Configuration and security
System storage
Section titled “System storage”| Setting | Purpose |
|---|---|
SUPER_DB_MANAGER_DATABASE_PROVIDER |
System database provider, default H2 |
SUPER_DB_MANAGER_DATABASE_URL |
System database JDBC URL |
SUPER_DB_MANAGER_DATABASE_USERNAME |
Remote system database username |
SUPER_DB_MANAGER_DATABASE_PASSWORD |
Remote system database password |
SUPER_DB_MANAGER_STORAGE_CONFIG |
Bootstrap configuration path |
SUPER_DB_MANAGER_DATABASE_LOCAL_PATH |
Local H2 file path |
APP_SECRET / STORAGE_CONFIG_SECRET |
Encryption key for stored passwords |
Saving remote system storage through the setup screen requires an encryption key so the bootstrap file does not contain a plaintext password.
Transfer artifacts
Section titled “Transfer artifacts”| Setting | Purpose |
|---|---|
SUPER_DB_MANAGER_TRANSFER_STORAGE_DIR |
Transfer artifact directory |
SUPER_DB_MANAGER_TRANSFER_FILE_RETENTION_HOURS |
Result and error report retention |
SUPER_DB_MANAGER_TRANSFER_JOB_RETENTION_DAYS |
Job-record retention |
SUPER_DB_MANAGER_TRANSFER_CLEANUP_INTERVAL_MS |
Cleanup interval |
SUPER_DB_MANAGER_TRANSFER_DOWNLOAD_LEASE_SECONDS |
Download lease duration |
Expired files become unavailable immediately. Physical deletion waits for active download leases to finish.
Credential security
Section titled “Credential security”- Data-source passwords use AES-GCM encryption.
- Configure a stable, high-entropy key before saving credentials.
- Losing or changing the key makes existing encrypted passwords unreadable.
- Legacy plaintext data-source passwords migrate to encrypted storage on startup.
- Inject keys and system-database passwords through a production secret manager.
Network boundary
Section titled “Network boundary”Expose the management console only over HTTPS in a controlled network. Apply network policy to JDBC targets so the portal server does not become an unrestricted database jump host.