Configuring Alaveteli

You can control much of how Alaveteli looks and behaves just by changing the config settings.

The general configuration file

The Alaveteli code ships with an example configuration file: config/general.yml-example.

As part of the installation process, the example file gets copied to config/general.yml. You must edit this file to suit your needs.

Note that the default settings for frontpage examples are designed to work with the dummy data shipped with Alaveteli. Once you have real data, you should certainly edit these.

Note that there are other configuration settings and files too, for specific aspects of Alaveteli.

Config settings by topic

The following are all the configuration settings that you can change in config/general.yml. When you edit this file, remember it must be in the YAML syntax. It’s not complicated but — especially if you’re editing a list — be careful to get the indentation correct. If in doubt, look at the examples already in the file, and don’t use tabs.

All the general settings

SITE_NAME

SITE_NAME appears in various places throughout the site.

Examples:

SITE_NAME: 'Alaveteli'
SITE_NAME: 'WhatDoTheyKnow'

DOMAIN

Domain used in URLs generated by scripts (e.g. for going in some emails)

Examples:

DOMAIN: '127.0.0.1:3000'
DOMAIN: 'www.example.com'

FORCE_SSL

If true forces everyone (in the production environment) to use encrypted connections (via https) by redirecting unencrypted connections. This is highly recommended so that logins can't be intercepted by naughty people.

Example:

FORCE_SSL: true

FORCE_REGISTRATION_ON_NEW_REQUEST

Does a user need to sign in to start the New Request process?

Alaveteli will not send a request on behalf of a user until they have confirmed their email address. This setting controls when in the process such confirmation is required.

If FORCE_REGISTRATION_ON_NEW_REQUEST is false, a user who is not logged in can create a new request, but when they finally submit it they'll be invited to sign in or register; the request will not be sent until they have done so. That is, Alaveteli puts the confirmation of email address (by registering or signing in) at the end of the process. We recommend this because demanding registration right at the start may subtly discourage new users from making requests. If you don't want your site to behave in this way, set this to true.

This setting does not affect the way the site behaves if the user is already logged in.

Example:

We recommend you don't force registration at the start of the process:
FORCE_REGISTRATION_ON_NEW_REQUEST: false

THEME_URLS

URLs of themes to download and use (when running the rails-post-deploy script). The earlier in the list means the templates have a higher priority.

Example:

THEME_URLS:
 - 'https://github.com/mysociety/alavetelitheme.git'

THEME_URL

The URL of a single theme to download and use. This is the older, deprecated single-value form; new installations should use THEME_URLS instead, which accepts a prioritised list of themes. If set, a theme given here is installed after those listed in THEME_URLS.

Example:

THEME_URL: 'https://github.com/mysociety/alavetelitheme.git'

THEME_BRANCH

When rails-post-deploy installs the themes, it will first try the branch specified by THEME_BRANCH, if you've set it to a branch name. If the branch doesn't exist (or THEME_BRANCH is false, the default) it will fall back to using a tagged version specific to your installed Alaveteli version, and if that doesn't exist it will fall back to master.

The default theme is the "Alaveteli" theme. This gets installed automatically when rails-post-deploy runs.

Examples:

THEME_BRANCH: 'develop'
THEME_BRANCH: false

FRONTPAGE_PUBLICBODY_EXAMPLES

Specify which public bodies you want to be listed as examples on the home page, using their short_names. If you want more than one, separate them with semicolons. Comment this out if you want this to be auto-generated.

Warning: this is slow — don't use in production!

Examples:

FRONTPAGE_PUBLICBODY_EXAMPLES: 'tgq'
FRONTPAGE_PUBLICBODY_EXAMPLES: 'tgq;foo;bar'
# FRONTPAGE_PUBLICBODY_EXAMPLES:

PUBLIC_BODY_STATISTICS_PAGE & MINIMUM_REQUESTS_FOR_STATISTICS

If PUBLIC_BODY_STATISTICS_PAGE is set to true, Alaveteli will make a page of statistics on the performance of public bodies (which you can see at /body_statistics). The page will only consider public bodies that have had at least the number of requests set by MINIMUM_REQUESTS_FOR_STATISTICS.

Example:

PUBLIC_BODY_STATISTICS_PAGE: false
MINIMUM_REQUESTS_FOR_STATISTICS: 100

READ_ONLY

If present, READ_ONLY puts the site in read-only mode, and uses the text as reason (whole paragraph). Please use a read-only database user as well, as it only checks in a few obvious places.

