Configuration
CasOS reads a single config file at startup: conf/app.conf. Below is an annotated example covering every option.
appname = casos
httpport = 9000
runmode = dev
SessionOn = true
copyrequestbody = true
; -- Database ---------------------------------------------------------------
driverName = mysql
dataSourceName= root:123456@tcp(localhost:3306)/
dbName = casos
; -- Casdoor ----------------------------------------------------------------
casdoorEndpoint = https://door.casdoor.com
clientId = <your-client-id>
clientSecret = <your-client-secret>
casdoorOrganization = <your-org>
casdoorApplication = <your-app>
; -- Outbound proxy (optional) ----------------------------------------------
socks5Proxy = 127.0.0.1:10808
; -- Control plane ----------------------------------------------------------
apiserverPort = 6443
apiserverBind = 127.0.0.1
dataDir = /var/lib/casos
; -- Built-in platform dependencies (optional) ------------------------------
storageProvisionerEnabled = true
coreDNSImage = docker.1ms.run/coredns/coredns:1.12.4
localPathProvisionerImage = docker.1ms.run/rancher/local-path-provisioner:v0.0.32
localPathHelperImage = docker.1ms.run/library/busybox:1.37.0
Beego settings
httpport controls which port the web UI and REST API listen on (default 9000). Set runmode to prod in production to suppress debug output. The SessionOn and copyrequestbody options should stay true — they are required for session handling and request body parsing.
Database
dataSourceName is a MySQL DSN in the format user:pass@tcp(host:port)/ — without a database name at the end. CasOS appends the value of dbName (default casos) automatically. The same MySQL database stores both application data and all Kubernetes state (via kine), so you only need one database instance.
Create the database before first run:
CREATE DATABASE IF NOT EXISTS casos CHARACTER SET utf8mb4;
Casdoor
casdoorEndpoint is the URL of your Casdoor instance. clientId and clientSecret come from the Casdoor application you created. casdoorOrganization and casdoorApplication must match exactly what you set in Casdoor. See Authentication for the full setup walkthrough.
These same settings also configure the web UI: CasOS hands the public values (casdoorEndpoint, clientId, casdoorApplication, casdoorOrganization) to the browser at page load, so the frontend's login flow is driven entirely by app.conf. There is no separate frontend auth config to edit, and clientSecret is never sent to the browser.
Control plane
apiserverPort sets the HTTPS port for the embedded Kubernetes API server (default 6443). apiserverBind is the IP the API server binds to and advertises — use 127.0.0.1 for local development and your machine's outbound IP for a multi-node setup. dataDir is where CasOS writes TLS certificates and other persistent control-plane data; make sure this directory is writable and survives reboots.
webhookPort (default 9443) is the HTTPS port for the internal Casbin admission and authorization webhook servers. It does not need to be exposed outside the machine.
Built-in platform dependencies
On start CasOS bootstraps the in-cluster services that App Store charts assume exist — cluster DNS and a default storage class. These keys control that behavior and are all optional; the defaults suit a local, single-machine cluster.
storageProvisionerEnabled (default true) decides whether CasOS installs the built-in local-path storage provisioner and marks its local-path class as the cluster default. Set it to false (also accepts no/off) on clusters that already provide their own default StorageClass, so CasOS doesn't add a competing one. This provisioner writes volumes under dataDir, which must be an absolute path for it to start.
The three image keys let an air-gapped or registry-mirrored environment override where the managed pods pull from: coreDNSImage is the CoreDNS image for the DNS bootstrap, while localPathProvisionerImage and localPathHelperImage are the controller and helper-pod images the storage provisioner uses. Leave them blank to accept the defaults shown above.
Optional: outbound proxy
If your environment requires a SOCKS5 proxy to reach container registries or the Kubernetes pause image, set socks5Proxy to host:port. When this is set, CasOS automatically switches the default sandbox (pause) image to registry.aliyuncs.com/google_containers/pause:3.10.1 instead of the upstream registry.k8s.io image. You can override this further with sandboxImage.
The same proxy is used for outbound HTTP: the App Store fetches Helm repository indexes and chart archives through it, so public chart repositories remain reachable from clusters whose egress is restricted to a proxy.