Configuration Global

🇬🇧 English · 🇫🇷 Français

Configuration: Daemon, Auth and Global Sections

Applies to Hydranos 4.4.

This page is the key-by-key reference for every part of default.toml that is not an engine: the top-level keys, [daemon], [proxy], [network], [auth], [mcp], [dedup], [rss], [vpn_speedtest], [bench], the five tracker host tables, and the sections and keys Hydranos names at startup as ignored. For each key you get its type, the value the shipped template writes, the value the code uses when the key is missing, whether 4.4 really reads it, and when a change takes effect. Engine keys ([race], [hoard], engine blocks, [race_drain]) are on Configuration: Engines and Race Drain. How the file is found, seeded and edited is on Configuration Reference. Terms such as store, resume state and engine are defined on Concepts and Glossary.

How to read the tables

Column	Meaning
Template	The value written by the shipped configs/default.toml. "—" = the template does not contain the key.
If absent	The value the code uses when the key is missing from your file. It can differ from the template: a key you delete does not fall back to the template value.
Status	Works = read and does what it says. Ignored = accepted (the file still loads) but read by nothing. Ignored, warned = the same, and the startup log names it (see Sections and keys named at startup).
Effect	What the key does in 4.4, when it is read at all.
Takes effect	Live = the next request sees the new value, provided you changed it through the web UI or the API (they swap the running config). A hand edit of the file is read at the next start, or as soon as any save through the web UI or the API rewrites the file (that reloads the whole file). Restart = read once at startup.
UI	Where the key can be changed in the web UI. "Advanced settings › X" means Config › Advanced settings (default.toml) › sub-tab X (General, Session Race, Session Hoard, Trackers & Network, Maintenance, and Other for every section not listed in another). Most keys there are visible only with Show advanced settings ticked.

Three rules apply to every section on this page:

• The generic editor in Advanced settings (default.toml) only changes keys already present in the file. A key the template does not contain (marked "—") must be added by hand, with the daemon stopped or followed by a restart. See Configuration Reference.
• After any save in Advanced settings, the UI shows "Daemon/auth settings changed, a full restart is required." for every section on this page, even when the code reads the key live. The Takes effect column below is what the code does.
• The editor hides, in [race]/[hoard] only, the keys the Network tab owns, and every key named at startup as ignored. [daemon] bind_interface, kill_switch, egress and the [proxy] keys are not hidden: once the Network tab has written them they show under General and Other, and can be edited there one by one. It also hides three [vpn_speedtest] keys that 4.4 reads; see that section.

Known bug in 4.4: the editor's list of Network-tab keys includes [daemon] kill_switch, egress and the [proxy] keys, meant to be hidden, but the filter only applies to [race]/[hoard]. Change them on the Network tab, which writes them as a set.

Top-level keys

A top-level key must sit before the first [table] header. Written at the end of the file, it lands inside the last table and is silently ignored.

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
auto_port_forward	bool	—	true	Works	At startup, for each engine that leaves by the home router, asks the router to forward its listen port, TCP and UDP, by NAT-PMP, then UPnP. 1-hour lease, renewed; after a total failure, retried every 15 minutes with one log line. Follows a live port change. Skipped for an engine that does not leave by the home router (kill switch, managed tunnel, Gluetun, SOCKS5, other interface). The listen port itself never changes.	Restart	none (top-level keys are not shown)

Details, Docker caveats and the log lines: Networking: Ports, Port Forwarding and the Network Tab.

# First lines of default.toml, before [daemon]
auto_port_forward = false   # the port is forwarded by hand on the router

[daemon]
api_port = 8199

[daemon]