Examples:

Typically, you do not want to run your site in read-only mode — so set READ_ONLY to be an empty string.
READ_ONLY: ''
READ_ONLY: 'The site is not currently accepting requests while we move the server.'

READ_ONLY_FEATURES

Granular read-only control for specific features. This lets you disable specific functionality without putting the entire site into read-only mode with READ_ONLY.

The available features are:

annotations blocks annotations on requests
classifications blocks request status classifications
followups blocks followup messages on requests
requests blocks new FOI requests
signups blocks new user registration

Examples:

Block only new requests:
READ_ONLY_FEATURES: ['requests']
Block new requests and annotations:
READ_ONLY_FEATURES: ['requests', 'annotations']

STAGING_SITE

Is this a staging or development site? If not, it's a live production site. This setting controls whether or not the rails-post-deploy script will create the file config/rails_env.rb file to force Rails into production environment.

Examples:

For staging or development:
STAGING_SITE: 1
For production:
STAGING_SITE: 0

ISO_COUNTRY_CODE

The ISO country code of the country in which your Alaveteli site is deployed.

Example:

ISO_COUNTRY_CODE: GB

ISO_CURRENCY_CODE

The ISO currency code of the currency in which Alaveteli Professional subscription costs are displayed. This does not affect the currency the plans are set up in, so it should match what is configured at Stripe.com.

Example:

ISO_CURRENCY_CODE: GBP

TIME_ZONE

This is the timezone that Alaveteli usese to display times and dates. If not set, defaults to UTC.

Example:

TIME_ZONE: Australia/Sydney

AVAILABLE_LOCALES & DEFAULT_LOCALE

AVAILABLE_LOCALES lists all the locales you want your site to support. If there is more than one, use spaces betwween the entries. Nominate one of these locales as the default with DEFAULT_LOCALE.

Examples:

AVAILABLE_LOCALES: 'en es'
DEFAULT_LOCALE: 'en'

USE_DEFAULT_BROWSER_LANGUAGE

Should Alaveteli try to use the default language of the user's browser?

Example:

USE_DEFAULT_BROWSER_LANGUAGE: true

REPLY_LATE_AFTER_DAYS REPLY_VERY_LATE_AFTER_DAYS WORKING_OR_CALENDAR_DAYS

The REPLY...AFTER_DAYS settings define how many days must have passed before an answer to a request is officially late. The WORKING_OR_CALENDAR_DAYS setting can be either "working" (the default) or "calendar", and determines which days are counted.

Examples:

REPLY_LATE_AFTER_DAYS: 20
REPLY_VERY_LATE_AFTER_DAYS: 40
WORKING_OR_CALENDAR_DAYS: working

ADMIN_USERNAME & ADMIN_PASSWORD DISABLE_EMERGENCY_USER

Details for the emergency user.

This is useful for creating the initial admin users for your site:

Create a new user (using regular sign up on the site)
Log in as the emergency user
Promote the new account
Disable the emergency user

For details of this process, see creating a admin account.

Examples:

ADMIN_USERNAME: 'adminxxxx'
ADMIN_PASSWORD: 'passwordx'
DISABLE_EMERGENCY_USER: false

SKIP_ADMIN_AUTH

Set this to true, and the admin interface will be available to anonymous users. Obviously, you should not set this to be true in production environments.

Example:

SKIP_ADMIN_AUTH: false

INCOMING_EMAIL_DOMAIN

Your email domain for incoming mail. See also How Alaveteli handles email.

Example:

INCOMING_EMAIL_DOMAIN: 'localhost'
INCOMING_EMAIL_DOMAIN: 'foifa.com'

INCOMING_EMAIL_PREFIX

An optional prefix to help you distinguish FOI requests. See also How Alaveteli handles email.

Example:

INCOMING_EMAIL_PREFIX: ''
INCOMING_EMAIL_PREFIX: 'foi+'

INCOMING_EMAIL_SECRET

Used for hash in request email address.

Example:

INCOMING_EMAIL_SECRET: '11ae 4e3b 70ff c001 3682 4a51 e86d ef5f'

INCOMING_EMAIL_SPAM_ACTION INCOMING_EMAIL_SPAM_HEADER & INCOMING_EMAIL_SPAM_THRESHOLD

Introduced in Alaveteli 0.22.2.0

Filter incoming mail that looks like spam. Spam can be redirected to the holding pen or discarded.

