ConfigAccessorPlugin

Display configuration values, roles, permissions, and system settings on any page. See Plugins for a complete list of available plugins.

Syntax

[{ConfigAccessor key='ngdpbase.server.port'}]
[{ConfigAccessor type='roles'}]

You must supply either key or type.

Parameters

Parameter	Type	Default	Description
`key`	string	(required or `type`)	Dot-notation config key. Supports `*` wildcards.
`type`	string	(required or `key`)	Named display type — see [Types](#types) below.
`valueonly`	boolean	`false`	Return plain text instead of a formatted card.
`before`	string	(none)	Prefix before each value (use with `valueonly`).
`after`	string	`''` / `\n`	Suffix after each value. Default: `''` for single keys, `\n` for wildcards.
`caption`	string	(none)	Descriptive text shown below a single `key` value.
`table`	boolean	`false`	Force a single `key` result into table format.
`noheader`	boolean	`false`	Suppress the card header on wildcard and single-key results.
`pageSize`	number	`0`	Rows per page for wildcard results. `0` shows all rows (no pagination).
`page`	number	`1`	Page number when using `pageSize`. Also reads from the `?page=` query string.
`manager`	string	(none)	Manager name — required when `type='manager'`.
`feature`	string	(none)	Feature name — required when `type='feature'`.
`enabled`	boolean	(none)	Filter keywords or categories by enabled state.
`category`	string	(none)	Filter by category (use with `userKeywords`, `systemKeywords`).
`storageLocation`	string	(none)	`regular` or `required` — filter system categories.

Key Examples

Single config value

[{ConfigAccessor key='ngdpbase.server.port'}] renders as:

Current Configuration Value

Key: ngdpbase.server.port

Value: 3000

Single value with caption

[{ConfigAccessor key='ngdpbase.server.port' caption='Port the server binds to'}] renders as:

Current Configuration Value

Key: ngdpbase.server.port

Value: 3000

Port the server binds to

Single value forced into table format

[{ConfigAccessor key='ngdpbase.server.port' table='true'}] renders as:

Key	Value
`ngdpbase.server.port`	`3000`

Single value without header

[{ConfigAccessor key='ngdpbase.server.port' noheader='true'}] renders as:

Key: ngdpbase.server.port

Value: 3000

Inline value in text

Running [{ConfigAccessor key='ngdpbase.application-name' valueonly='true'}] version [{ConfigAccessor key='ngdpbase.version' valueonly='true'}].

Running GeoHazardWatch version 5.34.0.

Wildcard — all server keys

[{ConfigAccessor key='ngdpbase.server.*'}] renders as:

Configuration Values (7 matches) — ngdpbase.server.*

Key	Value
`ngdpbase.server.behind-cloudflare`	`false`
`ngdpbase.server.geolite2-city-file`
`ngdpbase.server.host`	`0.0.0.0`
`ngdpbase.server.port`	`3000`
`ngdpbase.server.tls.cert-file`
`ngdpbase.server.tls.key-file`
`ngdpbase.server.trust-proxy`	`false`

Wildcard without header

[{ConfigAccessor key='ngdpbase.server.*' noheader='true'}] renders as:

Key	Value
`ngdpbase.server.behind-cloudflare`	`false`
`ngdpbase.server.geolite2-city-file`
`ngdpbase.server.host`	`0.0.0.0`
`ngdpbase.server.port`	`3000`
`ngdpbase.server.tls.cert-file`
`ngdpbase.server.tls.key-file`
`ngdpbase.server.trust-proxy`	`false`

Wildcard with pagination

Use pageSize to break large wildcard results into pages. Prev/Next links appear automatically when there is more than one page.

