DocView Capture has two kinds of settings:
- Start-up settings that each program needs before it can reach the database: the connection string, storage, the key ring certificate and so on. They are described on this page.
- Administrator settings that are changed while the system runs, such as retention periods and session rules. They are stored in the database and edited in the app. See Settings.
Where start-up settings live
| Hosting | Where |
|---|---|
| IIS and Windows service | appsettings.Production.json next to each program. The install scripts write it for you. |
| Azure App Service | Configuration › Application settings of each app. Write __ (two underscores) in place of :, for example Storage__Provider. |
| Docker | Environment variables, also with __, for example ConnectionStrings__DocViewCapture. |
| Development | appsettings.json, appsettings.Development.json and user secrets. |
Example appsettings.Production.json for a web app:
{
"ConnectionStrings": {
"DocViewCapture": "Server=SQL01;Database=DocViewCapture;Integrated Security=True;Encrypt=True;TrustServerCertificate=True"
},
"Storage": {
"Provider": "FileSystem",
"RootPath": "\\\\fileserver\\DocViewCapture\\Storage"
},
"DataProtection": { "CertificateThumbprint": "<thumbprint>" },
"Authentication": { "Windows": { "Enabled": true } },
"ReverseProxy": { "Enabled": false }
}
After you change a file, restart the site or service.
Settings table
The Web and DocView Worker columns show which program reads the setting.
| Setting | Web | DocView Worker | Default | Purpose |
|---|---|---|---|---|
ConnectionStrings:DocViewCapture |
✔ | ✔ | set by the setup wizard | The database. Windows (Integrated Security) or SQL authentication. The wizard keeps it protected on the server; a value here or in an environment variable wins. |
ConnectionStrings:DocViewEffort |
✔ | ✔ | — | Optional: a separate SQL Server database for the effort records. Empty keeps them in the main database. Set it the same on the web app and every DocView Worker. |
Database:InitializeOnStartup |
✔ | ✔ | true |
Create and upgrade the database schema at start-up. |
Database:Schema |
✔ | ✔ | dbo |
The SQL Server schema of all DocView's tables, for example docview, to share an existing database with other applications. It is created if needed. Choose it before the first start: DocView doesn't move existing tables. |
Storage:Provider |
✔ | ✔ | FileSystem |
FileSystem, AzureBlob, S3 or GoogleCloudStorage. |
Storage:RootPath |
✔ | ✔ | %ProgramData%\DocViewCapture\Storage |
Page images and outputs. Use a share when there are several servers. |
Storage:WorkPath |
✔ | ✔ | %ProgramData%\DocViewCapture\Work |
Local temporary files. |
Storage:AzureBlob:ConnectionString / ContainerUri / ContainerName |
✔ | ✔ | — / — / docview |
Azure Blob Storage. |
Storage:AzureBlob:ServiceUri / ManagedIdentityClientId |
✔ | ✔ | — | Azure Blob Storage without a key: the account's blob address, signed in with the managed identity (client id of a user-assigned one). |
Storage:AzureBlob:Prefix |
✔ | ✔ | — | A folder inside the container for DocView's files, to share a container with other data. |
Storage:S3:BucketName / Region / Prefix |
✔ | ✔ | — | Amazon S3. Without keys, the AWS role of the server (ECS task role, EC2 instance profile) or the usual AWS environment variables are used. |
Storage:S3:AccessKeyId / SecretAccessKey / ServiceUrl |
✔ | ✔ | — | Optional access key; ServiceUrl only for S3-compatible services. |
Storage:GoogleCloudStorage:BucketName / Prefix / CredentialsJson |
✔ | ✔ | — | Google Cloud Storage. Without a key, the server's service account (application default credentials). |
Database:Password |
✔ | ✔ | — | Put into the connection string, so a secret store can hold the password alone (cloud templates). |
