Configuration

Website reading edition · D1–D3 accepted source, schema 37. The older 0.1.0 binary download predates this work. Current status · Start here.

Current source also provides sfconfig, the native typed online/offline configuration application. This chapter documents the established stopped-board compatibility menu, including its identity/conference/file editors. Both paths retain shared parsing/validation and exclusive offline ownership.

Status

• Verified: Normal setup/configuration has created and reopened board identity, node/listener policy, conferences, file areas, and the packaged Modern presentation on clean boards.
• Development Preview: The interactive spitfire config surface below is the current supported operator boundary.
• Planned: Live reload, broad destructive maintenance, safe board-path relocation, and a remote administration interface are not implemented.

Use the supported configuration surface

Stop the board, then run:

spitfire config /path/to/board/spitfire.toml

The interactive menu validates configuration and coordinates with runtime, backup, and restore through the board-wide operation lock. This stopped-board menu does not perform live reload; normal online administration uses sfconfig.

The important save rule

The menu has two kinds of changes:

This distinction is intentional because static configuration lives in TOML, while conferences and file areas are operational records in SQLite.

1. General system and Sysop identity

This section edits:

• board name;
• Sysop display name;
• IANA board timezone;
• public/private admission and private threshold; and
• Sysop caller name.

The Sysop display name is branding. The Sysop caller name must match an actual caller account and is used for login and Comment to Sysop. Setup creates that account. Changing names does not create or rename a caller.

Daily policy follows the configured board-local civil date. Choose the real operating timezone instead of leaving UTC accidentally.

2. Nodes

The node count is the number of simultaneous sessions one server process may own. Node allocation is transport-independent and selects the lowest waiting enabled node. Reducing the count removes out-of-range overrides when the static configuration is saved.

The native model supports one process owning the node pool. Do not start run, console, or shell as independent concurrent owners of one board.

3. Terminal services

The menu lists configured services and edits one service's enabled state and network bind endpoint. Normal setup creates Telnet, RAW TCP, RLogin, and a disabled SSH entry. Enabling SSH during setup defaults to loopback port 2222 and generates its board-local Ed25519 key only when the listener first starts.

Both setup and this configuration surface accept y, yes, n, and no case-insensitively, preserve Enter/default behavior, and reprompt after invalid input. Disabling a listener skips its bind/port questions; validated internal defaults may remain stored for a later re-enable.

Telnet, RAW, and RLogin do not encrypt passwords or terminal content. Binding beyond loopback is an explicit risk decision. SSH encrypts the caller connection and enters the same BBS session; it never provides a host shell, SCP, SFTP, forwarding, or remote commands. Keep it disabled until the bind, firewall, password policy, host-key backup, and caller login identifiers have been reviewed. See Secure SSH Caller Transport.

Use ports above 1024 unless the host has been deliberately configured for a privileged service. Every enabled listener must have a unique endpoint. Port 2222 is the SSH caller default; port 22 is allowed when host permissions and service conflicts have been handled deliberately.

Caller login, Handle and private names

The Login identifier authenticates callers on all supported caller transports. Handle is caller-facing presentation identity. First Name and Last Name are private profile components; editing them does not change credentials or old messages.

IDENTITY Current Handle|pixelwizard|PixelWizard
NAMES PixelWizard|Avery|Example

Use the local operator console for these authorized commands. The old fourth full-name IDENTITY field is retired; legacy values remain preserved. Caller Main R edits private components. Board Require first and last name controls signup collection; Posting identity controls the fallback used by conferences. Both default to handle-friendly operation. A mapped network can impose a stricter posting rule, displayed before the caller submits. See caller management and the identity contract.

4. Security and caller defaults

This section controls:

• new-caller numerical security;
• minutes per call and per board-local day;
• first-day minutes;
• maximum calls per board-local day;
• keyboard-idle timeout;
• the optional fixed post-login journey (none or engine-owned stock); and
• disabled/optional/required postal, phone, email, and birth-date groups; and
• optional subscription warnings and expired-security policy.

Numerical security gates menu commands, conferences, file areas, and the caller-facing Sysop boundary. Keep the ordinary new-caller level below the Sysop threshold. Collect only profile data the board actually needs; contact fields are private, but unnecessary collection is still unnecessary risk. The stock post-login journey reads real message, caller, and new-file state before Main. It is board/session policy, not a presentation-profile script.