[{ConfigAccessor key='ngdpbase.*' pageSize='10'}] renders as:

Configuration Values (627 matches) — ngdpbase.*

Key	Value
`ngdpbase.mail.failure-notice.window-minutes`	`60`
`ngdpbase.mail.from`	`GeoHazardWatch Contact <[email protected]>`
`ngdpbase.mail.honeypot.enabled`	`true`
`ngdpbase.mail.provider`	`smtp`
`ngdpbase.mail.provider.smtp.from`
`ngdpbase.mail.provider.smtp.host`	`smtp.gmail.com`
`ngdpbase.mail.provider.smtp.pass`	`(hidden)`
`ngdpbase.mail.provider.smtp.port`	`587`
`ngdpbase.mail.provider.smtp.secure`	`false`
`ngdpbase.mail.provider.smtp.user`	`[email protected]`

Types

The type parameter selects a named display mode. Valid values:

Type	Description
`roles`	All configured roles with display name, description, and type
`permissions`	Role × permission matrix showing which roles have which permissions
`policy-summary`	Alias for `permissions`
`permissionsList`	All permissions grouped by target with name, icon, and description
`actions`	All unique actions defined in ACL policies
`policies`	ACL policies sorted by priority
`authMethods`	Authentication providers (sensitive fields masked for non-admins)
`features`	Feature flags grouped by feature name
`user-summary`	Current user's login status, roles, and permissions
`userKeywords`	User-defined keywords for content tagging
`systemKeywords`	System-defined controlled vocabulary keywords
`systemCategories`	System categories that determine page storage location
`manager`	Configuration for a named manager (requires `manager=`)
`feature`	Configuration for a named feature (requires `feature=`)

Type Examples

Roles

[{ConfigAccessor type='roles'}] renders as:

Available Roles

System and user-defined roles

Role Name	Display Name	Description	Type
`admin`	Administrator	Full system access to all features	System
`anonymous`	Anonymous	Public access without authentication	System
`contributor`	Contributor	Can create and edit pages	System
`editor`	Editor	Can create, edit, delete, and rename pages	System
`reader`	Reader	Read-only access to content	System
`user-admin`	User Administrator	Can manage users — create, edit, deactivate, delete	System
`vault-owner`	Vault Owner	Everything inside your own vaults — pages and files: read, create, edit, rename, delete, upload, share by link. Applies only in vaults you own; not deleting a vault. Given to every account (#1539)	System
`demo-admin`	Demo Administrator	Read-only access to the admin dashboard. For public demo instances: can view every admin screen but change nothing, and cannot see the user list.	Custom

Total Roles: 8 | System Roles: 7 | Custom Roles: 1

Permissions matrix (role × permission)

[{ConfigAccessor type='permissions'}] renders as:

Security Policy Summary

Permissions matrix showing which roles have which permissions, derived from the access policies

Permission	Administrator	User Administrator	Editor	Contributor	Demo Administrator	Vault Owner	Reader	Anonymous
`page-read` View pages
`page-edit` Edit pages
`page-public` Make a page public by moving it out of its vault
`page-create` Create pages
`page-delete` Delete pages
`page-rename` Rename pages
`page-export` Export pages
`asset-read` View attachments
`media-read` Browse and view the media library
`asset-upload` Upload attachments
`asset-delete` Delete attachments
`share-create` Create share links and see your own
`share-extend` Extend your own share links
`share-revoke` Revoke your own share links
`profile-manage` Manage your own profile and preferences
`account-security` Change your password, email and sign-in methods, and approve devices
`config-manage` Change site settings and download backups
`secret-reveal` Show hidden configuration secrets
`comment-create` Add comments and delete your own
`token-mint` Make and revoke your own agent tokens
`token-extend` Extend your own agent tokens
`proxy-grant` Let someone act for you, and stop them
`vault-proxy` Let someone acting for you into your vaults
`store-create` Create your own private store
`asset-edit` Edit attachment details such as photo information
`search-page` Search pages
`search-user` Search for people
`user-read` View the list of people and their profiles
`user-edit` Edit people's accounts
`user-create` Create accounts
`user-delete` Delete accounts
`identity-read` Find and view identity records (users, contacts and organizations)
`identity-manage` Add, change and link identity records (users, contacts and organizations)
`admin-read` View administration screens without changing anything
`admin-system` Administer the site
`admin-roles` Manage roles
`page-raw-edit` Edit a page's raw file, skipping the page editor's checks
`session-revoke` Sign other people out
`audit-export` Export the audit trail

Total Permissions: 39 | Total Roles: 8

Permissions list (all permissions with descriptions)

[{ConfigAccessor type='permissionsList'}] renders as:

Account Permissions

Permission	Icon	What it lets you do
`account-security`		Change your password, email and sign-in methods, and approve devices

Admin Permissions

Permission	Icon	What it lets you do
`admin-read`		View administration screens without changing anything
`admin-system`		Administer the site
`admin-roles`		Manage roles

Asset Permissions

Permission	Icon	What it lets you do
`asset-read`		View attachments
`asset-upload`		Upload attachments
`asset-delete`		Delete attachments
`asset-edit`		Edit attachment details such as photo information

Audit Permissions

Permission	Icon	What it lets you do
`audit-export`		Export the audit trail

Comment Permissions

Permission	Icon	What it lets you do
`comment-create`		Add comments and delete your own

Config Permissions

Permission	Icon	What it lets you do
`config-manage`		Change site settings and download backups

Identity Permissions

Permission	Icon	What it lets you do
`identity-read`		Find and view identity records (users, contacts and organizations)
`identity-manage`		Add, change and link identity records (users, contacts and organizations)

Media Permissions

Permission	Icon	What it lets you do
`media-read`		Browse and view the media library

Page Permissions

Permission	Icon	What it lets you do
`page-read`		View pages
`page-edit`		Edit pages
`page-public`		Make a page public by moving it out of its vault
`page-create`		Create pages
`page-delete`		Delete pages
`page-rename`		Rename pages
`page-export`		Export pages
`page-raw-edit`		Edit a page's raw file, skipping the page editor's checks

Profile Permissions

Permission	Icon	What it lets you do
`profile-manage`		Manage your own profile and preferences

Proxy Permissions

Permission	Icon	What it lets you do
`proxy-grant`		Let someone act for you, and stop them

Search Permissions

Permission	Icon	What it lets you do
`search-page`		Search pages
`search-user`		Search for people

Secret Permissions

Permission	Icon	What it lets you do
`secret-reveal`		Show hidden configuration secrets

Session Permissions

Permission	Icon	What it lets you do
`session-revoke`		Sign other people out

Share Permissions

Permission	Icon	What it lets you do
`share-create`		Create share links and see your own
`share-extend`		Extend your own share links
`share-revoke`		Revoke your own share links

Store Permissions

Permission	Icon	What it lets you do
`store-create`		Create your own private store

Token Permissions

Permission	Icon	What it lets you do
`token-mint`		Make and revoke your own agent tokens
`token-extend`		Extend your own agent tokens

User Permissions

Permission	Icon	What it lets you do
`user-read`		View the list of people and their profiles
`user-edit`		Edit people's accounts
`user-create`		Create accounts
`user-delete`		Delete accounts

Vault Permissions

Permission	Icon	What it lets you do
`vault-proxy`		Let someone acting for you into your vaults

Total: 39 permissions in 19 groups

Actions (from ACL policies)

[{ConfigAccessor type='actions'}] renders as:

Available Actions (Permissions)

All unique actions defined in access control policies

Category	Actions
`account-security`	`account-security`
`admin-read`	`admin-read`
`admin-roles`	`admin-roles`
`admin-system`	`admin-system`
`asset-delete`	`asset-delete`
`asset-edit`	`asset-edit`
`asset-read`	`asset-read`
`asset-upload`	`asset-upload`
`audit-export`	`audit-export`
`comment-create`	`comment-create`
`config-manage`	`config-manage`
`identity-manage`	`identity-manage`
`identity-read`	`identity-read`
`media-read`	`media-read`
`page-create`	`page-create`
`page-delete`	`page-delete`
`page-edit`	`page-edit`
`page-export`	`page-export`
`page-public`	`page-public`
`page-raw-edit`	`page-raw-edit`
`page-read`	`page-read`
`page-rename`	`page-rename`
`profile-manage`	`profile-manage`
`proxy-grant`	`proxy-grant`
`search-page`	`search-page`
`search-user`	`search-user`
`secret-reveal`	`secret-reveal`
`session-revoke`	`session-revoke`
`share-create`	`share-create`
`share-extend`	`share-extend`
`share-revoke`	`share-revoke`
`store-create`	`store-create`
`token-extend`	`token-extend`
`token-mint`	`token-mint`
`user-create`	`user-create`
`user-delete`	`user-delete`
`user-edit`	`user-edit`
`user-read`	`user-read`
`vault-proxy`	`vault-proxy`