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
api_host	string	"0.0.0.0"	"" → 0.0.0.0	Works	Address the HTTP server (web UI, /api, /api/v2, /mcp) binds to. 127.0.0.1 = this machine only.	Restart	Advanced settings › General
api_port	integer (1–65535)	8199	0 → 8199	Works	Port of that HTTP server.	Restart	Advanced settings › General
api_key	string	""	"" → generated	Works	The single API credential (X-Api-Key header, ?apikey=, or Authorization: Bearer on /mcp). At startup, an empty value or the placeholder change-me-in-production is replaced by a random 48-hex-character key, written back to the file.	Live	Advanced settings › General, with ↻ (generate) and ⧉ (copy)
data_dir	string (path)	"/config" (Docker writes /config; a binary seeding its own file writes <config dir>/data)	""	Works	Folder of the store hydra.db (see Architecture for store vs resume state), the benchmark database bench.db and the legacy uploads/. Created at startup if missing. Engine resume state is not here: it lives in <config dir>/<engine id>/.	Restart	Advanced settings › General
create_torrent_folder	bool	false	false	Works	Default of the subfolder option: true puts a single-file torrent in <save path>/<file name without extension>/. Used when an add does not choose itself (Add tab box, create_subfolder, shim contentLayout/root_folder), and by RSS adds. Pre-ticks Put the payload in its own subfolder on the Add tab (GET /api/torrents/add-defaults) and is reported to qBittorrent clients as create_subfolder_enabled. Multi-file torrents always have their folder.	Live (next add)	Advanced settings › General
update_check_disabled	bool	—	false	Works	true: GET /api/update-check answers {"enabled":false} and never contacts GitHub.	Live	Advanced settings › General, only once added by hand
bind_interface	string	— (commented out)	"" = default route	Works	Interface the daemon's own requests are bound to when they go direct or through proxy. Not the engines': each has its own bind_interface in its section.	Live through the Network tab; restart if edited by hand	Network › Kill switch and the daemon's own requests › Daemon interface
kill_switch	bool	— (commented out)	absent = follow [network] mode: disarmed in direct mode, armed in the four others	Works	true arms it even in direct mode, false disarms it. Armed, an engine without a way out that the mode accepts is kept off the network (which engines that means depends on the mode; a hand-typed interface does not count in WireGuard mode, nor one other than gluetun's in gluetun mode: see Networking: Ports, Port Forwarding and the Network Tab), and a daemon request whose way out is unusable is refused.	Engines: restart. Daemon requests: live through the Network tab	Network › Kill switch (Follow the network mode, Disarmed: leaks accepted, Armed, even in direct mode)
egress	string	— (commented out)	"" = auto	Works	Where the daemon's own requests go (tracker lists, IP-filter lists, update check, webhooks, .torrent URLs): auto (follow the mode), direct, proxy (the [proxy] section) or engine:<id>. Any other value refuses every request.	Live through the Network tab; restart if edited by hand	Network › External requests of the daemon

Where create_torrent_folder is not applied (magnets added natively, watched folders, MCP adds, the import wizard): see Download, recheck, or seed mode.

bind_interface, kill_switch and egress are written as a set by the Network tab (Save daemon traffic) with [proxy]. Once written they also show in Advanced settings › General (the editor only hides the Network-tab keys of [race]/[hoard]). What each egress value resolves to, the per-engine kill-switch verdicts and the log lines: VPN and Egress (The kill switch, The daemon's own requests).

agent_token is no longer a key: the 4.4 template does not contain it, and a file that still has it gets config: daemon.agent_token is ignored: … at startup (see Sections and keys named at startup). Reset to defaults drops it. The 3.x background is on Upgrading from 3.x.

Notes:

• Changing api_key from the UI takes effect on the next request. The UI stores the new key in this browser, but every other client (Sonarr, Radarr, autobrr, scripts, MCP clients, declared nodes that point at this instance) must be updated by hand.
• Do not save an empty api_key from the UI. An empty key refuses every API call until the next start, which then generates a new one. The browser that saved it is locked out too.
• api_host with an IPv6 address: the server binds to <api_host>:<api_port> as written, so an IPv6 literal needs brackets: "[::]".
• Rescue mode (the store cannot be opened) answers on the same api_host:api_port as the normal server. See Operating Hydranos.
• The template's data_dir = "/config" is the Docker layout. For the difference between the Docker and binary first-run seeding, see Configuration Reference.

[daemon]
api_host = "0.0.0.0"
api_port = 8199
api_key = ""                    # empty: a key is generated and written here at first start
data_dir = "/config"
update_check_disabled = true    # not in the template: add it by hand
# egress = "auto"              # commented out in the template; set from the Network tab

[proxy]

The SOCKS5 proxy for the daemon's own requests, used when [daemon] egress = "proxy". The engines' proxy is a different set of keys (socks5_outbound_* in [race]/[hoard], see Configuration: Engines and Race Drain). In 3.x this section carried the public-IP lookup and the speed test; 4.4 reads it again for the daemon's requests.