If you filter incoming emails through a spam detector like SpamAssassin, you can configure Alaveteli to filter messages with a high spam score.

This feature requires the messages to contain a header with a numeric spam score, and INCOMING_EMAIL_SPAM_ACTION, INCOMING_EMAIL_SPAM_HEADER and INCOMING_EMAIL_SPAM_THRESHOLD to be configured before the filtering will take effect.

Examples:

INCOMING_EMAIL_SPAM_ACTION: 'discard'
INCOMING_EMAIL_SPAM_ACTION: 'holding_pen'
INCOMING_EMAIL_SPAM_ACTION: 'false'
INCOMING_EMAIL_SPAM_HEADER: 'X-mySociety-Spam-Score'
INCOMING_EMAIL_SPAM_THRESHOLD: 20

BLACKHOLE_PREFIX

Used as envelope from at the incoming email domain for cases where you don't care about failure.

Example:

BLACKHOLE_PREFIX: 'do-not-reply-to-this-address'

CONTACT_EMAIL & CONTACT_NAME

Email "from" details. See also How Alaveteli handles email.

Examples:

CONTACT_EMAIL: 'team@example.com'
CONTACT_NAME: 'Alaveteli Webmaster'

TRACK_SENDER_EMAIL & TRACK_SENDER_NAME

Email "from" details for track messages. See also How Alaveteli handles email.

Examples:

TRACK_SENDER_EMAIL: 'alaveteli@example.com'
TRACK_SENDER_NAME: 'Alaveteli Webmaster'

RAW_EMAILS_LOCATION

Where the raw incoming email data gets stored. Make sure you back this up!

Example:

RAW_EMAILS_LOCATION: 'files/raw_emails'

EXCEPTION_NOTIFICATIONS_FROM & EXCEPTION_NOTIFICATIONS_TO

Email address(es) used for sending exception notifications.

Examples:

EXCEPTION_NOTIFICATIONS_FROM: do-not-reply-to-this-address@example.com

EXCEPTION_NOTIFICATIONS_TO:
 - robin@example.com
 - seb@example.com

FORWARD_NONBOUNCE_RESPONSES_TO

The email address to which non-bounce responses should be forwarded. See also How Alaveteli handles email.

Example:

FORWARD_NONBOUNCE_RESPONSES_TO: user-support@example.com

MTA_LOG_PATH

Path to your exim or postfix log files that will get sucked up by script/load-mail-server-logs.

Example:

MTA_LOG_PATH: '/var/log/exim4/exim-mainlog-*'

MTA_LOG_TYPE

Are you using "exim" or "postfix" for your Mail Transfer Agent (MTA)?

Example:

MTA_LOG_TYPE: "exim"

PRODUCTION_MAILER _DELIVERY_METHOD

What delivery method is being used for outgoing emails in production? The default value is sendmail, but there is experimental support for smtp. If you want to use an external SMTP server to send email, then you will also need to include SMTP configuration settings: SMTP_MAILER_ADDRESS, SMTP_MAILER_PORT, SMTP_MAILER_DOMAIN, SMTP_MAILER_USER_NAME, SMTP_MAILER_PASSWORD, SMTP_MAILER_AUTHENTICATION and SMTP_MAILER_ENABLE_STARTTLS_AUTO.

Example:

PRODUCTION_MAILER_DELIVERY_METHOD: "sendmail"

SMTP_MAILER_ADDRESS

Set this to localhost to use a local SMTP server, or the remote address of your SMTP server. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_ADDRESS: "smtp.gmail.com"

SMTP_MAILER_PORT

On the off chance that your mail server doesn't run on port 25, you can change it. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_PORT: 25

SMTP_MAILER_DOMAIN

If you need to specify a HELO domain, you can do it here. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_DOMAIN: gmail.com

SMTP_MAILER_USER_NAME

If your mail server requires authentication, set the username in this setting. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_USER_NAME: alaveteli

SMTP_MAILER_PASSWORD

If your mail server requires authentication, set the password in this setting. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_PASSWORD: supersecretpassword

SMTP_MAILER_AUTHENTICATION

If your mail server requires authentication, you need to specify the authentication type here. This is one of plain, login, cram_md5. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_AUTHENTICATION: plain

SMTP_MAILER_ENABLE_STARTTLS_AUTO

Set this to false if there is a problem with your server certificate that you cannot resolve. Only required if PRODUCTION_MAILER_DELIVERY_METHOD is set to smtp.

