Advanced Docker configuration for Devolutions Server

This article covers advanced configuration options for Devolutions Server's Docker deployment, including complete environment variable reference, certificate management, performance tuning, and security hardening.

Variable	Required	Default	Description
`DATABASE_HOST`	Yes	—	SQL Server hostname. For non-standard ports, use `host,port` format (e.g., `sql.example.com,1433`).
`AZURE_SQL_HOST`	Yes*	—	Alias for `DATABASE_HOST` (Azure-specific naming).
`DATABASE_NAME`	Yes	—	Devolutions Server database name.
`AZURE_SQL_DATABASE`	Yes*	—	Alias for `DATABASE_NAME`.
`DATABASE_USERNAME`	Yes	—	SQL authentication username (use least-privilege account with db_owner on Devolutions Server database).
`AZURE_SQL_USERNAME`	Yes*	—	Alias for `DATABASE_USERNAME`.
`DATABASE_PASSWORD`	Yes	—	SQL authentication password (treat as secret, use Docker secrets or Azure Key Vault).
`AZURE_SQL_PASSWORD`	Yes*	—	Alias for `DATABASE_PASSWORD`.
`DATABASE_PORT`	No	`1433`	SQL Server port (appended to host if not already specified in `DATABASE_HOST`).
`AZURE_SQL_PORT`	No	`1433`	Alias for `DATABASE_PORT`.

Variables marked with * are aliases. Use either the standard or Azure-specific naming, not both.

Variable	Required	Default	Description
`HOSTNAME`	No	`localhost`	Server hostname (overridden by `WEBSITE_HOSTNAME` on Azure).
`WEB_SCHEME`	No	`http`	Protocol: `http` or `https`. Set to `https` to enable TLS.
`WEB_PORT` / `PORT`	No	`5000`	Port the container listens on.
`EXTERNAL_WEB_SCHEME`	No	Mirrors `WEB_SCHEME`	External protocol when behind reverse proxy (e.g., `https` when proxy handles TLS).
`EXTERNAL_WEB_PORT`	No	Mirrors `WEB_PORT`	External port when behind reverse proxy (e.g., `443` for standard HTTPS).

Variable	Required	Default	Description
`TLS_CERTIFICATE_FILE`	No*	—	Path to mounted PEM certificate file (e.g., `/opt/devolutions/dvls/certs/server.pem`)
`TLS_PRIVATE_KEY_FILE`	No*	—	Path to mounted PEM private key file (e.g., `/opt/devolutions/dvls/certs/server.key`)
`TLS_CERTIFICATE_B64`	No*	—	Base64-encoded certificate content (written to `App_Data/server.pem`)
`TLS_PRIVATE_KEY_B64`	No*	—	Base64-encoded private key content (written to `App_Data/server.key`)

If WEB_SCHEME=https and no certificate is provided, a self-signed certificate is auto-generated (valid ~5 years, 2048-bit RSA). Use file mounts or base64 variables for production certificates.

DVLS_INIT and DVLS_UPDATE_MODE are mutually exclusive. Setting both to true will cause an error.

Variable	Required	Default	Description
`DVLS_INIT`	No	`false`	Set to `true` to run initialization mode (creates schema, admin user, then exits).
`DVLS_UPDATE_MODE`	No	`false`	Set to `true` to run update mode (backs up, migrates database, then exits).
`DVLS_BACKUP_PATH`	No	`/tmp/dvls-backup`	Backup location during updates (mount volume to persist backups).

These variables are only used during initialization (DVLS_INIT=true):

Variable	Required	Default	Description
`DVLS_ADMIN_USERNAME`	No	`dvls-admin`	Admin account username created during initialization.
`DVLS_ADMIN_PASSWORD`	No	`dvls-admin`	Admin account password. MUST be changed in production!
`DVLS_ADMIN_EMAIL`	No	`admin@<HOSTNAME>`	Admin account email address

Variable	Required	Default	Description
`DVLS_PATH`	No	`/opt/devolutions/dvls`	Installation root path (appsettings and App_Data location).
`DVLS_EXECUTABLE_PATH`	No	`/opt/devolutions/dvls/Devolutions.Server`	Devolutions Server executable path in runtime mode.
`DVLS_TELEMETRY`	No	`true`	Enable/disable telemetry collection.
`DVLS_ENCRYPTION_CONFIG_B64`	No	—	Base64-encoded encryption configuration (required for consistent encryption across scaled instances).

