Configuration reference

The server’s startup interface is declared in src/options.rs; the native client’s separate interface is covered in the CLI guide. Run the binaries built from your checkout for current help:

target/release/ffkv --help
target/release/ffkv restore --help
target/release/ffkv-cli --help

No flags in this reference require an installed Redis client. --help/-h and --version/-V are generated by Clap. Paths are filesystem paths, byte counts are bytes, and *-ms durations are milliseconds. Optional values are unset unless stated; bare boolean switches default to false. The tables inventory all server flags, not Redis CONFIG parameters.

Startup precedence matters

CLI parsing happens first. The server then loads its rewritten configuration file and validates the resulting settings. With --data-dir, --server-config-file defaults to data-dir/server-config.json; without either, there is no default rewrite path. A missing file is ignored, while invalid/unknown rewritten settings fail startup.

Persisted values can override explicit CLI flags. Current loadable entries include appendonly, appendfsync, databases, maxclients, bind, port, dir, backupdirname, backup-sealed-ttl, cluster-enabled, ffkv-shards, and supported latency/slowlog/shutdown telemetry settings. If a restart binds an unexpected port or changes durability, inspect this file before assuming the CLI was ignored. Use a fresh directory for examples; do not reuse someone else’s persisted settings. This JSON rewrite format is not a redis.conf parser.

Listener, layout and persistence

Flag	Startup default / behavior
--bind ADDRESS:PORT	127.0.0.1:6379; non-loopback requires TLS and ACL file
--max-connections N	1024; positive u32 connection cap
--data-dir DIRECTORY	Unset: volatile dataset. A directory enables normal durable startup and exclusive locking
--durability strict|everysec	Requires data-dir; effective default with persistence is strict
--shards N	4; 1–256 internal owning actors, not cluster nodes
--databases N	16; 1–65,536 logical databases in standalone mode; cluster exposes DB zero
--appendonly true|false	CLI default true; effective AOF requires a durable directory. Accepts an explicit boolean, not a bare enable switch
--wal-checkpoint-bytes N	268435456; WAL growth past prior checkpoint; zero disables automatic checkpoints
--server-config-file PATH	Rewritten runtime configuration; defaults to data-dir/server-config.json when a data directory is supplied

Strict appends/flushes/fsyncs before write reply; everysec appends/flushes before reply and targets a one-second fsync cadence. A data directory with AOF explicitly disabled is not the normal ongoing-journal durability guarantee. See persistence.

Storage and memory

Flag	Startup default / behavior
--storage memory|hybrid	memory; hybrid requires data-dir
--inline-threshold N	1024; hybrid list/native-job bodies larger than this are offloaded
--cache-bytes N	67108864; cached body bytes, not RSS
--segment-bytes N	67108864; derived-segment rotation size
--disk-budget N	0 unlimited; derived segments plus compaction/rebuild scratch only
--max-rss-bytes N	0 disabled; one-second-sampled soft growing-command admission threshold, not eviction/hard memory cap

Do not use the segment budget as a WAL/backup/filesystem limit. Reserve independent recovery/maintenance headroom. See hybrid storage and memory.

RESP security

Flag	Behavior
--acl-file PATH	Startup named-user ACL policy; separate from management token policy
--tls-cert PATH	RESP server certificate; must be paired with tls-key
--tls-key PATH	RESP server private key; must be paired with tls-cert

Non-loopback RESP requires both TLS and ACLs. Listener TLS does not automatically configure native upstream trust or the management listener. See security.

Management and console

Flag	Startup default / behavior
--management-bind ADDRESS:PORT	Unset: management disabled
--management-token-file PATH	Required for every management listener, even OIDC-only
--management-audit-file PATH	Default: data-dir/management-audit.jsonl; without data-dir, ffkv-audit.jsonl beside token file
--management-tls-cert PATH	Management certificate; paired with management-tls-key; required for non-loopback management
--management-tls-key PATH	Management private key
--console-dir DIRECTORY	Optional static React console asset root, e.g. apps/console/dist; API can run without assets
--management-origin ORIGIN	Exact allowed browser origin for an explicit proxy/external endpoint
--management-allow-sensitive-reveal	Opt in to unmasked sensitive JSON on admin reveal; otherwise recognized fields stay masked
--management-oidc-issuer URL	OIDC issuer; configure with audience and JWKS URL
--management-oidc-audience VALUE	Expected OIDC audience
--management-oidc-jwks-url URL	Bounded cached verification-key source
--management-oidc-admin-role NAME	ffkv-admin
--management-oidc-viewer-role NAME	ffkv-viewer
--management-oidc-allow-loopback-http	Explicit local issuer-test escape from HTTPS, not production policy

Management settings require management-bind; TLS cert/key are paired and the OIDC issuer/audience/JWKS trio is all-or-nothing. Empty static token policies are accepted only with configured OIDC. API transport/work/response limits are fixed implementation bounds, not additional undocumented CLI flags. See management API.