Example:

SMTP_MAILER_ENABLE_STARTTLS_AUTO: true

PRODUCTION_MAILER_RETRIEVER_METHOD

Introduced in Alaveteli 0.30.0.0

What retrieval method is being used for incoming emails in production?

The default value is passive - incoming emails must be piped into the application via the mailin script. There is experimental support for polling a POP3 server for messages, if PRODUCTION_MAILER_RETRIEVER_METHOD is set to pop.

For some guidance on considerations and setup for running a POP service, see how Alaveteli handles email.

If you want to use an external POP3 server to receive email, then you will also need to include POP configuration settings: POP_MAILER_ADDRESS, POP_MAILER_PORT, POP_MAILER_USER_NAME, POP_MAILER_PASSWORD and POP_MAILER_ENABLE_SSL.

Example:

PRODUCTION_MAILER_RETRIEVER_METHOD: "passive"

POP_MAILER_ADDRESS

Introduced in Alaveteli 0.30.0.0

Set this to the address of the POP3 server you want to poll for incoming messages. Only required if PRODUCTION_MAILER_RETRIEVER_METHOD is set to pop.

Example:

POP_MAILER_ADDRESS: 'localhost'

POP_MAILER_PORT

Introduced in Alaveteli 0.30.0.0

The port that your POP3 server accepts connections on. Only required if PRODUCTION_MAILER_RETRIEVER_METHOD is set to pop.

Example:

POP_MAILER_PORT: 995

POP_MAILER_USER_NAME

Introduced in Alaveteli 0.30.0.0

Set the username of the account user to connect to the POP server. Only required if PRODUCTION_MAILER_RETRIEVER_METHOD is set to pop.

Example:

POP_MAILER_USER_NAME: 'jane322'

POP_MAILER_PASSWORD

Introduced in Alaveteli 0.30.0.0

Set the password of the account user to connect to the POP server. Only required if PRODUCTION_MAILER_RETRIEVER_METHOD is set to pop.

Example:

POP_MAILER_PASSWORD: 'supersecretpassword'

POP_MAILER_ENABLE_SSL

Introduced in Alaveteli 0.30.0.0

Should Alaveteli use SSL when connecting to the POP3 server used? Only required if PRODUCTION_MAILER_RETRIEVER_METHOD is set to pop.

Example:

POP_MAILER_ENABLE_SSL: true

RESTRICT_NEW_RESPONSES_ON_OLD_REQUESTS_AFTER_MONTHS

Introduced in Alaveteli 0.23.0.0

Number of months after which to start restricting new responses to requests. When a request has not been updated after RESTRICT_NEW_RESPONSES_ON_OLD_REQUESTS_AFTER_MONTHS, allow_new_responses_from is set to 'authority_only'. After RESTRICT_NEW_RESPONSES_ON_OLD_REQUESTS_AFTER_MONTHS × 4 , allow_new_responses_from is set to 'nobody'.

For details of this process, see old requests.

Examples:

RESTRICT_NEW_RESPONSES_ON_OLD_REQUESTS_AFTER_MONTHS: 3

SECRET_KEY_BASE

Used as the base from which Rails generates and verifies signed cookies (among other things). Make it long and random; you can generate a suitable value with rake secret. The built-in default is insecure because the code is open source, so you must override it for live sites.

Example:

SECRET_KEY_BASE: 'uIngVC238Jn9NsaQizMNf89pliYmDBFugPjHS2JJmzOp8'

RECAPTCHA_SITE_KEY & RECAPTCHA_SECRET_KEY

Recaptcha, for detecting humans. Get keys here: https://www.google.com/recaptcha. Currently Alaveteli requires a reCAPTCHA v2 Checkbox key.

Examples:

RECAPTCHA_SITE_KEY: '7HoPjGBBBBBBBBBkmj78HF9PjjaisQ893'
(Called RECAPTCHA_PUBLIC_KEY before release 0.32)
RECAPTCHA_SECRET_KEY: '7HjPjGBBBBBCBBBpuTy8a33sgnGG7A'
(Called RECAPTCHA_PRIVATE_KEY before release 0.32)

ENABLE_ANTI_SPAM

If set to true, Alaveteli enforces a set of extra restrictions to combat spam requests, annotations and profile content. This includes the ability to restrict IP addresses from some countries from performing some actions (see RESTRICTED_COUNTRIES), showing a reCAPTCHA on new request submission, and preventing the submission of requests, annotations and profile text matching a set of spam content patterns.