Variable	Required	Default	Description
`SSH_ENABLED`	No	`false`	Enable SSH daemon for debugging (auto-enabled on Azure unless explicitly disabled),
`SSH_PORT`	No	`2222`	SSH listen port (publish with `-p 2222:2222`),
`SSH_PASSWORD`	Yes*	`Docker!`	Root password for SSH (REQUIRED if `SSH_ENABLED=true`, MUST be changed in production!

If SSH_ENABLED=true without SSH_PASSWORD, the container will refuse to start for security reasons.

These variables are automatically set by Azure App Service:

Variable	Set By	Description
`WEBSITE_HOSTNAME`	Azure	Overrides `HOSTNAME` (e.g., `dvls-prod.azurewebsites.net`)
`WEBSITE_INSTANCE_ID`	Azure	Presence forces `EXTERNAL_WEB_SCHEME=https` and `EXTERNAL_WEB_PORT=443`, auto-enables SSH

When WEB_SCHEME=https without certificate variables, Devolutions Server generates a self-signed certificate (valid ~5 years, 2048-bit RSA, CN=hostname):

docker run -d --name dvls-server `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e HOSTNAME=localhost `
  -e WEB_SCHEME=https `
  -e PORT=5000 `
  -p 5000:5000 `
  devolutions/devolutions-server:release-2025.3

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=localhost \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -p 5000:5000 \
  devolutions/devolutions-server:release-2025.3

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=localhost \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -p 5000:5000 \
  devolutions/devolutions-server:release-2025.3

For development and testing only. Browsers will show security warnings.

Mount certificate files from the host:

mkdir -p /host/certs
cp /path/to/server.pem /host/certs/
cp /path/to/server.key /host/certs/
chmod 600 /host/certs/server.key

docker run -d --name dvls-server `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e HOSTNAME=dvls.company.com `
  -e WEB_SCHEME=https `
  -e PORT=5000 `
  -e TLS_CERTIFICATE_FILE=/opt/devolutions/dvls/certs/server.pem `
  -e TLS_PRIVATE_KEY_FILE=/opt/devolutions/dvls/certs/server.key `
  -p 5000:5000 `
  -v /host/certs:/opt/devolutions/dvls/certs:ro `
  devolutions/devolutions-server:release-20XX.X

mkdir -p /host/certs
cp /path/to/server.pem /host/certs/
cp /path/to/server.key /host/certs/
chmod 600 /host/certs/server.key

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=dvls.company.com \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e TLS_CERTIFICATE_FILE=/opt/devolutions/dvls/certs/server.pem \
  -e TLS_PRIVATE_KEY_FILE=/opt/devolutions/dvls/certs/server.key \
  -p 5000:5000 \
  -v /host/certs:/opt/devolutions/dvls/certs:ro \
  devolutions/devolutions-server:release-20XX.X

mkdir -p /host/certs
cp /path/to/server.pem /host/certs/
cp /path/to/server.key /host/certs/
chmod 600 /host/certs/server.key

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=dvls.company.com \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e TLS_CERTIFICATE_FILE=/opt/devolutions/dvls/certs/server.pem \
  -e TLS_PRIVATE_KEY_FILE=/opt/devolutions/dvls/certs/server.key \
  -p 5000:5000 \
  -v /host/certs:/opt/devolutions/dvls/certs:ro \
  devolutions/devolutions-server:release-20XX.X

Certificate format requirements:

Certificate: PEM format (.pem, .crt)
Private key: PEM format (.key, .pem)
Chain: Include intermediate certificates in the certificate file

Example certificate file with chain:

Use base64-encoded certificates when working with secrets management systems (Azure Key Vault, Kubernetes Secrets):

cat server.pem | base64 > server.pem.b64
cat server.key | base64 > server.key.b64

docker run -d --name dvls-server `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e HOSTNAME=dvls.company.com `
  -e WEB_SCHEME=https `
  -e PORT=5000 `
  -e TLS_CERTIFICATE_B64="$(cat server.pem.b64)" `
  -e TLS_PRIVATE_KEY_B64="$(cat server.key.b64)" `
  -p 5000:5000 `
  devolutions/devolutions-server:release-20XX.X

cat server.pem | base64 > server.pem.b64
cat server.key | base64 > server.key.b64

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=dvls.company.com \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e TLS_CERTIFICATE_B64="$(cat server.pem.b64)" \
  -e TLS_PRIVATE_KEY_B64="$(cat server.key.b64)" \
  -p 5000:5000 \
  devolutions/devolutions-server:release-20XX.X

cat server.pem | base64 > server.pem.b64
cat server.key | base64 > server.key.b64

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=dvls.company.com \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e TLS_CERTIFICATE_B64="$(cat server.pem.b64)" \
  -e TLS_PRIVATE_KEY_B64="$(cat server.key.b64)" \
  -p 5000:5000 \
  devolutions/devolutions-server:release-20XX.X

Certificate and private key are written to /opt/devolutions/dvls/App_Data/ and referenced in Devolutions Server configuration.

Devolutions Server constructs the SQL Server connection string from environment variables:

Server=<DATABASE_HOST>,<DATABASE_PORT>;Database=<DATABASE_NAME>;User Id=<DATABASE_USERNAME>;Password=<DATABASE_PASSWORD>;Encrypt=True;TrustServerCertificate=True;

-e DATABASE_HOST=sql.example.com `
-e DATABASE_PORT=1433

-e DATABASE_HOST=sql.example.com \
-e DATABASE_PORT=1433

-e DATABASE_HOST=sql.example.com \
-e DATABASE_PORT=1433

Or omit DATABASE_PORT (defaults to 1433):

-e DATABASE_HOST=sql.example.com

-e DATABASE_HOST=sql.example.com

-e DATABASE_HOST=sql.example.com

Option 1: Include port in hostname:

-e DATABASE_HOST=sql.example.com,1435

-e DATABASE_HOST=sql.example.com,1435

-e DATABASE_HOST=sql.example.com,1435

Option 2: Separate port variable:

-e DATABASE_HOST=sql.example.com `
-e DATABASE_PORT=1435

-e DATABASE_HOST=sql.example.com \
-e DATABASE_PORT=1435

-e DATABASE_HOST=sql.example.com \
-e DATABASE_PORT=1435

-e AZURE_SQL_HOST=dvls-sql-server.database.windows.net `
-e AZURE_SQL_DATABASE=dvls `
-e AZURE_SQL_USERNAME=dvls_user@dvls-sql-server `
-e AZURE_SQL_PASSWORD='YourPassword!'

-e AZURE_SQL_HOST=dvls-sql-server.database.windows.net \
-e AZURE_SQL_DATABASE=dvls \
-e AZURE_SQL_USERNAME=dvls_user@dvls-sql-server \
-e AZURE_SQL_PASSWORD='YourPassword!'

-e AZURE_SQL_HOST=dvls-sql-server.database.windows.net \
-e AZURE_SQL_DATABASE=dvls \
-e AZURE_SQL_USERNAME=dvls_user@dvls-sql-server \
-e AZURE_SQL_PASSWORD='YourPassword!'

Devolutions Server Docker containers only support SQL Server Authentication (username/password). Windows Authentication (Integrated Security) is not supported in Linux containers.

