSL

If enabled, regular TLS (on connect) will be used for the encrypted SMTP connection. This is also known as SMTPS and usually on port 465. This setting is mutually exclusive with SMTP_USE_TLS (STARTTLS).

Warning

Note that the email handler for error log emails is not compatible with this setting, so when using it instead of STARTTLS you may want to tweak your logging.yaml to not attempt to send emails.

Default: False

SMTP_CERTFILE

If provided, this certificate file will be used for certificate-based SMTP authentication.

Default: None

SMTP_KEYFILE

If provided, this private key file will be used for certificate-based SMTP authentication.

Default: None

SMTP_TIMEOUT

The timeout in seconds after which a connection attempt to the SMTP server is aborted.

Default: 30

SMTP_ALLOWED_SENDERS

A list of allowed email senders for this Indico instance. Each entry must be an email address, but using the * wildcard is allowed. For any address not matching an entry in this list, the From address will be rewritten to the SMTP_SENDER_FALLBACK address, and the name (or email if no name is available) of the original sender will be used in the human-friendly part, e.g. John Doe (via Indico) <noreply@example.com>, while their email address will go into the Reply-to header.

For example, if your mail server only allowed sending emails from your domain example.com, you would set this setting to {'*@example.com'}. If only a specific sender address was allowed, you’d use e.g. {'indico@example.com'}.

Important

You most likely want to configure this setting to ensure emails sent from your Indico instance are not classified as junk, since email spoofing is nowadays being more and more frowned upon by large email providers, as it is commonly abused by spammers and threat actors.

Default: set()

SMTP_SENDER_FALLBACK

The envelope sender address to be used for any senders that are not whitelisted in SMTP_ALLOWED_SENDERS. This setting is required if the sender whitelist is used. Typically setting it to a no-reply address is a good choice.

Default: None

NO_REPLY_EMAIL

The email address used when sending emails to users to which they should not reply.

Default: None

PUBLIC_SUPPORT_EMAIL

The email address that is shown to users on the “Contact” page.

Default: None

SUPPORT_EMAIL

The email address of the technical manager of the Indico instance. Emails about unhandled errors/exceptions are sent to this address.

Default: None

Experimental Features

EXPERIMENTAL_EDITING_SERVICE

If enabled, event managers can connect the Editing module of their events to an external microservice extending the normal Editing workflow. As long as this is considered experimental, there are no guarantees on backwards compatibility even in minor Indico version bumps. Please check the reference implementation for details/changes.

Default: False

LaTeX

XELATEX_PATH

The full path to the xelatex program of TeXLive.

If it is installed in a directory in your $PATH, specifying its name without a path is sufficient.

If the path is not configured, any functionality that requires LaTeX on the server (such as generating the Book of Abstracts or exporting contributions to PDF) will be disabled.

For security reasons we recommend setting this to the special string 'podman' and installing Podman on the system. That way, any LaTeX rendering will be done in a container, and thus fully sandboxed from the rest of Indico. When using this string, a default TeXLive image is used.

You can also use the 'podman:foo=123,bar=456' syntax to customize the podman behavior using the following options:

image – a custom image, using any format that both podman pull and podman run understand
connection – a podman connection name when using the local podman service (defaults to not using the service)
timeout – a timeout (in seconds) after which the LaTeX build container is killed (defaults to no timeout)
allow_pull – when set to false, a missing image is not pulled but generating the PDF fails; when using this option, the image must be pulled using indico maint pull-latex-image or directly using podman

Default: None

STRICT_LATEX

Enables strict mode for LaTeX rendering, in which case a non-zero status code is considered failure.

LaTeX is rather generous when it comes to using a non-zero exit code. For example, having an oversized image in an abstract is enough to cause one. It is generally not a good idea to enable strict mode as this will result in PDF generation to fail instead of creating a PDF that looks slightly uglier (e.g. a truncated image) than one that would succeed without a non-zero status code.

Default: False

LATEX_RATE_LIMIT

Applies a rate limit to public endpoints that generate PDFs using LaTeX when accessed by people who are not logged in (such as crawlers).

Rate limiting is applied by IP address.

The default allows 2 PDF generations every 3 seconds. Setting the rate limit to None disables it.

Default: '2 per 3 seconds'

Logging

LOGGING_CONFIG_FILE

The path to the logging config file. Unless an absolute path is specified, the path is relative to the location of the Indico config file after resolving symlinks.

Default: 'logging.yaml'

SENTRY_DSN

If you use Sentry for logging warnings/errors, you can specify the connection string here.

Default: None

SENTRY_ENVIRONMENT

If you use Sentry for logging warnings/errors, you can specify the environment name here. This can be used to distinguish data from separate Indico installations that are logged to the same Sentry project.

Default: 'production'

SENTRY_LOGGING_LEVEL

The minimum level a log record needs to have to be sent to Sentry. If you do not care about warnings, set this to 'ERROR'.