Subscription policy is off by default. To enable it on a stopped board, edit the caller section in spitfire.toml:

[caller.subscription]
enabled = true
warning_days = 7
expired_security = 5

warning_days must be 0–365 and expired_security must be 0–9999. Dates are assigned per caller from spitfire console; they remain valid through the displayed date in the board's configured time zone. Expiry lowers effective security without overwriting base security. See Caller Management.

5. Message conferences

The conference screen can add, edit, enable, or disable a conference. It configures caller-visible number/name/description, read and post security, threshold versus exact read access, public-only policy, caller message-deletion policy, and maximum message lines. Caller deletion permits the sender, direct recipient, or CC recipient to tombstone only that delivery. It never grants an unrelated caller authority and does not limit threshold-Sysop mutation.

Conference 1 is mandatory because Comment to Sysop uses it. Disabling a conference preserves messages and identity. There is no destructive conference delete or message-purge workflow in the Development Preview.

6. File areas

The area screen can add, edit, enable, or disable an area. It configures:

• caller-visible number, name, and long description;
• immutable safe storage key;
• read and upload security;
• threshold versus exact access;
• lower-security preview;
• no-charge behavior;
• maximum upload MiB; and
• up to five privileged security levels.

Creating an area also creates its confined storage directory. Its number and storage key cannot be changed later because a casual edit must not orphan metadata or bytes. Disabling preserves both.

7. Presentation profile

Normal setup selects modern-ng as both active and base. Section 7 can change the two confined profile IDs or select legacy-resources for a pre-M031 board that still owns direct SYSTEM/DISPLAY content. It also selects display-overrides or generated menu presentation. Generated mode derives Main/Message/File/Sysop directly from the parsed, security-filtered .MNU authority; display-overrides mode accepts exact-security board/active-profile BBS/CLR art and generates safely when it is absent, malformed, or unsupported. At a capable 80-column ANSI terminal, generated mode uses equal 30-character cells with a fixed eight-character gutter. Plain, constrained, or overlong localized output falls back to a bounded single column without changing commands or authority.

These two modes can look different for callers at different exact security levels. In display-overrides, a caller with matching MAIN10 art receives that resource while a caller without matching MAIN50 art receives the generated fallback. That is exact-security resource selection, not a security-selected generated layout algorithm. Use presentation.menu_mode = "generated" when every security level should use the same generated geometry. For a live caller, spitfire status reports renderer=exact-security-board-override, renderer=exact-security-active-profile, renderer=generated-stock, or renderer=expert-suppressed so the selected path is explicit. Save with S, then run spitfire status before restarting. A valid selection reports profile IDs, versions, effective source, and ready; a missing/invalid active package reports DEGRADED and the base or built-in fallback in use.

Profile changes are cold configuration. They change presentation only and do not change terminal ANSI preference, commands, security, messages, files, or transfers. See Presentation Profiles before installing or authoring a package.

Setup also installs classic-spitfire and minimal-terminal without selecting them. For Classic selection and the separate stock-journey setting, see the Classic Presentation Operator Guide.

Language and locale

[language].default_locale selects engine-owned prose independently of the presentation profile. Clean setup installs and selects en-US; configuration menu item 8 changes the locale. Stop the board, validate/install a package with the public language-validate and language-install commands, select it with spitfire config, then require spitfire status to report the intended default/effective package and READY. See Language Packages.

Configuration authority

spitfire.toml is authoritative for static settings. SQLite is authoritative for callers, conferences, messages, file areas, catalog metadata, and statistics. Cataloged file bytes live below the configured logical external path. Do not manually edit SQLite or move managed paths.

The complete validated format and authority boundaries are in SPITFIRE NG Setup and Configuration.

Setup prompt behavior

M037.3 closes the bounded setup/operator findings: disabled RAW/RLogin/Telnet/SSH listeners skip bind/port questions; listener prompts accept y, Y, yes, n, N, and no case-insensitively and invalid input reprompts; disabled listeners can retain safe internal defaults without forcing irrelevant questions. The interactive security decision is simply Sysop security threshold [50]:; historical level research remains in the reference documentation. Setup also names every installed presentation package and separately asks for active/base profile, generated/display-override menus, post-login journey, new-caller security, Sysop threshold, and initial Sysop caller security.

D2 login/registration policy is documented in caller management. Use matching D2 sfconfig/runtime versions for the extended policy. Older clients retain their existing settings view; their field-scoped edits preserve new values.

Source: public docs/operator/configuration.md. Navigation is adapted for this site; stale overview version/networking labels are reconciled with the accepted D3 checkpoint.