Example:

ENABLE_ANTI_SPAM: false

BLOCK_RATE_LIMITED_IPS

Prevent user signups if several signup attempts from the same IP address are made in quick succession.

Example:

BLOCK_RATE_LIMITED_IPS: false

BLOCK_RESTRICTED_COUNTRY_IPS

Prevent users signing up and making requests if their IP address originates in one of the RESTRICTED_COUNTRIES.

Example:

BLOCK_RESTRICTED_COUNTRY_IPS: false

BLOCK_SPAM_ABOUT_ME_TEXT

Prevent users submitting spam as their "About me" profile text.

Example:

BLOCK_SPAM_ABOUT_ME_TEXT: false

BLOCK_SPAM_COMMENTS

Prevent users submitting comments that appear to be spam.

Example:

BLOCK_SPAM_COMMENTS: false

BLOCK_SPAM_REQUESTS

Prevent users submitting requests that appear to be spam.

Example:

BLOCK_SPAM_REQUESTS: false

BLOCK_SPAM_SIGNINS

Prevent user signins from spam email domains or names which appear to be spam.

Example:

BLOCK_SPAM_SIGNINS: false

BLOCK_SPAM_SIGNUPS

Prevent user signups from spam email domains or names which appear to be spam.

Example:

BLOCK_SPAM_SIGNUPS: false

BLOCK_SPAM_USER_MESSAGES

Prevent users submitting user to user messages that appear to be spam.

Example:

BLOCK_SPAM_USER_MESSAGES: false

RESTRICTED_COUNTRIES

Restrict IP addresses from some countries from performing some actions. If set, requests from IP addresses in the countries specified are prevented from making new requests on the site. Country codes can be prefixed with ! to invert the list from restricted to permitted (that is, to allow requests only from the specified countries). Given as a string of space-separated uppercase ISO Alpha-2 codes.

Examples:

Block GB and ES:
RESTRICTED_COUNTRIES: 'GB ES'
Only allow GB and ES:
RESTRICTED_COUNTRIES: '!GB !ES'

NEW_REQUEST_RECAPTCHA

Show a reCAPTCHA on the new request submission form if a user is not signed in or not marked as confirmed not spam. Requires RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY to be set.

Example:

NEW_REQUEST_RECAPTCHA: false

CONTACT_FORM_RECAPTCHA

Show a reCAPTCHA on the contact form to discourage spammers. Requires RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY to be set. You also need to add the reCAPTCHA tags to help/_contact_form.html.erb in your theme (just above the submit button works best):

<% if @recaptcha_required %>
  <%= recaptcha_tags %><br />
<% end %>

Example:

CONTACT_FORM_RECAPTCHA: false

USER_CONTACT_FORM_RECAPTCHA

Show a reCAPTCHA on the user to user contact form to discourage spammers. Requires RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY to be set.

Example:

USER_CONTACT_FORM_RECAPTCHA: false

GEOIP_DATABASE

Alaveteli uses a GeoIP database to determine the country from the IP address of an HTTP request to the site (this lets us suggest an Alaveteli in the user's country if one exists). You shouldn't need to change this if you have the geoip-database package installed as specified in the config/packages files. You must set MAXMIND_LICENSE_KEY with this setting.

Example:

GEOIP_DATABASE: vendor/data/GeoLite2-Country.mmdb

MAXMIND_LICENSE_KEY

MaxMind requires a free licence key to download the GeoLite2 databases used by GEOIP_DATABASE. You must set this if you want Alaveteli to download and update the GeoIP database. See MaxMind's announcement for details.

Example:

MAXMIND_LICENSE_KEY: ''

GA_CODE (GA=Google Analytics)

Adding a value here will enable Google Analytics on all non-admin pages for non-admin users.

Examples:

GA_CODE: ''
GA_CODE: 'AB-8222142-14'

UTILITY_SEARCH_PATH

Search path for external command-line utilities (such as pdftk, unrtf).

Example:

UTILITY_SEARCH_PATH: ["/usr/bin", "/usr/local/bin"]

SHARED_FILES_PATH

In some deployments of Alaveteli you may wish to install each newly deployed version alongside the previous ones, in which case certain files and resources should be shared between these installations. For example, the files directory, the cache directory and the generated graphs such as public/foi-live-creation.png. If you're installing Alaveteli in such a setup then set SHARED_FILES_PATH to the directory you're keeping these files under. Otherwise, leave it blank.