Total Actions: 39 | Categories: 39

[{ConfigAccessor type='actions' valueonly='true' before='* ' after='\n'}] renders as:

* account-security
* admin-read
* admin-roles
* admin-system
* asset-delete
* asset-edit
* asset-read
* asset-upload
* audit-export
* comment-create
* config-manage
* identity-manage
* identity-read
* media-read
* page-create
* page-delete
* page-edit
* page-export
* page-public
* page-raw-edit
* page-read
* page-rename
* profile-manage
* proxy-grant
* search-page
* search-user
* secret-reveal
* session-revoke
* share-create
* share-extend
* share-revoke
* store-create
* token-extend
* token-mint
* user-create
* user-delete
* user-edit
* user-read
* vault-proxy

ACL Policies

[{ConfigAccessor type='policies'}] renders as:

Access Policies

Sorted by priority (highest first)

Name	Priority	Effect	Subjects	Resources	Actions
Administrator Full Access Full system access for administrators - all page and admin permissions	100	allow	admin	`*`	`page-readpage-editpage-createpage-deletepage-renamepage-exportasset-readmedia-readasset-uploadasset-deleteshare-createshare-extendshare-revoketoken-minttoken-extendasset-editsearch-pagesearch-useruser-readuser-edituser-createuser-deleteadmin-rolesadmin-readadmin-systempage-raw-editsession-revokeaudit-exportconfig-managesecret-revealprofile-manageaccount-securitycomment-createstore-createproxy-grantvault-proxy`
Administrators and demo administrators find and view identity records List, search and view identity records and organizations (#1930). Changing them is identity-manage, admins only. An add-on that needs them grants identity-read to its own roles in its own policy. The id keeps its name from before #2038, so an operator's override of it still merges	100	allow	admin, demo-admin	`*`	`identity-read`
Administrators change identity records Admins create, edit, delete and link identity records and organizations (#1930). An add-on that needs to change them grants identity-manage to its own roles in its own policy. The id keeps its name from before #2038, so an operator's override of it still merges	100	allow	admin	`*`	`identity-manage`
User Administrator Permissions Can manage users — create, edit, deactivate, delete	95	allow	user-admin	`*`	`user-readuser-edituser-createuser-deletesearch-userpage-readtoken-mintprofile-manageaccount-securitycomment-createstore-createproxy-grantvault-proxy`
Demo Administrator (read-only) Demo visitors may view admin screens and edit pages, but change nothing administrative	90	allow	demo-admin	`*`	`page-readpage-editpage-createpage-exportasset-readmedia-readasset-uploadsearch-pageadmin-readprofile-manageaccount-securitycomment-createsearch-userstore-create`
Editor Permissions Can create, edit, delete, and rename pages plus manage assets	80	allow	editor	`*`	`page-readpage-editpage-createpage-deletepage-renamepage-exportasset-readmedia-readasset-uploadasset-deleteshare-createshare-extendshare-revoketoken-mintsearch-pageprofile-manageaccount-securitycomment-createsearch-userstore-createproxy-grantvault-proxy`
Contributor Permissions Can create and edit pages, upload assets (no delete/rename)	70	allow	contributor	`*`	`page-readpage-editpage-createpage-exportasset-readmedia-readasset-uploadsearch-pagetoken-mintprofile-manageaccount-securitycomment-createsearch-userstore-createproxy-grantvault-proxy`
Vault Owner Permissions Everything inside the subject's own vaults — pages and files. The private-container check admits only the owner, so `vault: *` means their own vaults (#1539)	65	allow	vault-owner	`*`	`page-readpage-createpage-editpage-renamepage-deletepage-exportasset-readmedia-readasset-uploadasset-editasset-deleteshare-createshare-extendshare-revoke`
Reader Permissions Read-only access - can view pages and assets, search, and export	60	allow	reader	`*`	`page-readpage-exportasset-readmedia-readsearch-pagetoken-mintprofile-manageaccount-securitycomment-createsearch-userstore-createproxy-grantvault-proxy`
Signed-in Self-Service Every account manages its own profile and sign-in methods (#448). Granted to vault-owner, the role every account is given (ngdpbase.user.account-roles), so a session whose site role has stepped down for its required-aal can still reach its profile to enrol a passkey. profile-manage, account-security (#1525), and search-user: every user may search for other users (operator, 2026-10-24, #2018), so the people pickers work for every account. Nothing else.	60	allow	vault-owner	`*`	`profile-manageaccount-securitysearch-user`
Make pages public Move one's own general and capture pages out of their vault (#1504): the roles that can have private pages today. The journal add-on grants the same for journal pages in its own policy, journal-page-public (#1507)	60	allow	reader, contributor, editor, user-admin, admin, demo-admin	`general` `capture`	`page-public`
Anonymous Read Access Anonymous users can read pages and attachments, and search pages	50	allow	anonymous	`*`	`page-readasset-readsearch-page`