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
socks5_host	string	— (whole section commented out)	""	Works	Proxy host. Requests go as socks5h:// (names resolved by the proxy). Empty with egress = "proxy": every request is refused.	Live through the Network tab; restart if edited by hand	Network › Proxy host (an empty host removes the section)
socks5_port	integer	—	0	Works	Proxy port.	same	Network › Proxy port
socks5_user	string	—	""	Works	Username, if the proxy wants one.	same	Network › Username
socks5_pass	string	—	""	Works	Password. Read back as ******** by GET /api/settings and the Network tab's routes; saving the mask keeps the stored value.	same	Network › Password

Once the section exists, the four keys show under Advanced settings › Other, still with their 3.x description ("used by the orchestrator (public IP + speedtest)"). Change them on the Network tab. Details: VPN and Egress.

[daemon]
egress = "proxy"

[proxy]
socks5_host = "198.51.100.20"
socks5_port = 1080

[network]

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
mode	string	— (no [network] table)	"" = deduced from the engine keys, as a file from before 4.4	Works	The mode the Network tab saved: direct, wireguard, gluetun, socks5 or proxy_v2. Decides whether the kill switch is armed by default and where egress = "auto" sends the daemon's requests.	Restart for the engines; the daemon's requests follow at once	Network (the mode cards)

The tab writes it; editing it alone (it shows under Advanced settings › Other once the table exists) can leave the engine keys of another mode in place. What each mode writes: Networking: Ports, Port Forwarding and the Network Tab and Managed WireGuard.

[auth]

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
username	string	"admin"	""	Works	Name of the admin account, checked by POST /api/login (web UI) and by the qBittorrent shim login. First-run setup writes it (admin when left blank).	Live	first-run Create account; Advanced settings › Other
password_hash	string (bcrypt)	""	""	Works	bcrypt hash of the admin password. Empty = first run: GET /api/setup reports needs_setup: true and the Welcome to Hydranos screen creates the account (8 characters minimum) and hands the browser the API key.	Live	first-run Create account; Advanced settings › Other

• The qBittorrent shim (/api/v2/auth/login) accepts either this username and password, or any username with the API key as the password.
• password_hash must be a bcrypt hash. Typing a plain password into this field makes every login fail (the API key keeps working). hydranos hash-password <password> prints one (8 characters minimum); the template comment still calls it hydra hash-password.
• Config › Account › Change password (POST /api/auth/password) writes a new hash into password_hash at once, 8 characters minimum; the old password is refused from the next login and this browser stays signed in (the API key does not change).
• hydranos reset-password <password> [path/to/default.toml] writes the hash into the file from the command line, for a locked-out admin; restart Hydranos for it to apply.
• There is one account. Lost-password recovery and the first-run exposure rules are on Security and Access, which owns them.

[auth]
username = "admin"
password_hash = ""   # empty = the first-run screen asks for a password

[mcp]

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
allow_destructive	bool	— (no [mcp] table)	false	Works	true lists and allows the two tools that cannot be undone, delete_torrents and purge_race, on /mcp. false: they are neither listed nor callable; a call returns an error naming this key.	Live	Advanced settings › Other, only once the table exists

The table is not in the template: add it by hand. Everything else about the endpoint is on MCP Server (AI clients).

[mcp]
allow_destructive = false

[dedup]

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
enabled	bool	— (no [dedup] table)	true	Works	When a torrent is added whose payload is already held under another save path, hardlink the existing files instead of downloading them again. Failure is never fatal: the torrent just downloads.	Live (the UI restarts anyway)	Config › Duplicate data › Link it instead of downloading, Save and restart
path_collision	string	—	isolate	Works	An incoming torrent naming files another torrent already holds with other bytes: isolate (a folder of its own next to the one it asked for, identical files hardlinked in), refuse (the add is refused with the reason), legacy (share the path and let the recheck overwrite, as before 4.4; logged each time).	Live (next add) through the UI editor; restart if edited by hand	Advanced settings › Other, once the key exists; the Duplicate data card writes only enabled

• Absent table = on. To turn it off, use the Duplicate data card (it creates the table, POST /api/dedup/config) or add the table by hand. The generic editor cannot create it.
• The card's Save and restart writes the file and then restarts the process through the UI restart path (the same clean stop as SIGTERM; see Operating Hydranos). The code reads the new value on the next add, so editing the table by hand and restarting is just as good.
• path_collision must be added by hand. What counts as a collision, the events it logs and the guarded recheck: Files another torrent already holds.
• What counts as "the same payload" and how it interacts with seed mode: Adding Torrents and Existing Data.

