Configuration

Jadarit reads a single config.toml. Every setting has a default, so a missing file or a missing key still works, and the first run writes a fully commented file you can edit.

Where the file lives

Install	Path
Debian package	`/etc/jadarit/config.toml`
Container	mounted into the data volume
Run from a directory	`config.toml` beside the binary

Set MS_CONFIG to override the path. MS_API_TOKEN overrides the API token from the environment, so a secret need never be written to the file.

Changing settings through the dashboard or PUT /api/v1/settings writes this file. Changes take effect on restart, and the API says so rather than pretending they applied live.

`[server]`

Where the server listens and where it keeps its data.

Key	Type	Default	Description
`http_addr`	`String`	`"0.0.0.0:9001"`	HTTP bind address for API + dashboard + HLS.
`rtmp_port`	`u16`	`1935`	RTMP ingest port.
`data_dir`	`String`	`"data"`	Root of vod/live/ads data directories.
`api_token`	`String`	`""`	Bearer token for the control API. Empty = auth disabled. The MS_API_TOKEN environment variable overrides this.
`trusted_proxies`	`Vec<String>`	`["127.0.0.1/32", "::1/128"]`	Addresses or CIDR ranges of reverse proxies and CDNs in front of the server. Only from these is X-Forwarded-For believed: anyone else could claim any address, and a viewer’s address is what ad servers target and count.

`[srt]`

SRT ingest: the UDP port encoders push to, how long to wait for lost packets, and optional encryption.

Key	Type	Default	Description
`enabled`	`bool`	`true`	Accept SRT publishers. On by default, like RTMP.
`port`	`u16`	`8890`	UDP port encoders connect to. 8890 is the port most SRT users already know from other media servers.
`latency_ms`	`u32`	`120`	How long, in milliseconds, to wait for lost packets to be resent before giving up on them. Higher survives worse networks at the cost of delay; the publisher’s own setting is used if it asks for more.
`passphrase`	`String`	`""`	Encrypt SRT with this passphrase (10 to 79 characters). Empty means unencrypted. When set, publishers that do not use it are refused.

`[tls]`

Built-in HTTPS. Most deployments put a reverse proxy or tunnel in front instead.

Key	Type	Default	Description
`enabled`	`bool`	`false`	Serve HTTPS on `https_addr` in addition to HTTP.
`https_addr`	`String`	`"0.0.0.0:9443"`	Address to serve HTTPS on when `enabled` is true.
`cert_path`	`String`	`""`	PEM paths. Both empty + enabled → a self-signed certificate is generated under <data_dir>/tls/ on startup.
`key_path`	`String`	`""`	Private key matching `cert_path`. Leave both empty to self-sign.

`[hls]`

Segment length and how much of the live window is kept.

Key	Type	Default	Description
`segment_secs`	`f64`	`2.0`	Target segment duration (seconds). Cuts happen at the first keyframe past this mark.
`window_segments`	`usize`	`20`	Segments kept in the live playlist window.
`sessions`	`bool`	`true`	Give every HLS viewer a session of their own: a player asking for a stream’s playlist is redirected once to a per-viewer address. Needed to count HLS viewers and to choose ads per viewer.

`[conditioning]`

How uploaded VOD and ad assets are normalised so they play out cleanly.

Key	Type	Default	Description
`preset`	`String`	`"veryfast"`	x264 preset for offline mezzanine conditioning.
`crf`	`u8`	`20`	Quality target. Lower is better and larger; 18 to 23 is the useful range.
`maxrate_kbps`	`u32`	`6000`	Ceiling on the conditioned video bitrate.
`audio_bitrate_kbps`	`u32`	`160`	Bitrate for the conditioned audio track.

`[webrtc]`

WebRTC networking. Set these to serve viewers beyond the local network.

Key	Type	Default	Description
`public_ip`	`String`	`""`	Public IP advertised as an additional ICE candidate. Set this (plus a router port-forward for the UDP range) to serve viewers outside the LAN. Empty = LAN-only.
`udp_port_min`	`u16`	`0`	UDP port range for WebRTC sessions. 0/0 = ephemeral (LAN only); a fixed range is what you forward on the router.
`udp_port_max`	`u16`	`0`	Top of that range. Forward min..=max on the router.
`bwe_initial_mbps`	`u32`	`10`	Bandwidth-estimation budget in Mbps. The pacer drains at current × 1.1.
`bwe_current_mbps`	`u32`	`8`	Working budget the pacer drains against. Keep it above the real media bitrate or the pacer starves the stream.
`send_buffer_video`	`usize`	`4096`	Packet ring shared by pacing queue and NACK history.

`[ssai]`

Defaults for server-side ad insertion.

Key	Type	Default	Description
`default_break_secs`	`f64`	`10.0`	Default ad-break length when the API request omits duration_secs.

`[logging]`

Log level, destination, rotation, and the in-memory buffer the dashboard reads.

Key	Type	Default	Description
`level`	`String`	`"info"`	Level filter, e.g. `info`, `debug`, or per-module `info,ms_egress=debug`. RUST_LOG overrides this when set.
`directory`	`String`	`"data/logs"`	Where log and crash files go. Relative paths are relative to the working directory; empty disables file logging (stdout only).
`json`	`bool`	`false`	Write JSON lines instead of human-readable text. Useful when shipping logs into a collector; harder to read by eye.
`retention_days`	`u64`	`14`	Delete rotated log files older than this many days. 0 keeps them all.
`ring_capacity`	`usize`	`2000`	How many recent events to keep in memory for the dashboard viewer.

`[license]`

Licence renewal. Monthly and yearly licences fetch their renewal from jadarit.com; set renew_url to an empty string for an air-gapped install.

Key	Type	Default	Description
`renew_url`	`String`	`"https://jadarit.com/pay/licence/renew"`	Where to fetch a renewed licence. Only a licence with an expiry ever checks in, sending nothing but its licence id; trials and lifetime licences never contact anything. On by default so a customer who renews from the reminder email has nothing else to do. Empty disables the check entirely, which is what an air-gapped install wants.