When Devolutions Server runs behind a reverse proxy, nginx ingress, or Azure App Service, configure external URL settings:

docker run -d --name dvls-server `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e HOSTNAME=dvls.company.com `
  -e WEB_SCHEME=http `
  -e PORT=5000 `
  -e EXTERNAL_WEB_SCHEME=https `
  -e EXTERNAL_WEB_PORT=443 `
  devolutions/devolutions-server:release-20XX.X

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=dvls.company.com \
  -e WEB_SCHEME=http \
  -e PORT=5000 \
  -e EXTERNAL_WEB_SCHEME=https \
  -e EXTERNAL_WEB_PORT=443 \
  devolutions/devolutions-server:release-20XX.X

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=dvls.company.com \
  -e WEB_SCHEME=http \
  -e PORT=5000 \
  -e EXTERNAL_WEB_SCHEME=https \
  -e EXTERNAL_WEB_PORT=443 \
  devolutions/devolutions-server:release-20XX.X

Key settings:

WEB_SCHEME=http - Container uses HTTP
EXTERNAL_WEB_SCHEME=https - Public URL is HTTPS
EXTERNAL_WEB_PORT=443 - Standard HTTPS port (omitted in URLs)
HOSTNAME=dvls.company.com - Public hostname

Devolutions Server generates URLs like https://dvls.company.com/ in the UI and API responses.

Do NOT hardcode passwords in docker run commands or compose files.

echo "YourPassword!" | docker secret create dvls_db_password -

docker service create `
  --name dvls-server `
  --secret dvls_db_password `
  -e DATABASE_PASSWORD_FILE=/run/secrets/dvls_db_password `
  ...

echo "YourPassword!" | docker secret create dvls_db_password -

docker service create \
  --name dvls-server \
  --secret dvls_db_password \
  -e DATABASE_PASSWORD_FILE=/run/secrets/dvls_db_password \
  ...

echo "YourPassword!" | docker secret create dvls_db_password -

docker service create \
  --name dvls-server \
  --secret dvls_db_password \
  -e DATABASE_PASSWORD_FILE=/run/secrets/dvls_db_password \
  ...

# .env file (keep out of version control)
DATABASE_PASSWORD=YourPassword!
DVLS_ADMIN_PASSWORD=AdminPassword!

docker run -d --name dvls-server `
  --env-file .env `
  -e DATABASE_HOST=your-sql-server `
  ...

# .env file (keep out of version control)
DATABASE_PASSWORD=YourPassword!
DVLS_ADMIN_PASSWORD=AdminPassword!

docker run -d --name dvls-server \
  --env-file .env \
  -e DATABASE_HOST=your-sql-server \
  ...

# .env file (keep out of version control)
DATABASE_PASSWORD=YourPassword!
DVLS_ADMIN_PASSWORD=AdminPassword!

docker run -d --name dvls-server \
  --env-file .env \
  -e DATABASE_HOST=your-sql-server \
  ...

Use Managed Identity to retrieve secrets from Key Vault at runtime. See Devolutions Server deployment to Azure App Service using a container for more details.

Use Docker networks to isolate Devolutions Server:

docker network create dvls-network

docker run -d --name dvls-server `
  --network dvls-network `
  -p 127.0.0.1:5000:5000 `
  -e DATABASE_HOST=sql-server `
  ...

docker network create dvls-network

docker run -d --name dvls-server \
  --network dvls-network \
  -p 127.0.0.1:5000:5000 \
  -e DATABASE_HOST=sql-server \
  ...

docker network create dvls-network

docker run -d --name dvls-server \
  --network dvls-network \
  -p 127.0.0.1:5000:5000 \
  -e DATABASE_HOST=sql-server \
  ...

Disable SSH in production unless required for debugging:

-e SSH_ENABLED=false

-e SSH_ENABLED=false

-e SSH_ENABLED=false

If SSH is enabled:

Use strong passwords.
Change default password.
Restrict access with firewall rules.
Consider SSH key authentication (requires custom image).

Images are tagged by release version (e.g., release-2025.3, release-2026.1) and by specific build (e.g., 2025.3.1.0, 2025.3.2.0).
No latest tag exists - always specify a version.
Minor/patch updates within the same release version are automatically included when pulling the release tag.
Database update mode is only required when changing major versions (e.g., release-2025.3 → release-2026.1).