Native RESP replication

Flag	Startup default / behavior
--replication-backlog-bytes N	67108864; minimum 1024 bytes
--native-replication-allow-loopback	Explicitly permit loopback upstream connections; otherwise protected-network policy applies
--native-replica-user NAME	Upstream ACL username; requires a password file
--native-replica-password-file PATH	Upstream password, read from file rather than command argument
--native-replica-ca-file PATH	PEM trust roots for verified native upstream TLS
--native-replica-tls-name NAME	Verified upstream name override; requires native-replica-ca-file
--replication-fsync-gate PATH	Owned test fixture only: while the file exists, hold durable replica ACKs. Do not set in normal deployments

Followership/role changes use RESP REPLICAOF/FAILOVER; these are not startup --replicaof flags. Native runtime also uses the replica-interval-ms, replica-timeout-ms and replica-max-snapshot-bytes values below for reconnect delay, I/O timeout and snapshot bounds. Native replication and HTTP polling are separate mechanisms despite these shared settings.

Development HTTP snapshot polling

Flag	Startup default / behavior
--replication-export	Opt in to admin-only raw full-snapshot export on management; requires a durable master, not a polling follower
--replica-source URL	Management base URL to follow; full-snapshot polling, not PSYNC; requires data-dir and replica-token-file
--replica-token-file PATH	Source management admin bearer token, not RESP password
--replica-ca-file PATH	Source HTTPS CA trust
--replica-interval-ms N	5000; 1–86,400,000
--replica-timeout-ms N	120000; 1–3,600,000
--replica-max-snapshot-bytes N	1073741824 (1 GiB); 1–8,589,934,591
--replica-allow-loopback-http	Explicit local HTTP poller-test flag; production uses verified HTTPS

Token/CA/loopback-HTTP follower settings require replica-source. Polling disables dataset writes and requires first sync on each process start. It cannot be combined with cluster mode. See replication.

Cluster

Flag	Startup default / behavior
--cluster-enabled	Enable ffkv cluster; requires data-dir
--cluster-config-file PATH	Default data-dir/nodes.json; per-node durable topology
--cluster-bus-port PORT	0: derive RESP port + 10,000; reject overflow
--cluster-announce-bus-port PORT	Optional advertised nonzero bus port
--cluster-bus-secret VALUE	Shared peer secret; non-loopback requires at least 32 bytes. Current CLI takes value directly, not a file
--cluster-node-timeout-ms N	15000; positive, bounded to avoid internal duration overflow
--cluster-require-full-coverage true|false	true; explicit boolean value
--cluster-allow-reads-when-down true|false	false; explicit boolean value
--cluster-slot-stats-cpu	Enable actual per-slot CPU statistics
--cluster-slot-stats-memory	Enable per-slot owned-memory estimates
--cluster-slot-stats-network	Enable per-slot network statistics

Cluster-specific settings require cluster-enabled. The bus is custom plaintext shared-secret TCP, not Redis bus compatibility or TLS encryption. Bind IP is also advertised; no separate announce-IP CLI option exists. Isolate bus networking and protect secret process arguments. See clustering before changing availability/failover policy.

Offline restore subcommand

target/release/ffkv restore --source .ffkv-docs-persistence/backups/manual-1 \
  --data-dir .ffkv-docs-restored

restore --source DIRECTORY --data-dir NEW_DIRECTORY verifies a trusted backup and refuses any existing destination. It is an offline operation, not a running-server flag. See backup/restore for the complete procedure.

Runtime configuration and deployment values

Inspect actual supported/runtime values rather than treating Redis’s entire configuration universe as implemented:

target/release/ffkv-cli -3 -p 6382 CONFIG GET '*'
target/release/ffkv-cli -3 -p 6382 CONFIG GET appendonly appendfsync

CONFIG SET validates the current registry and mutability rules. appendfsync maps always to strict and everysec to everysec. CONFIG REWRITE writes the supported runtime snapshot to the configured rewrite file; do not assume every CLI security/storage flag is rewritable. Changes to listener/topology/startup-only settings require the corresponding restart/deployment procedure. Avoid testing persistence toggles or database-count changes on real data.

Compose environment variables and Helm values are translated by those deployment files, not read generically by the server. For example, Helm’s inline threshold is 4096 while the native CLI default is 1024. Consult Docker and Kubernetes for their exact values and packaging caveat.