Example:

SHARED_FILES_PATH: ''

SHARED_FILES & SHARED_DIRECTORIES

If you have SHARED_FILES_PATH set, then these options list the files and directories that are shared; i.e. those to which the deploy scripts should create symlinks from the repository.

Examples:

SHARED_FILES:
 - config/database.yml
 - config/general.yml
 - config/sidekiq.yml
 - config/storage.yml
 - config/rails_env.rb
 - config/httpd.conf
 - public/foi-live-creation.png
 - public/foi-user-use.png
 - config/aliases

SHARED_DIRECTORIES:
 - files/
 - cache/
 - lib/acts_as_xapian/xapiandbs/
 - log/
 - storage/
 - tmp/pids
 - vendor/bundle
 - public/assets

BUNDLE_PATH

The path that Bundler installs gems into. The deploy scripts read this value (via bin/config) and run bundle config set --local path with it, so gems are installed there rather than system-wide. It is used by the deployment tooling, not read by the running application. If it is not set, it defaults to vendor/bundle.

Examples:

BUNDLE_PATH: vendor/bundle
BUNDLE_PATH: /var/alaveteli/bundle

NEW_RESPONSE_REMINDER_AFTER_DAYS

Number of days after which to send a 'new response reminder'.

Example:

NEW_RESPONSE_REMINDER_AFTER_DAYS: [3, 10, 24]

AUTHORITY_MUST_RESPOND

Introduced in Alaveteli version 0.21

Set this to true if authorities must respond by law. Set to false otherwise. It defaults to true. At the moment this just controls the display of some UI text telling users that the authority must respond to them by law.

Example:

AUTHORITY_MUST_RESPOND: true

MAX_REQUESTS_PER_USER_PER_DAY

This rate limiting can be turned off per-user via the admin interface.

Example:

MAX_REQUESTS_PER_USER_PER_DAY: 6

OVERRIDE_ALL_PUBLIC_BODY_REQUEST_EMAILS

If you want to override all the public body request emails with your own email address so that request emails that would normally go to the public body go to you, use this setting. This is useful for a staging server, so you can play with the whole process of sending requests without inadvertently sending an email to a real authority.

Examples:

OVERRIDE_ALL_PUBLIC_BODY_REQUEST_EMAILS: test-email@foo.com
If you don't want this behaviour, comment the setting out
# OVERRIDE_ALL_PUBLIC_BODY_REQUEST_EMAILS:

PUBLIC_BODY_LIST_FALLBACK_TO_DEFAULT_LOCALE

If you would like the public body list page to include bodies that have no translation in the current locale (but which do have a translation in the default locale), set this to true.

Example:

PUBLIC_BODY_LIST_FALLBACK_TO_DEFAULT_LOCALE: false

ENABLE_WIDGETS

If you would like to give users the opportunity to insert HTML 'widgets' into their other websites, advertising the requests they've made in Alaveteli, set this to true. A link to add a widget will appear in the sidebar of each request page. Users following the link can preview the widget for that request, and cut and paste the HTML to produce the widget into their own site.

Example:

ENABLE_WIDGETS: false

ENABLE_TWO_FACTOR_AUTH

Introduced in Alaveteli 0.23.0.0

Enable a second step of authentication for dangerous account actions. Currently only active for changing password. Two factor auth is opt-in per user.

Example:

ENABLE_TWO_FACTOR_AUTH: true

ENABLE_ANNOTATIONS

Introduced in Alaveteli 0.25.0.0

Enable the annotations (comments on requests) feature. Annotations are on by default as they've been a standard feature for some time, but this setting allows new sites to turn them off if they're not desired.

Example:

ENABLE_ANNOTATIONS: true

ENABLE_PUBLIC_ANNOTATIONS

If set to true, comments (annotations) are allowed on all requests, regardless of who made the request. If set to false, comments are only allowed by the requester or admin users.

Example:

ENABLE_PUBLIC_ANNOTATIONS: true

ENABLE_USER_TO_USER_MESSAGING

If set to true, Alaveteli allows users to send messages to each other through the site. If set to false, user-to-user messaging is disabled.

Example:

ENABLE_USER_TO_USER_MESSAGING: true

SURVEY_URL

If set, one month after a request has been made Alaveteli will email the user with a link to a survey at this URL.