Default: 'WARNING'

Security

ALLOW_PUBLIC_USER_SEARCH

If disabled, users without management permissions cannot search for existing Indico users. This affects places such as abstract submission, material ACLs and the verbosity of the email status check (whether the registration will be linked to an Indico account) while registering for an event.

It is recommended to disable this setting in case you run a public instance with strong privacy requirements that weigh heavier than the convenience of being able to search Indico users.

Note that this setting is only effective if event creation is properly restricted since otherwise any user can just create an event where they then have management permissions and thus the ability to search for users. This also means that unlisted events must be disabled or restricted to trusted users.

Default: True

SECRET_KEY

The secret key used to sign tokens in URLs. It must be kept secret under all circumstances.

When using Indico on a cluster of more than one worker, all machines need to have the same secret key.

The initial key is generated by the setup wizard, but if you have to regenerate it, the best way of doing so is running this snippet on a shell: python -c 'import os; print(repr(os.urandom(32)))'

Default: None

SESSION_LIFETIME

The duration of inactivity after which a session and its session cookie expires. If set to 0, the session cookie will be cleared when the browser is closed.

Default: 86400 * 31

SESSION_MAX_LIFETIME

The duration (in seconds) after which a session always expires. If set to None, only the SESSION_LIFETIME is used and the session can be renewed indefinitely as long as there is activity before its expiry. This setting is ignored if a custom Multipass provider specifies its own maximum lifetime via the session_expiry entry in the multipass_data.

Default: None

CSP_ENABLED

Specifies whether a Content-Security-Policy header should be sent. This can also be set to 'report-only' to use Content-Security-Policy-Report-Only instead (only useful when a CSP_REPORT_URI is set or when using your browser’s dev tools console to look for errors).

Default: False (may change in a future release)

CSP_REPORT_URI

Specifies the URL to which CSP violations should be reported. When using Sentry, you can use the “Report URI” which you can find in your project settings under “Security Headers”.

Default: None

CSP_SCRIPT_SOURCES

By default only script-src values needed for Indico to work are included. If you embed external scripts from other hosts, you may need to include them here or they will not work (use your browser’s dev tools to check for log messages related to CSP violations). Note that you MUST NOT add any nonce values there, as this would make the whole policy useless (knowing the nonce in advance means you can set it on any maliciously injected script). The values specified here are not automatically wrapped in single quotes, so if you want to include e.g. a hash, you need to manually quote it.

Default: set()

CSP_DIRECTIVES

Specify custom top-level CSP directives. This can include any CSP directive besides script-src which is already handled by Indico itself (use CSP_SCRIPT_SOURCES if you need to add custom values there) and base-uri which is always set to 'self'.

Default: set()

Storage

STORAGE_BACKENDS

The list of backends that can be used to store/retrieve files.

Indico needs to store various files such as event attachments somewhere. By default only a filesystem based storage backend is available, but plugins could add additional backends. You can define multiple backends, but once a backend has been used, you MUST NOT remove it or all files stored in that backend will become unavailable.

To define a filesystem-based backend, use the string fs:/base/path. If you stopped using a backend, you can switch it to read-only mode by using fs-readonly: instead of fs:

Other backends may accept different options - see the documentation of these backends for details.

Default: {'default': 'fs:/opt/indico/archive'}

ATTACHMENT_STORAGE

The name of the storage backend used to store all kinds of attachments. Anything in this backend is write-once, i.e. once stored, files in it are never modified or deleted.

Changing this only affects new uploads; existing files are taken from the backend that was active when they were uploaded – which is also why you must not remove a backend from STORAGE_BACKENDS once it has been used.

Default: 'default'

STATIC_SITE_STORAGE

The name of the storage backend used to store “offline copies” of events and material packages. Files are written to this backend when generating an offline copy and deleted after a certain amount of time. When someone requests a material package for an event, it is also written to this backend, and deleted about a day later.

If not set, the ATTACHMENT_STORAGE backend is used.

Default: None

MAX_DATA_EXPORT_SIZE

The maximum file size (in MB) for files added to the user data export archive. Note that this limit does not apply to the YAML metadata files which are always generated and typically do not exceed a few megabytes. However, any additional files such as attachments, papers, etc., that the user might have and that do not fit within the limit are not included in the exported archive. The default size is 10 GB.

Default: 10 * 1024

MATERIAL_PACKAGE_RATE_LIMIT

Applies a rate limit to public endpoints that build material packages.

Rate limiting is applied by IP address.

The default allows 3 packages per 30 minutes, and an additional 3 once per day in case someone builds separate packages e.g. for sessions. Setting the rate limit to None disables it.

Depending on how limited your storage space is, especially in relation to the amount of materials (slides etc.) in your events, you may want to go for an even stricter rate limit.

Default: '3 per 30 minutes, 3 per day'

System

BASE_URL

This is the URL through which Indico is accessed by users. For production systems this should be an https:// URL and your web server should redirect all plain HTTP requests to HTTPs.