[dedup]
enabled = false   # always download, never hardlink onto payload already held
path_collision = "refuse"   # not in the template: add it by hand

[rss]

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
enabled	bool	— (no [rss] table)	true	Works	false: the background worker fetches no feed and no rule adds anything. Feeds, articles and rules are kept.	Live through the UI editor; restart if edited by hand	Advanced settings › Other, once the table exists
refresh_minutes	integer	—	30	Works	Interval given to a new feed. Below 5 → 5. Existing feeds keep their own.	same	same
max_articles	integer	—	200	Works	Articles kept per feed, newest first. Clamped to 1–10 000.	same	same

The section is not in the template: add it by hand. Feeds and rules themselves live in the store, not here. Everything else: RSS and Automatic Downloads.

[rss]
enabled = true
refresh_minutes = 30
max_articles = 200

[vpn_speedtest]

The iperf3 line test of the Benchmark tab (▶ Run now, POST /api/vpn-speedtest/run), and its optional schedule.

Key	Type	Template	If absent	Status	Effect	Takes effect	UI
enabled	bool	true	false	Works	Required for any test. false (or an empty iperf3_server): Run now answers 400 iperf3_server not configured in [vpn_speedtest] and no automatic test runs. GET /api/vpn-speedtest/latest echoes it.	Live	Advanced settings › Maintenance
iperf3_server	string	"ping.online.net"	"" (no test)	Works	iperf3 server. The test leaves by the bind_interface of the race engine (else the first engine), a managed tunnel included, else by the default route; refused (400) when that engine has no interface and goes out through a SOCKS5 proxy.	Live	Advanced settings › Maintenance
iperf3_port	integer	— (commented out: # iperf3_port = 5201)	5201	Works	Server port.	Next start or next UI/API save	none (hidden from Advanced settings: hand edit)
duration_secs	integer	— (commented out: # duration_secs = 10)	10	Works	Seconds per direction (upload, then download), clamped to 1–60. The line is saturated for about twice this.	Next start or next UI/API save	none (hidden: hand edit)
interval_secs	integer	— (commented out: # interval_secs = 0)	0	Works	0 or absent: Run now only. Above 0: an automatic test every interval_secs, never more often than every 300 s.	Next start or next UI/API save (read at each wake)	none (hidden: hand edit)

"Live" is for a change through the UI editor; the keys are re-read at every run. A hand edit of the file is read at the next start, or as soon as any save through the web UI or the API rewrites the file (that reloads the whole file) — the only way the three hidden keys change without a restart.

Known bug in 4.4: Advanced settings looks like it lists every [vpn_speedtest] key — iperf3_port, duration_secs and interval_secs are hidden there although 4.4 reads them — edit default.toml by hand and restart.

Upgrading: a file seeded from the 4.3 template (or carried over from 3.x) contains enabled = true, iperf3_server = "ping.online.net" and interval_secs = 3600. 4.3 ignored the last key; 4.4 reads it, so such a file saturates the line with a test every hour after the upgrade. Set interval_secs = 0 by hand (or untick enabled in Advanced settings › Maintenance, which also turns Run now off).

What the test measures and how it is shown: Monitoring and Logs (Speedtest (line test)).

[vpn_speedtest]
enabled = true
iperf3_server = "ping.online.net"
interval_secs = 0     # a 4.3 file may say 3600: one saturating test an hour in 4.4

[bench]

The whole section is Ignored, warned: none of its keys appears in the code, the 4.4 template no longer contains it, and Advanced settings hides it. Benchmark recording cannot be turned off and its sampling is fixed (see Monitoring and Logs). A file that still has the section gets, at every start:

config: [bench] is ignored: bench recording and its retention are built in; none of these keys is read. Instead: nothing; delete the section.

The keys a 4.3 file may hold: enabled, retention_days, race_snapshot_retention_days, snapshot_interval_secs, prune_interval_mins, vacuum. Delete the section.

Tracker host tables

Five tables map a tracker host to a value. All five are host = "value" tables of strings: always quote the value. A bare number ("tracker.example.org" = 48) is a type error, and a type error in the file stops Hydranos at startup. Quote the host too when it contains dots.

The Trackers tab writes all five through dedicated routes; that is the recommended way. Its form and buttons are described on Trackers and Announces, which owns their behaviour.