Total Policies: 12

Authentication Methods

[{ConfigAccessor type='authMethods'}] renders as:

agent-tokenDisabled

`default-ttl-hours`	24
`directory`	./data/tokens
`max-per-user`	10
`max-ttl-hours`	24
`retention-days`	1
`sweep-interval-seconds`	60

authentik-bearerEnabled

`audience`	kvBwSzZ2P2X0UqGXfrQ8JxBKKn3uOSDcRQaI2QBE
`default-role`	occupant
`group-map`	{}
`issuer`	https://auth.nerdsbythehour.com/application/o/ngdpbase/
`jwks-url`	https://auth.nerdsbythehour.com/application/o/ngdpbase/jwks/

cloudflare-accessDisabled

`application-aud`	—
`default-role`	reader
`group-map`	{}
`team-domain`	—

credentialsDisabled

file ${FAST_STORAGE}/users/credentials.json

email-changeDisabled

`cooldown-seconds`	60
`max-per-window`	5
`ttl-minutes`	60
`window-minutes`	60

google-oidcDisabled

`auto-provision`	true
`callback-url`	—
`client-id`	—
`client-secret`	—
`default-roles`	["reader"]
`deny-redirect`	/login?error=Access+denied
`hd`	—

invitationDisabled

ttl-days 7

magic-linkDisabled

`auto-provision`	false
`bind-to-requesting-device`	false
`registration.default-role`	reader
`ttl-minutes`	15

oidcDisabled

`auto-provision`	false
`providers`	{}

passkeyEnabled

passwordEnabled

proxy-accessDisabled

throttleEnabled

`lock-minutes`	1
`max-attempts`	10
`max-lock-minutes`	15
`window-minutes`	15

userDisabled

default-external false

General

factors [{"authproviderid":"passkey","primary":true,"amr":["swk","user"],"aal":2,"acr":"phr","enabled":true},{"authproviderid":"password","primary":true,"amr":["pwd"],"aal":1,"enabled":true},{"authproviderid":"magic-link","primary":true,"amr":["email"],"aal":1,"enabled":true},{"authproviderid":"oidc:google","primary":true,"amr":["trust"],"enabled":true},{"authproviderid":"cloudflare-access","primary":true,"amr":["trust"],"enabled":true}]

step-up {"max-age-minutes":60}

Features

[{ConfigAccessor type='features'}] renders as:

Features

export

`html`	true
`odt`	false
`pdf`	false

imagesEnabled

`default-alt`	Uploaded image
`default-class`	wiki-image

llmDisabled

`endpoint`	http://localhost:11434
`model`	llama2

maintenanceDisabled

`allow-admins`	true
`estimated-duration`
`message`	System is currently under maintenance. Please try again later.

Current User Summary

[{ConfigAccessor type='user-summary'}] renders as:

Current User Summary

Your roles and permissions

Login Status

Not Authenticated We recognize you but you are not currently authenticated. Login to access all features.