Example:

SURVEY_URL: 'https://example.com/survey'

USER_SIGN_IN_ACTIVITY_RETENTION_DAYS

Retains records of the IP addresses used to sign in to user accounts for the configured number of days. This value should be less than or equal to the number of days of logs retained by your logrotate configuration, otherwise you may hold data in a way that is inconsistent with your privacy policy. When set to 0, no sign-in activity is recorded.

Example:

USER_SIGN_IN_ACTIVITY_RETENTION_DAYS: 0

BLOG_FEED

These feeds are displayed accordingly on the Alaveteli "blog" page.

Currently WordPress is the only "officially supported" external blog feed, but other feeds may work if they use the same data format.

Example:

BLOG_FEED: 'https://www.mysociety.org/category/projects/whatdotheyknow/feed/'

BLOG_TIMEOUT

The number of seconds to wait when reading the BLOG_FEED before the request fails.

Example:

BLOG_TIMEOUT: 60

FACEBOOK_USERNAME

Makes your Facebook page URL available to the application. Also adds a Facebook link to the footer.

Examples:

FACEBOOK_USERNAME: whatdotheyknowcom

TWITTER_USERNAME TWITTER_WIDGET_ID

If you want a twitter feed displayed on the "blog" page, provide the widget ID and username.

Examples:

TWITTER_USERNAME: WhatDoTheyKnow
TWITTER_WIDGET_ID: '833549204689320031'

DONATION_URL

URL where people can donate to the organisation running the site. If set, this will be included in the message people see when their request is successful.

Example:

DONATION_URL: "https://www.mysociety.org/donate/"

DEBUG_RECORD_MEMORY

For debugging memory problems. If true, Alaveteli logs the memory use increase of the Ruby process due to the request (Linux only). Since Ruby never returns memory to the OS, if the existing process previously served a larger request, this won't show any consumption for the later request.

Example:

DEBUG_RECORD_MEMORY: false

VARNISH_HOSTS

If you're running behind Varnish, set this to work out where to send purge requests to invalidate the Varnish cache. Otherwise, don't set it. Given as a list of hosts.

Example:

```
VARNISH_HOSTS:
 - host1
 - host2
```

USE_MAILCATCHER_IN_DEVELOPMENT

If true, while in development mode, try to send mail by SMTP to port 1025 (the port the mailcatcher listens on by default):

Example:

USE_MAILCATCHER_IN_DEVELOPMENT: true

USE_BULLET_IN_DEVELOPMENT

Enables Bullet, a tool that helps to kill N+1 queries and unnecessary eager loading, while running in development mode.

Example:

USE_BULLET_IN_DEVELOPMENT: false

USE_GHOSTSCRIPT_COMPRESSION

Currently we default to using pdftk to compress PDFs. You can optionally try Ghostscript, which should do a better job of compression. Some versions of pdftk are buggy with respect to compression, in which case Alaveteli doesn't recompress the PDFs at all and logs a warning message "Unable to compress PDF" — which would be another reason to try this setting.

Example:

USE_GHOSTSCRIPT_COMPRESSION: true

CACHE_FRAGMENTS

Use memcached to cache HTML fragments for better performance. This will only have an effect in environments where config.action_controller.perform_caching is set to true

Example:

CACHE_FRAGMENTS: true

ENABLE_ALAVETELI_PRO

If set to true, Alaveteli includes extra functionality and account levels for professional FOI users, for example journalists. Professional users have access to a dashboard, a more streamlined request process, and crucially the ability to embargo their requests so that they remain private.

Enabling this is a large change, so you may want to contact the Alaveteli team before doing so. See also Alaveteli Professional.

Example:

ENABLE_ALAVETELI_PRO: false

ENABLE_PRO_PRICING

If set to true, Alaveteli lets users enter their bank details and subscribe to a Stripe subscription which grants them access to the pro role and all the features of Alaveteli Professional. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

ENABLE_PRO_PRICING: false

ENABLE_PRO_SELF_SERVE

This option is only used when ENABLE_PRO_PRICING is set to false. If set to true, Alaveteli lets users upgrade their accounts to Pro without needing to enter payment details. If set to false, admins receive an account request email and have to assign the role in the Alaveteli admin interface. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

ENABLE_PRO_SELF_SERVE: false

ENABLE_PROJECTS

Warning: Projects is not ready for re-use.