Table	Value	Host matching	Effect	Takes effect	Status	Written by (route)	UI
[announce_passkeys]	passkey	same host or any subdomain, case-insensitive, longest key wins (not a substring match)	Replaces the last path segment of matching announce URLs. A URL whose last path segment is exactly announce, or that ends with /, is left untouched. Any other last segment is replaced, even when the tracker carries the passkey in the query string (/announce.php?passkey=… becomes /<your passkey>?passkey=…): do not set an override for such a tracker.	Live through the route; restart if edited by hand	Works	POST /api/announce/passkeys {"host","passkey"} (empty passkey = delete); GET returns them in clear	Trackers › Edit › Passkey, Clear passkey; Advanced settings (hosts already in the table)
[announce_ip_modes]	v4 / v6 (ipv4, 4, ipv6, 6 also accepted); anything else = auto	same host or subdomain, longest key wins	Announce over one address family only. No entry = auto (one announce per family, same peer id). The route stores auto by deleting the entry.	Live through the route; restart if edited by hand	Works	POST /api/announce/ip-modes {"host","mode"} (auto, v4, v6)	Trackers › Edit › Announce (auto / v4 only / v6 only); Advanced settings (hosts already in the table)
[announce_min_seed_hours]	whole hours, as a string	exact host of the torrent's first tracker URL, case-sensitive, no subdomain rule	Seed obligation for the race drain. No entry (or a value that is not a whole number ≥ 0) = protected, never deleted by the drain. "0" = no obligation, may be deleted. The share limits wait for it too: a seed whose tracker declares nothing is never stopped or removed by a share limit.	Live (re-read on every drain pass)	Works	POST /api/announce/min-seed {"host","hours"}, or {"host","clear":true} to remove	Trackers › Edit › Minimum seed; Advanced settings (hosts already in the table)
[announce_muted]	any string: only the key's presence counts (the route writes "1", and deletes the key to unmute)	exact host as listed on the Trackers tab	Tracker faults stay visible but are marked acknowledged and left out of the tab's badge counts. Announces are unchanged.	Live	Works	POST /api/announce/mute {"host","muted"}	Trackers › Mute / Unmute; Advanced settings (hosts already in the table)
[announce_hidden]	any string: only the key's presence counts (the route writes "1", and deletes the key to unhide)	exact host as listed on the Trackers tab	Removes the row from the Trackers tab, badge included. A view setting only: the tracker is still announced to and counted.	Live	Works	POST /api/announce/hidden {"host","hidden"} or {"hosts":[…],"hidden"}	Trackers › Hide / Unhide, Hide them, Unhide all; Advanced settings (hosts already in the table)

None of the tables is in the template; the routes create them.

• Passkeys and IP modes edited by hand in the file are not pushed to the running announcers: they apply at the next start. Any later save through a passkey or IP-mode route pushes the whole current table.
• Advanced settings can change the value of a host already in one of the five tables (a quoted host key is matched by its bare name). It cannot add or remove a host: use the Trackers tab for that. A passkey or IP mode saved there is written and re-read but not pushed to the running announcers: it applies at the next restart (the save banner asks for one) or at the next save through a passkey or IP-mode route. Muted, hidden and minimum-seed values saved there apply at once.
• The batch form of the hide route ("hosts" with more than one host) skips hosts that carry a passkey or an IP mode, and lists them in skipped_configured.
• Seed-obligation semantics (which torrents the drain may delete, and when): Race Drain, Graduation and Seed Obligations.
• An engine with enable_ipv6 = false announces over IPv4 only, whatever the IP mode says: see Trackers and Announces.
• The template comment says passkeys are matched by "host substring" and pushed fleet-wide to other machines. Both are outdated: matching follows the table above, and the tables apply to the engines of this instance only.

[announce_passkeys]
"tracker.example.org" = "0123456789abcdef"

[announce_ip_modes]
"tracker.example.org" = "v4"

[announce_min_seed_hours]
"tracker.example.org" = "72"     # string, not a bare number
"public.example.org" = "0"       # no obligation: the drain may delete

[announce_muted]
"dead.example.org" = "1"

[announce_hidden]
"old.example.org" = "1"

Legacy [announce_clients]. Per-tracker client identity was removed. If a file still contains [announce_clients] tables, the first start of 4.3 or later stops the torrents whose first tracker matches them, once, and strips the tables from the file. See Upgrading from 3.x.

Reset to defaults

Config › Advanced settings (default.toml) › Reset to defaults (top right of the editor) › Reset and restart (POST /api/settings/reset) saves the current file as <config file>.bak-reset-<unix seconds>, writes the shipped template back, and keeps only four values, when they are non-empty strings: [auth] username, [auth] password_hash, [daemon] api_key and [daemon] data_dir. Then the UI restarts the daemon.

