config_user.php options
Every constant in the config file and what flipping it does
RKHM reads most of its configuration from api/app/config_user.php — a plain PHP file of define() statements. The installer writes a handful of these automatically the first time you set up (database credentials, licence details, your web address) and you should never need to touch them again after that. Two related files hold real secrets and are not covered here: config_license.php, and the database credentials inside this same file — never share their values with anyone, including support.
How this file and the Admin panel interact
A specific set of settings can also be changed from Admin → Settings screens. When you save one of those screens, RKHM rewrites that exact constant's line in config_user.php on disk — the file on disk and what the Admin panel shows are always kept in sync for these. Never hand-edit one of the constants listed in the table below — your manual edit will survive only until the next time that Admin screen is saved, which silently overwrites it with whatever the screen currently shows. Everything in the second table has no Admin control at all, so editing the file directly is the only way to change it.
Admin-controlled constants
Change these from their Admin screen, not by hand.
| Constant | What it does | Change it via |
| session_ip_lock / session_pf_lock | Lock a logged-in session to the IP address / user-agent it started with | Setting → User → Session |
| session_max | Maximum concurrent sessions per regular user | Setting → User → Session |
| session_life | Session lifetime in hours; unset or 0 means sessions don't expire on their own | Setting → User → Session |
| session_cc | How likely (1–100, as a percentage) a request is to run the extra session checks, such as the concurrent-session limit | Setting → User → Session |
| admin_ip_lock / admin_ua_lock / admin_nu_lock / admin_ti_lock | The same session locks as above, applied to Admin panel logins; admin_nu_lock is the concurrent-admin-session cap | Setting → User → Session (Admin Session group) |
| ip_geo + ip_geo_source / ip_geo_*_key | Look up a visitor's country from their IP, used for things like automatic interface-language selection | Setting → General → IP Geolocation |
| client_private | Require login to view any client-facing page | Setting → General → General (Private App) |
| search_engine | "php" (built-in database search) or "meilisearch" | Setting → General → Search |
| accept_animated_gif | Allow animated GIF uploads | Setting → Files → Upload Setting → Image → Animated GIFs |
| disable_comments / comments_max_depth / comments_can_delete_after_hr / comments_objects | Turns comments off entirely, caps reply thread depth, sets how long a user may delete their own comment, and which content types allow comments | Setting → User → Comments |
| fw_active / fw_enforce | Turns the built-in request firewall on, and whether it blocks (enforce) or only logs suspicious requests | Setting → Firewall → Setting |
| client_give_attribute / client_auto_images | Show a credit or disclaimer for media hosted on third-party services, and use third-party images when an item has no image of its own | Setting → General → General (Credit Sources, Third-party images) |
| awf_enabled | Turns on audio waveforms (see Audiowaveform) | Setting → General → External Tools → Audio Waveform |
| date_default_timezone_set(…) / api_send_diagnostics | The timezone RKHM uses, and what is shared with Busyowl (none = Necessary, basic, advanced) (editable from the admin since v2.1.04) | Setting → General → License |
Manual-only constants
No Admin screen touches these — edit config_user.php directly, then re-check the page (no restart needed for a plain PHP web request).
| Constant | What it does |
| web_address, db_host, db_user, db_pass, db_name | Installer-written identity and database connection. Changing db_* by hand without also moving the actual database will break the install — only edit these if you know exactly what you're doing (e.g. moving to a new DB server). |
| production | false (development mode) on a fresh install: most caching is off, unminified CSS/JS is used and more errors are logged. Set it to true before you launch |
| session_live | true: a signed-in user's roles and account data are re-read on every request, so role changes apply instantly. false: they are refreshed on about one request in 26, which saves database work on a busy site |
| cf_cache / nginx | Compatibility switches for sites running behind Cloudflare's proxy or an Nginx front-end instead of Apache — see the Cloudflare and Nginx articles |
| debug_report | Whether API error responses include extra debug detail in the response body — turn this off on a live site |
| player_playlist_range | How many items load into a playlist queue up front before infinite-scroll pagination takes over. There is no guaranteed built-in default if this is left unset, so set it explicitly rather than relying on a default. |
| assign_language_based_on_ip_location | Whether a new visitor's interface language is auto-picked from their geo-located country (requires ip_geo above to be on) |
| bof_cache_entire_page / bof_cache_range | An opt-in whole-page cache mode (instead of the default per-widget caching), with a cache duration in minutes. Neither product enables this by default. |
| client_constructing | Shows an "under construction" state to visitors |
| theme | The fallback desktop theme folder. The theme you activate under Setting → Themes is stored in the database (separate Desktop Theme and Mobile Theme & PWA slots (since v2.1.04)); this constant is only used when no desktop theme has been activated there. The Demo Importer checks this value. |
Defaults on a fresh install
Both products start from the same defaults (as of v2.1.04): production false (development mode), session_live true, the firewall off (fw_active and fw_enforce false), comments off (disable_comments 1), no session limits (session_max and session_life false), and the built-in php search engine. Review them before you launch.
RKHM-specific options
RKHM also recognises a set of constants specific to the Music plugin (bof_music). They do nothing on an install that doesn't have Music enabled:
| Constant | What it does |
| allow_music_tracks_dups | Allow the same artist/album/track name combination to be uploaded more than once |
| id3_write_cover | Write cover art into an uploaded MP3's own ID3 tag |
| music_hide_single_albums | Hide single-track "albums" from album listings |
| disable_music_genre_hiearchy | Turn off the parent/child genre hierarchy |
| spotify_playlist_user_id | The Spotify user ID whose public playlists the Spotify import automation reads from |
| music_artist_top_tracks_awf, music_artist_top_tracks_more | Waveform slider and "show more" behaviour on an artist's Top Tracks widget |
awf_enabled (Audio Waveform, in the admin-controlled table above) is what turns on the waveform slider used by Top Tracks and Beat producer widgets.