Server settings

Settings that the server's administrator sets outside MaxTrax, before the site starts. Settings a Corporate Administrator changes inside MaxTrax are on Site settings.

How MaxTrax reads them

Every setting has a name starting MAXTRAX_. The site reads it from an environment variable first, then from an appSettings entry in Web.config. A setting you do not set keeps its default.

• On your own server, set them as environment variables of the site's application pool (see below), then recycle the pool.
• On Azure App Service, application settings are environment variables. Set them on the app's Environment variables page, and the app restarts.
• Prefer environment variables to Web.config. Each release's Web.config replaces the site's own, so values kept there must be entered again at every upgrade.

Required

• MAXTRAX_MAIN_DB: the SQL Server connection string for the site's database. The site refuses to start without it. For example Server=sql01;Database=MaxTrax_Site1;User ID=maxtrax_site1;Password=…;Encrypt=True, or with Integrated Security=SSPI in place of the user ID and password.

Email (SMTP)

MaxTrax sends email for subscriptions, scheduled reports, NDE requests and account messages such as password resets. There is no built-in mail server: without yours, no email goes out.

• MAXTRAX_SMTP_SERVER: the mail server's host name. Unset by default.
• MAXTRAX_SMTP_PORT: default 587.
• MAXTRAX_SMTP_SSL: use TLS (STARTTLS). Default true. Keep it on.
• MAXTRAX_SMTP_FROM: the sender address on every email.
• MAXTRAX_SMTP_USER and MAXTRAX_SMTP_PASSWORD: only if the mail server needs them.

When MAXTRAX_SMTP_SERVER is set, these win over the Email (SMTP) screen in Site settings, which then shows them read-only, and the password never reaches the database. If you leave them unset, a Corporate Administrator enters the mail server on that screen instead.

A relay that accepts the web server by its address and needs no password is simplest. Users can type outside addresses into subscriptions and scheduled reports, so limit relaying on the mail server if your policy needs it.

Other email settings

• MAXTRAX_BASE_URL: the site's public address, used for links in emails and scheduled reports. Default: taken from each request. Set it behind a proxy, or if emailed links point at the wrong host.
• MAXTRAX_FEEDBACK_EMAIL: where the Send feedback button emails a user's note. Default support@maxtrax.io (CSDS support). Set your own address, or off to keep notes in the database only. Every note is saved in the site's own database either way.
• MAXTRAX_EXPIRY_NOTICES: true sends a weekly email, on Mondays, listing welder continuity and NDE technician certifications that run out soon. Off by default, so a copy of a live database on a test site does not email real people. It goes to the Project Administrators of the projects concerned who keep the notice on in My account.
• MAXTRAX_EXPIRY_NOTICE_DAYS: how far ahead those notices look, 1 to 180 days. Default 30.
• MAXTRAX_EXPIRY_NOTICE_TO: comma-separated addresses that get one combined notice instead.

Sign-in and security

• MAXTRAX_PASSWORD_MIN_LENGTH: the shortest password accepted. Default 8; values below 8 count as 8.
• MAXTRAX_PASSWORD_REQUIRE_UPPERCASE, MAXTRAX_PASSWORD_REQUIRE_LOWERCASE, MAXTRAX_PASSWORD_REQUIRE_DIGIT and MAXTRAX_PASSWORD_REQUIRE_SYMBOL: whether a new password must contain that kind of character. Default true each. The rules apply when a password is set, so existing passwords keep working.
• MAXTRAX_MAX_SESSION_HOURS: hours after sign-in when a session ends, however active. Default 24; 0 turns the limit off.
• MAXTRAX_MAX_FAILED_SIGNINS_PER_IP: failed sign-ins allowed from one address in 15 minutes. Default 50; 0 turns it off. If all your users come through one address (a proxy, NAT or VPN gateway), raise it or set the next setting, or one person's mistakes can block everyone behind that address.
• MAXTRAX_TRUST_FORWARDED_FOR: true only behind a proxy that adds the user's address to X-Forwarded-For and cannot be bypassed. Default false.
• MAXTRAX_TRUSTED_ORIGINS: the public site addresses to accept (for example https://maxtrax.example.com), comma-separated, when a proxy rewrites the Host header. Empty by default.
• MAXTRAX_AUDIT_REQUESTS: true also writes one audit row per web request (user, address, page and timing). Off by default; record changes, sign-ins and exports are always audited. MAXTRAX_REQUEST_LOG_RETENTION_DAYS then deletes those rows after that many days (default 0, keep them).
• MAXTRAX_OIDC_…: single sign-on with Microsoft Entra ID, Google or another provider. Off unless set. See Single sign-on.
• MAXTRAX_SUPPORT_PASSWORD and MAXTRAX_SUPPORT_EXPIRES: switch on the CSDS support account until the expiry, a UTC time such as YYYY-MM-DDT00:00:00Z. The password must be 16 or more characters. Leave both unset unless you have agreed a support task; the account turns itself off at the expiry.

The new view

The new view opens at the site's address for everyone, and the classic view is at /legacy. No setting changes that.