Enables the Projects feature. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

ENABLE_PROJECTS: false

PRO_CONTACT_EMAIL

Contact email address for Alaveteli Professional. Requests made through Alaveteli Professional may be embargoed, meaning the user expects them to be private, which can include being private from some of the site's administration team. Even where this is not the case, you may wish to redirect pro support email away from the usual address. If you want all support mail to go to the same address, make this the same as CONTACT_EMAIL. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

PRO_CONTACT_EMAIL: 'pro-contact@localhost'

PRO_CONTACT_NAME

The name to address emails to when sending email to PRO_CONTACT_EMAIL. If you want all support mail to go to the same address, make this the same as CONTACT_NAME. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

PRO_CONTACT_NAME: 'Alaveteli Professional'

PRO_SITE_NAME

The name to use when referring to the Alaveteli Professional parts of an Alaveteli site. For example, in the UK the mySociety instance is called "WhatDoTheyKnow" but the pro parts of the site are referred to as "WhatDoTheyKnow Pro". If you don't want a different name for the pro pages, make this the same as SITE_NAME. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

PRO_SITE_NAME: 'Alaveteli Professional'

PRO_BATCH_AUTHORITY_LIMIT

The total number of authorities that can be added to an Alaveteli Professional batch request. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

PRO_BATCH_AUTHORITY_LIMIT: 500

PRO_REFERRAL_COUPON

A Stripe coupon code, displayed to existing Pro users on their subscriptions page, that they can share with friends so those friends receive a signup discount. This should not include the STRIPE_NAMESPACE. You must set a humanized_terms key in the coupon metadata to display the discount that will be applied when using the coupon (for example, "50% off for 1 month"). This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

PRO_REFERRAL_COUPON: 'PROREFERRAL'

EXTERNAL_REVIEWERS

Enable referral of requests to external reviewers. This is likely to be an Information Commissioner or similar. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

EXTERNAL_REVIEWERS: ico@example.net

FORWARD_PRO_NONBOUNCE_RESPONSES_TO

The email address to which non-bounce responses to emails sent out to Alaveteli Professional users should be forwarded. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

FORWARD_PRO_NONBOUNCE_RESPONSES_TO: pro-user-support@example.com

STRIPE_PUBLISHABLE_KEY

Stripe.com publishable key. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

STRIPE_PUBLISHABLE_KEY: pk_test_UD6BDsARFZIYb8273dbdl

STRIPE_SECRET_KEY

Stripe.com secret key. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

STRIPE_SECRET_KEY: sk_test_UD6BDsARFZIYb8273dbdl

STRIPE_NAMESPACE

An optional Stripe.com namespace which allows plans and coupons to be separated from other resources within Stripe. If used, the Stripe resources need IDs like <namespace>-<id>. Must be uppercase. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

STRIPE_NAMESPACE: 'ALAVETELI'

STRIPE_PRICES

A list of Stripe Prices which, if a user signs up to, grant them access to Alaveteli Pro. These are rendered on the pro pricing pages in the order defined here. Given as a hash whose keys are the Stripe Price IDs and whose values are a parameterised, short, human-readable string. Historical Stripe Price IDs listed here should include the STRIPE_NAMESPACE. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

```
STRIPE_PRICES:
  pro: pro
```

STRIPE_WEBHOOK_SECRET

Stripe.com webhook secret. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

STRIPE_WEBHOOK_SECRET: wh_test_UD6BDsARFZIYb8273dbdl

STRIPE_TAX_RATE

The rate of tax / VAT to add to Pro subscriptions. Note that the price per unit of your Stripe product plan must be created without tax; Alaveteli automatically calculates the gross amount to charge. This only takes effect when ENABLE_ALAVETELI_PRO is set to true.

Example:

STRIPE_TAX_RATE: '0.20'

Other configuration settings and files

There are more configuration settings for Alaveteli Professional and Alaveteli Pro Pricing.

Note that there are other configuration files for Alaveteli — you’ll find them all in the config directory. These are presented in the git repository as *-example files which you can copy into place.

database.yml: database settings (as per Rails)
deploy.yml: deployment specifications used by Capistrano
httpd.conf, nginx.conf: Apache and Nginx configuration suggestions

Configuring Alaveteli

The general configuration file

Config settings by topic

Appearance and overall behaviour of the site:

Site status:

Locale and internationalisation:

Definition of “late”:

Admin access:

Email management:

General admin (keys, paths, back-end services):

Behaviour settings and switches:

External public services:

Development work or special cases:

Anti-spam and abuse:

Alaveteli Professional:

All the general settings

Other configuration settings and files