> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# startup.ini tunables

Many appliance behaviours are set in `/opt/safesquid/startup.ini` (defaults in `/opt/safesquid/default/startup.ini`). These values are loaded before SafeSquid starts. They are **not** edited in Web UI sections from `sectionMaster.xml`.

After edits, restart SafeSquid (`/etc/init.d/safesquid restart`). Path layout comes from `/opt/safesquid/setup.ini`.

<Note>
  **Two layers:** Web UI / `sectionMaster` = policy XML. `startup.ini` = process and host tunables (listen, threads, logs, TLS, sync, DNS categorisation zone, and similar). Every value here is read once, at process start — there is no partial-reload path; a config sync from a master, or a Web UI policy save, does not touch or re-read this file. An unrecognised key is silently ignored rather than rejected — consult the shipped default file if unsure a key is spelled correctly.
</Note>

## Listen and identity

* **LISTEN\_IP / LISTEN\_PORT** — Default bind address and port if no Network settings Listen entry is enabled. See [Network settings](/configuration/application_setup/network_settings_and_listeners). Once you add and enable a real Listen entry that entry is used and this fallback becomes irrelevant — but it is never actively disabled, so if every Listen entry is later disabled or removed, the appliance silently falls back to these defaults again rather than refusing to bind at all.
* **HOSTNAME / DOMAIN** — Appliance hostname and domain.

## Threads, memory, sockets

* `MAXTHREADS`, `MAX_FDS` (about 4× threads — sized at that ratio because each connection can hold more than one descriptor at once, such as a client socket, an origin socket, and a cache file), `STACKSIZE`, `OVERLOAD_FACTOR`
* `SOCKET_TIMEOUT`, `THREAD_TIMEOUT`
* **`MAX_CONCURRENT`** — a global concurrent-connection ceiling for the whole process, distinct from the per-user, per-client-IP ceiling set by **MAX Concurrent Connections** on an individual Access restrictions entry.
* `HEAP_MEM`, `SOCK_MEM` — lower if the host is memory-starved
* `SEND_SOCKET_BUFFERS`, `RECEIVE_SOCKET_BUFFERS` — `0` = no artificial limit
* `TCP_KEEPIDLE_TIME`, `TCP_KEEPINTVL_TIME`, `TCP_KEEPCNT_COUNTS`
* **`CLIENT_DEFER_ACCEPT`** — defers accepting a client connection until data has actually arrived, reducing wasted thread time on connections that open and immediately go idle.

## CPU placement

* **LISTEN\_CPUS** — Cores reserved for accepting clients (default `0,1`)
* **CPU\_RESERVATION** — Reservation strategy (default `1`)

## Authentication cache

`PASSWORD_CACHE_SIZE` and `PASSWORD_CACHE_EXPIRE_TIME` — see [Authentication](/configuration/start_here/authentication).

## Logging

`LOG_LEVEL`, `LOG_SIZE_LIMIT`, `PROCESS_OLD_LOGS`, `DATE_TIME_FORMAT`, and optional `NATIVE_UDP_*` / `EXTENDED_UDP_*` / `CONFIG_UDP_*` — see [Logging](/configuration/start_here/logging).

## Master sync

* **MASTER\_IP / MASTER\_PORT** — Master appliance for configuration sync
* **NEVER\_SYNC / ALWAYS\_SYNC** — Comma-separated section names that must never / always sync (default `NEVER_SYNC=cache`)
* **SYNCTIME** — Sync interval toward the master

## Updates and HTTPS

* `UPDATE_INTVL`, `UPDATE_RETRY_DELAY`
* `FORCE_SNI` — use SNI for client certs in HTTPS Inspection
* `USE_SESSION_TICKETS`
* `CLIENT_CIPHERS_LIST` / `SERVER_CIPHERS_LIST` (TLS ≤ 1.2)
* `CLIENT_CIPHERS_SUITE` / `SERVER_CIPHERS_SUITE` (TLS 1.3)

## Categorisation and identity side channels

* **DNS\_CAT\_ZONE** — DNS categorisation zone (default `.c.ssquid.in`). Set to `.` to disable.
* **USER\_IP\_DB\_FILE** — SQLite map of IP → username (for example VPN clients)
* **OPENVPN\_CLIENT\_HEAD** — OpenVPN client head file path when that integration is used
* **IPV6\_DETECT\_SITE** — FQDN:PORT used to test IPv6 reachability

## Reporting database

`REAL_TIME_DB_WRITE`, `STATEMENT_COUNT`, `MAX_MAIL_THRESHOLD`, `MIN_MAIL_THRESHOLD`, `KEEP_DATA`.

## Debugging

`MALLOC_CHECKING` — glibc `MALLOC_CHECK_` mode (see comments in the default file).

## Examples

### Fitting resource limits to a smaller host

On a lower-memory appliance, lower `HEAP_MEM` and `SOCK_MEM` alongside `MAXTHREADS` and `MAX_FDS` (keeping `MAX_FDS` at roughly four times `MAXTHREADS`), restart, then watch Dashboard and Statistics under load to confirm the appliance stays responsive.

### Disabling DNS categorisation temporarily

If the DNS categorisation zone is unreachable and producing errors rather than degrading gracefully, set `DNS_CAT_ZONE=.` and restart to disable that path while resolving the underlying DNS issue; other categorisation sources such as SSqore and local category overrides continue to function.

## How to verify

1. After any edit, restart the service, then confirm the appliance is actually running the new configuration — a misspelled tunable is silently ignored, which looks identical from the outside to the tunable simply not mattering.
2. For listen-related changes, confirm with a direct connection test rather than trusting the Web UI Network settings page alone — that page shows configured Listen entries, not the process's actual fallback behavior when none are enabled.
3. For master sync changes, confirm on the replica that a policy change made on the master actually arrives within the configured sync interval, and that any section in `NEVER_SYNC` genuinely does not change.
4. Revert any temporary diagnostic change and restart again once the investigation is complete.

## See also

* [Daemon and service](/configuration/start_here/daemon)
* [Logging](/configuration/start_here/logging)
* [Authentication](/configuration/start_here/authentication)
* [HTTPS Inspection](/configuration/real_time_content_security/https_inspection)
* [Cloud / categorisation feeds](/configuration/start_here/cloud_feeds)
* [Subscription](/configuration/infrastructure_and_access/subscription)