• MAXTRAX_NEXT_PREVIEW: whether the classic view shows its banner that links back to the new view. Default true.
• MAXTRAX_NEXT_PREVIEW_USERS and MAXTRAX_NEXT_PREVIEW_ROLES: comma-separated user names (or emails) and roles who see that banner. When both are unset, everyone does.
• MAXTRAX_CLIENT_TELEMETRY: whether the server accepts error reports from the new view (script errors and failed requests), kept in the site's own log. Default true; false turns it off.

Operations

• MAXTRAX_LOG_PATH: the folder for log files. Default App_Data\logs.
• MAXTRAX_GENERATED_FILE_RETENTION_DAYS: days that generated reports and downloads are kept. Default 90; 0 keeps them.
• MAXTRAX_NEW_REPORT_ENGINES: off sends every report from the new view, scheduled runs included, back to the older layout the classic view uses. Unset by default. Meant for support while a problem with the newer look is fixed.
• MAXTRAX_REPORT_WORKERS and MAXTRAX_IMPORT_WORKERS: background jobs run at once for reports and for Excel imports, 1 to 4. Default 1. More uses more memory.
• MAXTRAX_SLOW_SQL_MS: database calls slower than this many milliseconds are logged. Default 2000; 0 turns it off.
• MAXTRAX_SLOW_REQUEST_MS: requests slower than this many milliseconds are logged as warnings, so a site without Application Insights still records slow pages. Default 5000; 0 turns it off.
• MAXTRAX_LOG_RETENTION_DAYS: each night, deletes the site's log files older than this many days. Off unless set, and never below 7. Leave it off if your log collector reads the folder, or your policy keeps logs longer.
• MAXTRAX_SIGNALR_BACKPLANE: memory (the default) for one web server, sqlserver for two or more serving one site. With sqlserver, give every server the same machineKey. It does not work on Azure SQL.
• MAXTRAX_AUTH_DB and MAXTRAX_HANGFIRE_DB: separate databases for sign-in data and for the background job queue. Default: the main database. Most sites leave them unset.
• MAXTRAX_TELEMETRY_PROVIDER: appinsights or otlp forwards a redacted copy of warning and error log lines to your monitoring service, with MAXTRAX_TELEMETRY_CONNECTION (the connection string or address), optional MAXTRAX_TELEMETRY_HEADERS, and MAXTRAX_TELEMETRY_MIN_LEVEL (default Warning). Default none.

Where secrets are kept

The secrets are the connection strings (when they hold a SQL password), MAXTRAX_SMTP_PASSWORD, each MAXTRAX_OIDC_…CLIENT_SECRET, MAXTRAX_TELEMETRY_CONNECTION and MAXTRAX_TELEMETRY_HEADERS if used, and MAXTRAX_SUPPORT_PASSWORD if it is ever set. MaxTrax reads each as a plain value from its environment when it starts. Never send one to CSDS, and never put one in a file the site serves.

Azure App Service: Key Vault

Azure Key Vault is supported on App Service only.

1. Turn on a managed identity for the app. A user-assigned identity survives the app being re-created.
2. Give that identity the Key Vault Secrets User role on the vault.
3. Store each value as a secret, for example maxtrax-main-db holding the whole connection string.
4. Set the application setting to a reference instead of the value: MAXTRAX_MAIN_DB = @Microsoft.KeyVault(VaultName=your-vault;SecretName=maxtrax-main-db). With a user-assigned identity, also set the app's Key Vault reference identity to it.
5. Restart the app. App Service reads the vault before MaxTrax starts, and the Environment variables page shows a green tick beside each reference it resolved. If a database reference does not resolve, MaxTrax refuses to start and its log names the setting.

To rotate a secret, add a new version in the vault and restart the app.

Your own Windows server with IIS

• Set each secret as an environment variable of the site's application pool: in IIS Manager open Configuration Editor, section system.applicationHost/applicationPools, open the pool's environmentVariables and add the name and value, then recycle the pool. IIS keeps them in applicationHost.config, which only administrators can read, and gives them only to that site.
• Keep the master copy in your own password vault, and enter the new value there when you rotate it.
• With SQL Server on your own network, run each site's application pool as its own domain account or group managed service account, and use Windows authentication (Integrated Security=SSPI) in MAXTRAX_MAIN_DB. There is then no database password to keep at all.
• Avoid machine-wide environment variables (every process on the server can read them) and Web.config (it sits in the site folder and is replaced at each upgrade).

Azure Blob Storage for documents (App Service only)

By default, uploaded documents and photos are kept in the site's database. On App Service you can send new uploads to Azure Blob Storage instead: set MAXTRAX_DOCUMENT_STORE to blob and MAXTRAX_DOCUMENT_BLOB_URL to the container's address, and give the app's managed identity read and write access to the container (the Storage Blob Data Contributor role). With a user-assigned identity, set MAXTRAX_DOCUMENT_BLOB_CLIENT_ID to its client ID. No secret is needed. Keep MAXTRAX_DOCUMENT_BLOB_URL set once any file is in Blob Storage, because reading those files needs it too.