DataProtection:CertificateThumbprint |
✔ | ✔ | — | Certificate that protects the shared key ring (from the machine's certificate store). |
DataProtection:CertificatePath + CertificatePassword |
✔ | ✔ | — | The same, from a PFX file (for example in containers). |
DataProtection:CertificateBase64 + CertificatePassword |
✔ | ✔ | — | The same, from a setting holding the PFX as base64 (App Service, Key Vault reference). On Azure App Service without a certificate, the key ring relies on the database's protection. |
Authentication:Windows:Enabled |
✔ | false |
Offer Sign in with Windows. See Windows sign-in. | |
ReverseProxy:Enabled |
✔ | false |
Trust X-Forwarded-For and X-Forwarded-Proto from a load balancer, proxy or App Service. |
|
ReverseProxy:KnownNetworks / KnownProxies |
✔ | — | The proxies trusted, as address ranges (CIDR) or addresses, comma separated: set them behind Azure Front Door, Application Gateway or your own proxy so the real client address is used. Empty: the nearest hop (right for App Service alone). | |
Security:AllowedNetworks |
✔ | — | Addresses or ranges (CIDR), comma separated: the whole site answers only these (and the server itself); health checks always answer. Adds to System settings › Security › Only accept requests from. | |
Security:IgnoreAllowedNetworkSetting |
✔ | false |
true ignores the list in System settings, to get back in after a mistake. |
|
Bootstrap:AdminUser |
✔ | DocView |
Name of the first administrator. | |
Bootstrap:AdminPassword |
✔ | — | Password of the first administrator, for containers and scripted installs. Used only when the database has no users. Without it the setup wizard creates the administrator. | |
Bootstrap:GenerateAdminPassword |
✔ | false |
true: without AdminPassword, generate a password and write it once to the log (instead of the wizard). |
|
Setup:ConfigFolder |
✔ | ✔ | %ProgramData%\DocViewCapture\config |
Where the setup wizard keeps its settings (protected) and the setup token. |
Setup:Token |
✔ | generated | The setup token for opening the wizard from another computer (containers). | |
Setup:AdminEmail |
✔ | — | Filled in as the e-mail address on the wizard's administrator step. | |
Cloud:OmniReadUrls / Cloud:OmniReadKey |
✔ | — | DocView OmniRead services of a cloud or Docker deployment: the addresses are stored when none are set yet; the key replaces a different stored one. | |
Site:PublicUrl |
✔ | Setup › Site address | The address other computers use; downloaded DocView Workers connect to it. | |
Downloads:Folder |
✔ | %ProgramData%\DocViewCapture\Downloads |
DocView Worker packages for Administration › Downloads (the release's own are always offered). | |
Bootstrap:SeedSampleBatchClass |
✔ | true |
Create the Sample Invoices Batch Setup on first start. | |
Bootstrap:SeedBookingStarterData |
✔ | true |
On a new installation, add well-known UK, USA and European couriers (with their tracking pages) and a sample client, Sample Client Ltd (SAMPLE). Added once, only when there are no couriers or clients yet. |
|
ScanAgent:DownloadFolder |
✔ | %ProgramData%\DocViewCapture\ScanAgent |
Extra Scan Agent installers. Those in the package are always offered. | |
RateLimits:LoginPerMinute |
✔ | 30 | Sign-in attempts per minute per client address. | |
RateLimits:ApiPerMinute |
✔ | 600 | REST API requests per minute per client address. | |
RateLimits:ScanUploadsPerMinute |
✔ | 1200 | Scan Agent page uploads per minute per client address. | |
Export:CSharpScripts:Enabled |
✔ | true |
Allow C# export scripts. See C# export scripts. | |
ScheduledTasks:AllowedFolders |
✔ | (none) | Folders JavaScript scheduled tasks may use besides their work folder and the folders of folder export destinations. C# tasks are not limited. | |
Worker:Name |