Everything else on this page goes back to the template or to its "If absent" value, in particular:

• [network] mode, [daemon] kill_switch, egress, bind_interface and [proxy] (and the engines' allow_direct and wireguard_* keys): an install that ran in WireGuard, SOCKS5, PROXY-v2 or Gluetun mode comes back in Direct mode with the kill switch disarmed, so its engines leave by the host's default route after the restart. The daemon's own requests switch to the default route as soon as the file is written, before the restart;
• the five tracker host tables (passkeys, IP modes, minimum seed hours, muted, hidden);
• [mcp], [dedup] (back to on, isolate), [rss], auto_port_forward, update_check_disabled, create_torrent_folder, and every engine block;
• [vpn_speedtest] (back to enabled = true, ping.online.net, no schedule).

Copy back what you need from the backup before the engines meet a tracker; the dialog's wording (Every setting goes back to what a fresh install ships: ports, network mode, tracker passkeys, client spoofs, engine tuning.) does not mention the kill switch. More: Configuration Reference and Operating Hydranos.

Sections and keys named at startup

Some keys and sections of older files are accepted and do nothing. At every start, Hydranos reads the raw file and logs one WARN line per such key present, in this form:

config: <where> is ignored: <why>. Instead: <what to use>.

The warning is never fatal; a file that does not parse gets its parse error instead. None of these keys is in the 4.4 template, and Advanced settings hides all of them. The complete list (deadkeys.rs):

Where (as logged)	Why it is ignored	Instead
daemon.agent_token	guarded the 3.x agent/front gRPC channel, which no longer exists	enrol the machine as a node (install.sh --register-to <url> --token <token>)
an agent or engine block (TOML array of tables): addr (only when not empty), token, tls_ca	3.x remote agent and its credentials	enrol the machine as a node
an agent or engine block: an engine sub-array (the 3.x per-agent override)	a 3.x per-agent engine override; nothing matches it	put the overridden keys in the block's session sub-table
race.listen_interfaces, hoard.listen_interfaces, and in a block's session	never passed to the engine	bind_interface = "<interface name>"
file_pool_size (same places)	the open-file pool is sized by aio_threads	aio_threads
custom_choking ([race.custom_choking], same places)	a 3.x choking strategy	choking = true and max_uploads_per_torrent
disk_slots ([hoard.disk_slots], same places)	per-disk seeding slots were never implemented	nothing; stop torrents yourself
[bench]	recording and retention are built in	nothing; delete the section
[metrics]	/metrics takes no configuration	nothing; /metrics is always served
[peer_intel]	not carried over from 3.x	nothing; delete the section
[arr_cleanup]	not carried over from 3.x; it removes nothing (POST /api/arr-cleanup/execute is gone: 404)	the *arr's own completed-download handling
[notify]	notifications are sent by workflows	a workflow with a webhook action (Workflows)
race_drain.min_age_minutes	the drain protects a torrent by its tracker's minimum seed time, not its age	Minimum seed on the Trackers tab ([announce_min_seed_hours])

A block is named by its name (or engine_id), else by its position:

config: [[engine]] "vpn7" token is ignored: …
config: [[engine]] #2 session.file_pool_size is ignored: …

The 3.x category fields placement, agents, strategy and min_free_bytes (stored with the categories, not in this file) get one similar line per field once the store is open, listing the categories that set them; they are kept for a rollback to 3.x. Upgrade context: Upgrading from 3.x.

[proxy] and [vpn_speedtest] are not on this list: 4.4 reads them (see above).

Any other unknown key or section is still accepted silently: a typo in a key name (enable_dth) produces no warning and no effect. Two engine keys of the template family are also silent and inert, inactivity_timeout and announce_rate_limit; see Configuration: Engines and Race Drain. The overall list of keys that do nothing is on Configuration Reference.

See also

• Configuration Reference: where the file is, how it is seeded and edited, restart rules, keys that do nothing.
• Configuration: Engines and Race Drain: [race], [hoard], engine blocks, [race_drain].
• Configuration: Environment Variables, CLI and Signals: everything outside the TOML.
• Security and Access · MCP Server (AI clients) · Trackers and Announces · Race Drain, Graduation and Seed Obligations · Networking: Ports, Port Forwarding and the Network Tab · VPN and Egress · RSS and Automatic Downloads · Queue, Share and Speed Limits · Known Limitations in 4.4