Configuration

Grafana reads configuration from multiple layered sources. This page maps the most common knobs to their location in source.

Source files

File	Role
conf/defaults.ini	Bundled defaults. Read-only.
<homepath>/conf/custom.ini	Operator overrides. The canonical place for production config.
Command-line flags	--config, --homepath, --pidfile, etc.
Environment variables	GF_<SECTION>_<KEY> (e.g. GF_SERVER_HTTP_PORT=4000).

Loading happens at startup in pkg/setting/setting.go. The result is a *setting.Cfg that flows through Wire to every service.

Notable sections

The list below is not exhaustive — it points to the config keys that come up most often when reading code.

Section	Used by	Notable keys
[server]	HTTP server	protocol, http_addr, http_port, domain, root_url, serve_from_sub_path
[database]	sqlstore	type (sqlite3/mysql/postgres), host, name, user, password, max_open_conn, migration_locking
[security]	various	admin_user, admin_password, secret_key, cookie_secure, cookie_samesite, csrf_trusted_origins
[users]	user / org	allow_sign_up, auto_assign_org, default_theme
[auth]	auth	login_cookie_name, login_maximum_lifetime_duration, disable_login_form
[auth.anonymous], [auth.basic], [auth.jwt], [auth.<oauth>]	authn clients	per-provider config
[auth.proxy]	auth proxy	enabled, header_name, header_property, auto_sign_up
[auth.ldap]	LDAP	enabled, config_file
[smtp]	email notifications	enabled, host, from_address, password
[log]	log infrastructure	mode, level, plus [log.console], [log.file], [log.<namespace>]
[plugins]	plugin host	plugins_path, allow_loading_unsigned_plugins
[dashboards]	dashboards	versions_to_keep, min_refresh_interval
[unified_alerting]	ngalert	enabled, scheduler / store knobs
[remote_alertmanager]	ngalert	external Alertmanager config
[live]	live	max_connections, ha_engine, ha_engine_address
[rendering]	rendering	server_url, callback_url, concurrent_render_limit
[metrics]	metrics endpoint	enabled, basic_auth_username, basic_auth_password
[tracing.opentelemetry]	tracing	address, propagation
[feature_toggles]	featuremgmt	enable = a, b, c or <toggle> = true/false
[snapshots]	dashboard snapshots	external_enabled, external_snapshot_url
[panels]	panel host	disable_sanitize_html, enable_alpha
[plugin.<id>]	per-plugin	per-plugin overrides (varies)
[expressions]	expression engine	enabled
[rbac]	RBAC	enabled, permission_cache

Reading config in code

type MyService struct { cfg *setting.Cfg }
func ProvideService(cfg *setting.Cfg, ...) *MyService { return &MyService{cfg: cfg} }

// Inside the service:
if s.cfg.AnonymousEnabled { /* ... */ }

For section/key access:

section := cfg.Raw.Section("smtp")
host := section.Key("host").MustString("localhost:25")

When adding a new config key, also document it in conf/defaults.ini with a comment so users know it exists.

Hot reload

Most config keys are read at startup only and require a server restart. A subset (SSO settings via pkg/services/ssosettings/, feature toggles in some cases) are reloaded dynamically.

See also

• Server init and wiring
• Authentication & access control