✔ | computer name | The name used for the DocView Worker's profile. See DocView Workers. | |
Worker:ServerUrl + Worker:EnrolmentKey |
✔ | from the download | A DocView Worker from Administration › Downloads asks this server for its database and storage settings. | |
Worker:EnableImportPolling |
✔ | true |
false stops this DocView Worker polling import sources, whatever its profile says. |
|
Worker:ImportPollSeconds |
✔ | 10 | How often the DocView Worker looks for import sources that are due. | |
Worker:IdlePollSeconds |
✔ | 3 | How long an idle module waits before it checks its queue again. | |
Worker:Concurrency |
✔ | 1 per module | Batches at once per module, for example { "recognition": 2 }. Used only when the DocView Worker has no profile. |
|
Notifications:WebUrl |
✔ | http://localhost:5210 |
Web app address, for live progress on screen. | |
Kestrel:Endpoints:Health:Url |
✔ | http://localhost:5211 |
The DocView Worker's health endpoint. | |
Serilog:WriteTo:1:Args:path |
✔ | ✔ | logs/docview-web-.log, logs/docview-worker-.log |
Log file location. 14 daily files are kept. |
Important: Remove
Bootstrap:AdminPasswordafter the first start. It is only used to create the first administrator. The IIS install script removes it for you; on Azure, delete theBootstrap__AdminPasswordapplication setting.
Storage and several servers
Every web server and DocView Worker must see the same storage and database:
- on premises, set
Storage:RootPathto a file share that every application account can modify; - or use cloud storage:
Storage:Providerset toAzureBlob,S3orGoogleCloudStorage.
With more than one server, every server must also use the same key ring certificate (DataProtection:CertificateThumbprint, or CertificatePath and CertificatePassword). Without it, secrets encrypted on one server cannot be read on another. See Install on IIS and Install on Azure.
Database upgrades managed by DBAs
By default the programs upgrade the database schema themselves at start-up, which needs db_owner rights. If your DBAs apply schema changes themselves:
- Set
"Database": { "InitializeOnStartup": false }in both programs' settings. - Before each upgrade, run the release's
DocViewCapture-Database-<version>.sql. It is safe to run more than once. When DocView has its own schema (Database:Schema), use the script written for that schema (DocViewCapture-Database-<version>-<schema>.sql; ask for it, or build the release with-DatabaseSchemas <schema>). - The application accounts then only need
db_datareader,db_datawriterandEXECUTE.
Docker variables
docker-compose.yml reads these variables from a .env file:
| Variable | Purpose |
|---|---|
MSSQL_SA_PASSWORD |
Password of the SQL Server container's sa account. |
DOCVIEW_ADMIN_PASSWORD |
Password of the first administrator. |
DOCVIEW_WEB_PORT |
Port of the web app on the host (default 8080). |
DOCVIEW_STORAGE_PROVIDER |
FileSystem (default), AzureBlob, S3 or GoogleCloudStorage. |
DOCVIEW_S3_BUCKET, DOCVIEW_S3_REGION, DOCVIEW_S3_ACCESS_KEY_ID, DOCVIEW_S3_SECRET_ACCESS_KEY |
Amazon S3. |
DOCVIEW_GCS_BUCKET |
Google Cloud Storage. |
DOCVIEW_OMNIREAD_KEY, DOCVIEW_OMNIREAD_URLS |
DocView OmniRead with --profile omniread. |
DOCVIEW_AZURE_BLOB_CONNECTION_STRING |
Azure Blob Storage connection string. |
DOCVIEW_DATAPROTECTION_CERT / DOCVIEW_DATAPROTECTION_CERT_PASSWORD |
PFX file and password that protect the key ring. |
Note: Without a certificate, containers store the key ring keys unprotected and log a warning. Always set a certificate in production.
Health endpoints
Both programs answer, without sign-in:
| Path | Meaning |
|---|---|
/health/live |
The process is running. |
/health/ready |
The database and storage can also be reached. |
Use them for load balancer probes and monitoring. The DocView Worker answers on the address in Kestrel:Endpoints:Health:Url.