Configuration

norsk-ctl keeps its state in ~/.norsk-ctl/. Two files live there: a daemon config (config.yaml) that the server reads at boot, and a state database (norsk-ctl.db) that holds running instance and plugin state.

File	Who writes it	Purpose
`~/.norsk-ctl/config.yaml`	`norsk-ctl init` (server side)	Daemon settings — network mode, license, image tags, TLS
`~/.norsk-ctl/norsk-ctl.db`	The daemon	SQLite state (plugins, instances). Do not edit by hand

Daemon config (`config.yaml`)

Written by norsk-ctl init and read by the daemon at startup. Example:

networkMode: docker
licenseMode: byol
licenseFile: /Users/alice/licenses/norsk.json
defaultStudioTag: 1.27.0
defaultMediaTag: 1.0.402
defaultWorkingDirectory: /Users/alice/norsk-data
securityMode: tls
certPath: /etc/norsk-ctl/tls/cert.pem
keyPath: /etc/norsk-ctl/tls/key.pem
certSource: user

Fields

Field	Values	Description
`networkMode`	`docker` \| `host` \| `hybrid`	How containers are networked. See Network Modes
`licenseMode`	`byol` \| `marketplace`	Where the license comes from
`licenseFile`	path	Required when `licenseMode: byol`. Path to the Norsk license JSON
`marketplaceProvider`	`gcp` \| `aws`	Required when `licenseMode: marketplace`
`defaultStudioTag`	image tag	Default Studio container tag (overridable per launch)
`defaultMediaTag`	image tag	Default Media container tag (overridable per launch)
`defaultWorkingDirectory`	path	Default host directory mounted as `/data` in instance containers
`hostIp`	IP	Host IP advertised to clients (derived from `externalUrl` if unset)
`externalUrl`	URL	Public URL where the proxy is reachable (e.g. `https://norsk.example.com`)
`examplesDirectory`	path	Override for the seed-examples source tree
`containerUser`	`uid:gid`	User/group containers run as (auto-detected on Linux)
`proxyHeader`	header name	Custom header injected into proxy requests
`certPath`	path	TLS certificate file (when `securityMode: tls`)
`keyPath`	path	TLS key file (when `securityMode: tls`)
`certSource`	`mkcert` \| `user` \| `certbot`	How the cert was provisioned (affects renewal behaviour)
`securityMode`	`tls` \| `insecure`	`tls` → HTTPS via nginx; `insecure` → HTTP only
`runMode`	`standard` \| `demo`	`demo` is set by `norsk-ctl demo` and enables the demo banner in the UI

CLI / daemon port

The CLI always talks to a daemon on the same machine. Default port is 8333. Override with --port <n> per-invocation, or set NORSK_CTL_PORT in the environment (honoured by both the daemon and the CLI).

Remote management happens through the web UI (behind the nginx + oauth2-proxy front door), not the CLI.

State database (`norsk-ctl.db`)

SQLite file holding plugin enabled/disabled state, launched instance metadata, and other daemon-managed state. Managed entirely by the daemon — do not edit by hand.

If you want to start fresh, stop the daemon and delete ~/.norsk-ctl/ (or just norsk-ctl.db to keep your config). norsk-ctl init --force does the same plus resets the config.