User Information

Username:	`Anonymous`
Display Name:	Anonymous User

Your Roles

Anonymous System
Public access without authentication

Your Permissions

Permission	Granted By Role(s)
`asset-read` View assets (attachments)	Anonymous
`page-read` View pages	Anonymous
`search-page` Search pages	Anonymous

Total Roles: 1 | Total Permissions: 3

User Keywords

[{ConfigAccessor type='userKeywords'}] renders as:

User Keywords

User-defined keywords for content tagging and organization

Label	Description	Category	Enabled	Restrict Editing	Allowed Roles
`default`	Default keyword with no special restrictions	general	Yes	No	-

Total Keywords: 1 | By Category: general: 1

[{ConfigAccessor type='userKeywords' enabled='true' valueonly='true' before='* ' after='\n'}] renders as:

* default

System Keywords

[{ConfigAccessor type='systemKeywords'}] renders as:

System Keywords

System-defined keywords for controlled vocabulary

Label	Description	Category	Enabled	Default	Schema.org
`anthropology`	Human culture and society content	subject	Yes	No	-
`capture`	Machine provenance: page created by the capture bookmarklet (#881/#893)	provenance	Yes	No	-
`economics`	Economic and financial content	subject	Yes	No	-
`general`	General-purpose keyword for standard wiki content	content-type	Yes	Yes	-
`geology`	Geological and earth science content	subject	Yes	No	-
`medicine`	Medical and healthcare-related content	subject	Yes	No	-
`meteorology`	Weather and atmospheric science content	subject	Yes	No	-
`oceanography`	Ocean and marine science content	subject	Yes	No	-
`political-science`	Political science and governance content	subject	Yes	No	-
`psychology`	Psychological and behavioral science content	subject	Yes	No	-
`sociology`	Social science and society-related content	subject	Yes	No	-
`test-artifact`	Provenance: created by an automated test, probe or script run — not content, safe to delete. Stamped by the system, never typed by users	provenance	Yes	No	-
`test-page`	Purpose: a test page — one content shape the unit tests render through the real pipeline; admin-only via audience (#1355)	provenance	Yes	No	-

Total Keywords: 13 | By Category: subject: 9, provenance: 3, content-type: 1

System Categories

[{ConfigAccessor type='systemCategories'}] renders as:

System Categories

System categories that determine page storage location

Label	Description	Source	Enabled	Default
`addon`	Documentation about an installed add-on, seeded by it	required-pages	Yes	No
`capture`	Pages made by the capture bookmarklet	pages	No	No
`developer`	Developer documentation and technical notes, only in GitHub	docs	No	No
`documentation`	End-User documentation	required-pages	Yes	No
`general`	General User pages	pages	Yes	Yes
`journal`	Personal journal entries — schema.org BlogPosting at JSON-LD render time (#791)	pages	No	No
`system`	The minimal viable pages for a minimal site to start	required-pages	Yes	No
`user-profile`	User profile pages	pages	No	No

Total Categories: 8 | By Source: shipped: 3, site: 4, repo: 1

[{ConfigAccessor type='systemCategories' storageLocation='required'}] renders as:

System Categories

System categories that determine page storage location

Label	Description	Source	Enabled	Default
`addon`	Documentation about an installed add-on, seeded by it	required-pages	Yes	No
`capture`	Pages made by the capture bookmarklet	pages	No	No
`developer`	Developer documentation and technical notes, only in GitHub	docs	No	No
`documentation`	End-User documentation	required-pages	Yes	No
`general`	General User pages	pages	Yes	Yes
`journal`	Personal journal entries — schema.org BlogPosting at JSON-LD render time (#791)	pages	No	No
`system`	The minimal viable pages for a minimal site to start	required-pages	Yes	No
`user-profile`	User profile pages	pages	No	No

Total Categories: 8 | By Source: shipped: 3, site: 4, repo: 1

Manager config

[{ConfigAccessor type='manager' manager='PageManager'}] renders as:

PageManager Configuration

Property	Value
`enabled`	`true`

Feature config

[{ConfigAccessor type='feature' feature='search'}] renders as:

search Feature Configuration

Property	Value
`enabled`	`false`

Notes

type='authMethods' — sensitive fields (client secret, tokens) are masked for non-admin users.
Plugin name is case-insensitive: [{configaccessor}] and [{ConfigAccessor}] are equivalent.
caption only applies to single key lookups — ignored on wildcards and type invocations.
noheader applies to both single and wildcard key lookups.
pageSize only applies to wildcard key lookups — ignored on single keys and type invocations.
Pages that expose sensitive configuration should be restricted to admin or editor roles.