Configuration

dotwire reads standard .NET configuration. As environment variables, replace each : with __, so Dotwire:Sse:Enabled becomes Dotwire__Sse__Enabled. For local runs with dotnet run, dotwire also loads a .env file.

Options without a default must be set. dotwire refuses to start if a required option is missing or invalid.

Connection strings

Key	Description
`ConnectionStrings:PostgresMigrator`	Owner role (`dotwire`). Used to run migrations and apply startup retention.
`ConnectionStrings:PostgresWrite`	Runtime role (`dotwire_app`) for writes.
`ConnectionStrings:PostgresRead`	Runtime role for reads, including authorization checks and history. Can point at a replica.

Postgres

Key	Default	Description
`Postgres:Migrate`	`true`	Run the embedded migrations at startup. Set it on one node only.
`Postgres:AppRolePassword`	—	Password that the migration run sets for the `dotwire_app` role.

Auth

See Auth. Set Auth:Keys, Auth:JwksUrl, or both.

Key	Default	Description
`Auth:Issuer`	Required	Expected `iss` claim.
`Auth:Audience`	Required	Expected `aud` claim.
`Auth:Keys:<kid>`	—	PEM-encoded RSA public key for key id `<kid>`. Repeat for each key.
`Auth:JwksUrl`	—	JWKS endpoint to fetch public keys from.
`Auth:JwksRefreshMinutes`	`5`	JWKS cache refresh interval.

Node

Key	Default	Description
`Dotwire:Role`	`All`	`All`, `Api`, or `Gateway`. See Node roles.
`Dotwire:MaxContentBytes`	`65536`	Maximum message content size in UTF-8 bytes.

Encryption

See Encryption and retention.

Key	Default	Description
`Dotwire:Encryption:ActiveKeyId`	Required	Key id new messages are encrypted under. Must name a configured key.
`Dotwire:Encryption:Keys:<id>`	Required	Base64-encoded 32-byte AES key. Keep old ids configured after rotation.

Retention

Key	Default	Description
`Dotwire:Retention:MessagesDays`	Unset	Postgres history retention in days, applied at startup by the node that runs migrations. Unset leaves the value last set through the admin API. Manage retention here or through the API, not both.

JetStream retention is Nats:RoomsMaxAgeHours, below.

Webhooks

See Moderation webhooks.

Key	Default	Description
`Dotwire:Webhooks:Secret`	Unset	When set, both call-outs carry `X-Dotwire-Signature: sha256=<hex>`.
`Dotwire:Webhooks:Presend:Url`	Unset	Presend call-out URL. Presend is off when unset.
`Dotwire:Webhooks:Presend:TimeoutMs`	`500`	How long dotwire waits for an answer.
`Dotwire:Webhooks:Presend:FailPolicy`	`Closed`	`Closed` fails the send with `503 presend_unavailable`. `Open` accepts the original content.
`Dotwire:Webhooks:Presend:IncludeAdminSends`	`false`	Also run presend for admin message injection.
`Dotwire:Webhooks:PostSend:Url`	Unset	Postsend call-out URL. Postsend is off when unset.
`Dotwire:Webhooks:PostSend:TimeoutMs`	`2000`	Timeout per delivery attempt.
`Dotwire:Webhooks:PostSend:MaxAttempts`	`3`	Delivery attempts per message.
`Dotwire:Webhooks:PostSend:QueueCapacity`	`10000`	Queue size. When full, the newest item is dropped with a warning.
`Dotwire:Webhooks:PostSend:IncludeAdminSends`	`false`	Also run postsend for admin message injection.

SSE

See Stream room events.

Key	Default	Description
`Dotwire:Sse:Enabled`	`true`	When `false`, the events endpoint returns `404`.
`Dotwire:Sse:KeepAliveSeconds`	`15`	Interval between keep-alive comments.
`Dotwire:Sse:BufferSize`	`256`	Events buffered per connection. A connection that falls further behind is closed.
`Dotwire:Sse:ReplayPageSize`	`100`	Rows per page when replaying history on resume.

Rate limits

See Rate limits. Each bucket has three settings: PermitLimit (bucket size), TokensPerPeriod (tokens added each period), and PeriodSeconds.

Bucket	Keyed by	Covers	`PermitLimit`	`TokensPerPeriod`	`PeriodSeconds`
`Dotwire:RateLimits:Send`	User	Member message sends	20	5	1
`Dotwire:RateLimits:Read`	User	History, participants, SSE connects, `/audit`	30	10	1
`Dotwire:RateLimits:Admin`	User	Every `/admin` route	200	50	1
`Dotwire:RateLimits:Hub`	Connection	Hub `Subscribe` and `Unsubscribe`	30	10	1

Dotwire:RateLimits:Enabled (default true) turns all buckets on or off. For example, Dotwire__RateLimits__Send__PermitLimit=40 doubles the send bucket.

NATS

Key	Default	Description
`Nats:Url`	`nats://localhost:4222`	NATS server URL. Separate several URLs with commas. For an authenticated server, include the credentials: `nats://<user>:<password>@host:4222`. See Securing NATS.
`Nats:Enabled`	`true`	Provision streams and run the NATS consumers at startup.
`Nats:RoomsStream`	`ROOMS`	JetStream stream for room messages.
`Nats:RoomSubjectPrefix`	`room.`	Prefix of each room's subject, `room.{roomId}`.
`Nats:RoomsSubjectFilter`	`room.*`	Subject filter of the rooms stream. Don't widen it to `room.>`; see Ephemeral traffic.
`Nats:RoomLiveSubjectSuffix`	`.live`	Suffix of the core subject used for live fanout.
`Nats:RoomsMaxAgeHours`	`48`	How long the rooms stream keeps messages.
`Nats:BatchMaxMessages`	`500`	Postgres writer: maximum messages per batch.
`Nats:BatchLingerMs`	`1000`	Postgres writer: wait before flushing a partial batch.
`Nats:PostgresWriterConsumer`	`postgres-writer`	Durable consumer name for the Postgres writer.
`Nats:AuditStream`	`AUDIT`	JetStream stream for audit events.
`Nats:AuditSubject`	`audit.events`	Subject for audit events.
`Nats:AuditWriterConsumer`	`audit-writer`	Durable consumer name for the audit writer.
`Nats:AuditWriter:BatchMaxMessages`	`200`	Audit writer: maximum events per fetch.
`Nats:AuditWriter:BatchLingerMs`	`1000`	Audit writer: wait before flushing a partial batch.
`Nats:AuditWriter:StandbyRetrySeconds`	`5`	How often a standby node retries for the audit writer lock.

Runtime

compose.yaml sets these .NET runtime variables, which suit connection-dense workloads:

Variable	Value	Effect
`DOTNET_gcServer`	`1`	Server garbage collector.
`DOTNET_GCDynamicAdaptationMode`	`1`	Dynamic adaptation of the server GC (DATAS).