Default: None

USE_PROXY

This setting controls whether Indico runs behind a proxy or load balancer and should honor headers such as X-Forwarded-For to get the real IP address of the users accessing it.

The headers taken into account are:

X-Forwarded-For – the IP address of the user
X-Forwarded-Proto – the protocol used by the user
X-Forwarded-Host – the hostname as specified in BASE_URL (can be omitted if the Host header is correct)

Warning

This setting MUST NOT be enabled if the server is accessible directly by untrusted clients without going through the proxy or users will be able to spoof their IP address by sending a custom X-Forwarded-For header. You need to configure your firewall so only requests coming from your proxy or load balancer are allowed.

Default: False

ROUTE_OLD_URLS

If you migrated from an older Indico version (v1.x), enable this option to redirect from the legacy URLs so external links keep working.

Default: False

STATIC_FILE_METHOD

This setting controls how static files (like attachments) are sent to clients.

Web servers are very good at doing this; much better and more efficient than Indico or the WSGI container, so this should be offloaded to your web server using this setting.

When using Apache with mod_xsendfile or lighttpd, set this to 'xsendfile' and of course enable xsendfile in your Apache config.

When using nginx, set this to ('xaccelredirect', {'/opt/indico': '/.xsf/indico'}) and add an internal location handler to your nginx config to serve /opt/indico via /.xsf/indico:

location /.xsf/indico/ {
  internal;
  alias /opt/indico/;
  add_header Content-Security-Policy $upstream_http_content_security_policy;
  add_header Content-Security-Policy-Report-Only $upstream_http_content_security_policy_report_only;
  add_header Reporting-Endpoints $upstream_http_reporting_endpoints;
}

The production installation instructions already configure this properly, so if you installed Indico using our guide, you only need to change this setting if you add e.g. a new storage backend in STORAGE_BACKENDS that stores the files outside /opt/indico.

Default: None

MAX_UPLOAD_FILE_SIZE

The maximum size of an uploaded file (in MB). A value of 0 disables the limit.

This limit is only enforced on the client side. For a hard limit that is enforced on the server, see MAX_UPLOAD_FILES_TOTAL_SIZE

Default: 0

MAX_UPLOAD_FILES_TOTAL_SIZE

The maximum size (in MB) of all files uploaded in a single request (or to be more exact, any data contained in the body of a single request).

A value of 0 disables the limit, but most web servers also have limits which need to be configured as well (client_max_body_size in nginx) to allow very large uploads.

Default: 0

DEFAULT_LOCALE

The locale that is used by default for i18n. Valid values are en_GB, fr_FR, and es_ES.

Default: 'en_GB'

DEFAULT_TIMEZONE

The timezone that is used by default. Any timezone identifier such as Europe/Zurich or US/Central can be used.

Default: 'UTC'

ENABLE_ROOMBOOKING

Whether to enable the room booking system.

Default: False

ENABLE_GOOGLE_WALLET

Whether to enable the Google Wallet integration for event tickets.

Default: False

ENABLE_APPLE_WALLET

Whether to enable the Apple Wallet integration for event tickets.

Default: False

DISABLE_GRAVATAR

Completely disables the Gravatar integration. When enabled, users will no longer see Gravatar or Identicon options on the profile-picture page and Indico will not try to fetch updates from gravatar.com.

Default: False

CHECK_ACTION_PERMISSIONS

When enabled, certain action buttons in the UI (such as “Create event”) will be displayed to logged-in users only if they have the necessary permissions to perform that action.

When disabled, buttons are always shown, even to non-logged in users (who will be redirected to login when clicking).

Note

For performance reasons the access check for the “Create event” button only takes into account permissions granted directly to the user, via a local group or via a category role. When using externally-managed groups (e.g. LDAP), then this setting should not be enabled as people may not see the button even though they have creation privileges. When using a custom plugin that grants creation or management access to categories bypassing Indico’s usual permission system, this setting should also not be used.

Default: False

ALLOW_ADMIN_USER_DELETION

Whether to allow administrators to permanently delete users from the Indico UI.

If enabled, any Indico administrator can permanently delete a user from Indico, along with all their associated user data. If it is not possible to delete the user (e.g. because they are listed as a speaker at an event), the user will be anonymized instead.

Default: False

PLUGINS

The list of Indico plugins to enable.

A list of all installed plugins can be displayed by the indico setup list-plugins command; see the guide linked above for details on how to enable plugins.

Default: set()

CATEGORY_CLEANUP

This setting specifies categories where events are automatically deleted a certain amount of days after they have been created.

For each entry, the key is the category id and the value the days after which an event is deleted.

Warning

This feature is mostly intended for “Sandbox” categories where users test Indico features. Since it is common for such categories to be used for real events nonetheless, we recommend enabling the “Event Header” in the category settings and clearly mention that the event will be deleted after a while.

Default: {}

WORKER_NAME

The name of the machine running Indico. The default value is usually fine unless your servers have ugly (e.g. auto-generated) hostnames and you prefer nicer names to show up in error emails.

Default: socket.getfqdn()