Daemon configuration

The daemon reads its settings from daemon.properties. Most of it is written for you during install and rarely needs editing by hand.

Where the file lives

The daemon resolves <root>/daemon.properties, where <root> is, in order:

The -directory command-line argument, if passed
The GAMEDASH_ROOT_DIR environment variable, if set
The directory containing the wrapper JAR

Packaged installs resolve to /var/lib/gamedash/daemon.properties. The package also creates a symlink at /etc/gamedash/daemon.properties pointing back at the real file, so the conventional admin path works.

Precedence

For any key, the value that wins at read time is:

An environment variable named after the key
The value in daemon.properties
The consumer's built-in default

Command-line flags act by writing into daemon.properties, which means a live environment variable shadows a value supplied by a flag. Flags read directly rather than through the config file — -directory, -dev, -run-directly — sit outside this and are unaffected.

Required keys

Written by the installer. Treat tokens as secrets.

Key	Default	Purpose
`api.client.domain`	(none)	The panel this node reports to
`api.client.port`	443 or 80	Panel port; falls back to the scheme default
`api.client.security.enabled`	`true`	Whether outbound calls use HTTPS
`authentication.token`	(none, secret)	Authenticates this node in both directions

api.client.security.enabled is the key actually read. A similarly-named api.client.secure appears in older configurations and is read by nothing — if you have it, it is doing nothing.

An api.client.domain containing host:port is still accepted but deprecated. It is split into hostname and port at read time and logs a warning at boot.

TLS keystore

By default the daemon generates an ephemeral self-signed certificate at every start. No keytool step, no manual keystore.

Key	Default	Purpose
`security.keystore.autoGenerate`	`true`	Generate a certificate when none is configured
`security.keystore.file`	(none)	Path to your own keystore
`security.keystore.password`	(none, secret)	Its password
`security.keystore.isSelfSigned`	`false`	Marks a supplied keystore as self-signed

Leave file and password unset to use the automatic certificate.
Set both to supply your own; the daemon then uses it verbatim and skips generation.
Set autoGenerate=false to require an explicit keystore — the daemon fails fast at startup if none is configured. Use this on hardened deployments.

The generated certificate is not pinned and changes every boot, so it provides confidentiality but not server authentication. Supply a persistent keystore if you need pinning.

Ports

Key	Default	Service
`api.server.http.port`	`2145`	Plain HTTP API
`api.server.https.port`	`2147`	TLS API
`relay.server.port`	`2153`	TCP relay
`ssh.server.port`	`2149`	SSH, only bound when enabled

Note that the panel supplies the ports it wants a node to bind, and that takes precedence over both this file and the compiled defaults. See Ports & firewall.

SSH and SFTP

Off by default. ssh.server.enabled must be exactly true to turn it on.

Key	Default	Purpose
`ssh.server.enabled`	`false`	Enable the SSH server
`ssh.server.maxAuthRequests`	`3`	Auth attempts per connection
`ssh.server.session.authTimeoutSeconds`	`30`	Time allowed to authenticate
`ssh.server.session.idleTimeoutSeconds`	`600`	Idle time before disconnect
`ssh.server.session.maxPerUser`	`5`	Concurrent sessions per tenant; 0 or less is unlimited
`ssh.server.container.enabled`	`true`	Run a tenant's session inside their container
`ssh.server.container.label`	`com.gamedash.ssh.user`	Docker label naming the owning tenant
`ssh.server.container.shell`	`/bin/sh`	Shell started inside the container
`ssh.server.auth.maxFailures`	`5`	Failures from one address before blocking
`ssh.server.auth.blockSeconds`	`30`	Base block; doubles per failure, capped at an hour

ssh.client.keys.enabled is a separate setting covering key authentication on the SFTP transport — it is unrelated to ssh.server.enabled. If you use it, ssh.client.username.prefix must match the panel's own user-name prefix.

Other settings worth knowing

Key	Default	Purpose
`enforcePerformanceGovernor`	`false`	Force the `performance` cpufreq governor on Linux
`fileSystem.file.upload.session.chunk.directory`	`<root>/uploads/chunks`	Chunked upload staging
`childProcess.terminal.io.output.history.size`	`1000`	Console lines retained per child for replay

Command line

Flags that change behaviour rather than configuration:

Flag	Effect
`-directory`	Set the root directory
`-dev`	Development mode
`-run-directly`	Permit running the daemon JAR without the wrapper
`-install-only`	Run the install flow and exit
`-uninstall`	Uninstall
`-skip-node-status-handshake`	Skip the initial handshake with the panel

The -installer-* family sets the required keys above during an unattended install.