Configuration & Secrets Reference

Enables the ops surface (/api/v1/admin and the legacy api/* routes). Unset, every ops endpoint answers 503. Compared in constant time.

Live market data. Unset, the engine falls back to the bundled CSV provider — which is for development only, but does mean the engine runs and can be measured with no account anywhere.

Telegram publishing and review.

SQLite path. Docker default Data Source=/data/quant.db on a shared volume.

Unset, billing is disabled everywhere and the dashboard falls back to manual upgrades — and says so to the user rather than failing silently.

Signing secret for POST /api/v1/billing/webhook. The endpoint answers 503 until it is set.

Stripe price ids per plan code. Only mapped plans are purchasable.

SMTP delivery, any provider. With the host unset, emails become log lines — which means the password-reset flow silently does nothing.

Sqlite for a single node, or Postgres via Npgsql. Postgres needs its own migration set.

Set false on multi-node deployments and run the Migrator once first, so nodes don't race Migrate().

When set, the API quota and the login lockout use Redis — shared across nodes — instead of in-process counters. Required for horizontal scaling.

Scheduled verified backups in the bot host. Turn off only where an external process snapshots the volume.

Relative paths resolve next to the database. Set an absolute path on a separate volume in production — a same-disk copy dies with the disk.

Copies kept. Older ones are pruned after each run, ordered by the UTC timestamp in the filename.

Gap between automatic runs. One always runs at host startup.

The only way anyone becomes an operator. A string array of email addresses; a signed-in user whose address is on it reaches the admin pages, and nobody else does.

Empty means nobody. AdminAccess fails closed, and the admin page says it is unconfigured rather than pretending the account lacks permission.

It is configuration and not a database row on purpose: an attacker who reaches the database through the application still cannot grant themselves the operator pages. It ships empty, and the buyer sets their own address.

Must point at the same database as the API and the bot — /data/quant.db under Docker. All three hosts ship pointing at the bot's file: ../QuantMarketEngine.TelegramBot/quant.db from the API and the Dashboard, quant.db from the bot itself.

Getting this wrong does not error. The host attaches to a different file, and the interface looks empty while working perfectly.

The host refuses to start without it outside Development. It persists cookie-encryption keys across restarts — /data/dp-keys under Docker.

Unset, ASP.NET Core generates a key ring per process, so every restart signs out every subscriber with nothing in the logs to say why.

Shown on the Billing and Support pages. Set the real address before launch.

Full path to Chrome, Edge or Chromium. Leave empty to search the usual install locations.

false switches PDF export off even where a browser is installed.

Starts the browser with its sandbox disabled. Needed where a container runs as root without the kernel namespaces Chrome requires — there it will not start at all.

Off by default because the flag makes the feature work everywhere and weakens it everywhere, and that is the host's call rather than ours. The log names this setting when a failed print looks like a sandbox refusal.

Ceiling on one print before the browser is killed. A real print takes about a second.

What each analysed symbol is correlated against — the layer behind the correlation bars in the report.

CrossAsset:Enabled · default true. false skips the layer entirely.

CrossAsset:Map · default [], meaning the built-in EUR/USD institutional set: DXY, gold, the US 10-year yield. Entries are { BaseSymbol, Symbol, Label }.

An instrument the data provider cannot serve is skipped at run time rather than failing the report, so listing an index or a yield here is safe even on a forex-only free tier.

The US macro backdrop: inflation, policy rate, labour.

Enabled true · Timeframe MONTHLY · FreshnessDays 45 · AttemptIntervalDays 1 · Indicators [] for the built-in dollar-macro set.

AttemptIntervalDays is the setting that governs cost, not FreshnessDays. US macro publishes on a one-to-two-month lag, so the newest print available is routinely older than any sane freshness gate and the data can never make itself look current. Before this existed, four indicators were re-fetched on every single run and returned the same figures each time.

Cost: at most one provider call per indicator per day — a few calls a month.

A hand-maintained list of upcoming high-impact releases, used to warn that a reading sits inside a blackout window. The code default is off because it is a list somebody has to keep writing: it has no feed behind it, and a stale calendar is worse than none because it warns about the wrong days.

The bot's appsettings.json turns it on and carries 14 central-bank and US releases through 17 December 2026. When that list runs out the layer goes quiet rather than wrong — but it is a maintenance task with a date on it, and the buyer should be told which date.

BlackoutWindowHours 24 · MinimumImpact High · Events entries are { Name, ScheduledAt (UTC), Impact, Currencies[] }, where empty currencies means global.

Enabled false · DataFilePath empty. Point the path at a hand-filled JSON file of releases, rates and stances to feed the layer with test data.

Turning it on does not put hand-entered figures in front of a client. The provider reports IsLiveSource=false and the output mapper drops the values. The layer exists to be developed against, and the fence is in code so that a future contributor cannot enable it into production by flipping a flag.

From @BotFather. Empty and the bot stays idle — no receiver, no scheduler. The rest of the host still runs.

Private chat id of the human reviewer. This is the approval gate's inbox.

Channel id or @username where approved reports are published.

Symbols the scheduled worker analyses each cycle. Intentionally empty in code: the .NET binder appends to a non-empty default array, so a default of ["EURUSD"] plus the same value in appsettings binds to ["EURUSD","EURUSD"] and generates every report twice. The value comes from configuration only.

Timeframe the scheduled worker requests.

How often the scheduled worker runs.

The event-driven watcher. It runs more often than the scheduled cycle but only queues a report when it detects a structural change or a regime flip.

The bot's appsettings.json switches it off. This is the "event-driven trigger ships disabled" line in the sale material — and it is a configuration value, not missing code.

Minutes between detection passes. Clamped to a minimum of 1.

Lets startup migrations and the data load settle first.

The self-scoring loop — the background VaR backtest that produces the calibration record. Turning it off stops the product's central claim from being earned.

Clamped to a minimum of 1.

Lets startup migrations and the data load settle first.

Maximum analyses scored per pass.

Empty disables web publishing. Set it and approved reports are written there.

Used on the Arabic pages, where it carries the Arabic tagline.

Kept separately rather than derived from the above: printing the Arabic tagline on an English page was the last thing left untranslated when the site went bilingual.

Fixed-window per-IP perimeter limit; 429 beyond it. Health endpoints are exempt.

CORS origins. Empty means no CORS at all.

TTL of the in-process analysis cache, per symbol and timeframe. 0 disables it.

Standard Serilog configuration section.

The symbol catalogue. Shared by every host, so a symbol added here is a symbol the whole platform knows about.

Process liveness, with no dependencies.

Includes a database round-trip.

Logs are structured via Serilog and every request carries one, honouring an inbound X-Correlation-Id.