Version 2026.1 is used for illustration; replace with the actual latest major version when updating.

docker pull devolutions/devolutions-server:release-2026.1
docker stop dvls-server

# Run update mode to migrate database
docker run --rm `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e DVLS_UPDATE_MODE=true `
  -e DVLS_BACKUP_PATH=/backup `
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" `
  -v dvls-backups:/backup `
  devolutions/devolutions-server:release-2026.1

docker rm dvls-server
docker run -d --name dvls-server `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e HOSTNAME=localhost `
  -e WEB_SCHEME=https `
  -e PORT=5000 `
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" `
  -p 5000:5000 `
  devolutions/devolutions-server:release-2026.1

docker pull devolutions/devolutions-server:release-2026.1
docker stop dvls-server

# Run update mode to migrate database
docker run --rm \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e DVLS_UPDATE_MODE=true \
  -e DVLS_BACKUP_PATH=/backup \
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" \
  -v dvls-backups:/backup \
  devolutions/devolutions-server:release-2026.1

docker rm dvls-server
docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=localhost \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" \
  -p 5000:5000 \
  devolutions/devolutions-server:release-2026.1

docker pull devolutions/devolutions-server:release-2026.1
docker stop dvls-server

# Run update mode to migrate database
docker run --rm \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e DVLS_UPDATE_MODE=true \
  -e DVLS_BACKUP_PATH=/backup \
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" \
  -v dvls-backups:/backup \
  devolutions/devolutions-server:release-2026.1

docker rm dvls-server
docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=localhost \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" \
  -p 5000:5000 \
  devolutions/devolutions-server:release-2026.1

docker pull devolutions/devolutions-server:release-2025.3
docker stop dvls-server
docker rm dvls-server

docker run -d --name dvls-server `
  -e DATABASE_HOST=your-sql-server `
  -e DATABASE_NAME=dvls `
  -e DATABASE_USERNAME=dvls_user `
  -e DATABASE_PASSWORD='YourPassword!' `
  -e HOSTNAME=localhost `
  -e WEB_SCHEME=https `
  -e PORT=5000 `
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" `
  -p 5000:5000 `
  devolutions/devolutions-server:release-2025.3

docker pull devolutions/devolutions-server:release-2025.3
docker stop dvls-server
docker rm dvls-server

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=localhost \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" \
  -p 5000:5000 \
  devolutions/devolutions-server:release-2025.3

docker pull devolutions/devolutions-server:release-2025.3
docker stop dvls-server
docker rm dvls-server

docker run -d --name dvls-server \
  -e DATABASE_HOST=your-sql-server \
  -e DATABASE_NAME=dvls \
  -e DATABASE_USERNAME=dvls_user \
  -e DATABASE_PASSWORD='YourPassword!' \
  -e HOSTNAME=localhost \
  -e WEB_SCHEME=https \
  -e PORT=5000 \
  -e DVLS_ENCRYPTION_CONFIG_B64="$(cat /tmp/encryption.config.b64)" \
  -p 5000:5000 \
  devolutions/devolutions-server:release-2025.3

Consult Devolutions Server security hardening for:

Administration accounts settings
Password policies
Multifactor authentication
IP restrictions
Audit logging
Encryption settings

Advanced Docker configuration for Devolutions Server

Environment variables reference

Database connection variables

Web server configuration

TLS certificate configuration

Operating mode configuration

Initialization mode variables

System configuration

SSH Access Configuration

Azure Web App variables

TLS certificate configuration

Auto-generated self-signed certificate

Certificate files via volume mount

Base64-encoded certificates

Database Configuration

Connection string format

Standard port (1433)

Non-standard port

Azure SQL database

SQL Server Authentication vs Windows Authentication

Reverse proxy configuration

Security hardening

Secrets management

Docker Secrets (Swarm mode)

Environment files

Azure Key Vault

Network isolation

SSH access

Version updates

Version tagging

Major version update

Minor/patch update (e.g., 2025.3.1 to 2025.3.2)

Security checklist

See also