Where is the configuration, and what can I change in shelltrap.toml?

The configuration file is /etc/shelltrap/shelltrap.toml. It is a packaging conffile, so it survives upgrades. All paths in it must be absolute and must not contain .. components.

The sections you are most likely to touch

[watch]
roots = ["/home"]        # where file events are observed
min_uid = 1000           # only files at or above this UID are customer objects
backend = "auto"         # auto | fanotify-fid | fanotify-fd | inotify | crawl

[scanner]
workers = 2              # unprivileged scan workers in parallel
user = "shelltrap-scan"
clamd_socket = "/run/clamav/clamd.ctl"
enable_clamd = true      # set by the measured profile decision

[limits]
max_file_bytes = 67108864
max_scan_millis = 20000
max_archive_depth = 3

[feeds]
url = ""                 # empty disables remote updates, keeps local overlays
interval = "1h"
keep_generations = 3

[license]
service_url = "https://license.shelltrap.com"
token_path = "/etc/shelltrap/license.token"

Leave backend = "auto" unless you are deliberately testing a fallback: forcing a backend makes the top-level tier reflect your choice rather than the host's real capability.

Where everything else lives

• /var/lib/shelltrap/state.db, feeds/, cache/, quarantine/ — persistent state
• /run/shelltrap/api.sock and /run/shelltrap/upload.sock — the local sockets
• /usr/lib/shelltrap/php/shelltrap-prepend.php — the PHP upload adapter
• /etc/shelltrap/upload-policy.json — the atomic policy mirror the adapter reads
• /var/log/shelltrap/ — text and audit logs

Directory modes under /var/lib/shelltrap are staggered on purpose: the parent is 0711 and feeds/ is 0755 so the unprivileged worker can read rule generations, while quarantine/, cache/ and state.db stay root-only.

Behaviour is policy, not configuration

Almost everything that changes what Shelltrap does — actions on a hit, the upload gate, scan windows, retention — is a policy with three layers (global, account, domain), not a line in this file. Use the CLI or the panel for that; see "How do I set policies per domain?".

Resource limits belong in a systemd drop-in

Never edit the vendor unit. Put your own CPUQuota, IOWeight, Nice and MemoryHigh into a drop-in:

sudo install -d /etc/systemd/system/shelltrapd.service.d
sudo systemctl daemon-reload
sudo systemctl restart shelltrapd.service

The vendor unit restricts RestrictAddressFamilies to AF_UNIX on purpose. Only if your notification policy really uses SMTP or webhook targets do you install the shipped network drop-in from /usr/share/shelltrap/systemd/.

After a change

sudo systemctl restart shelltrapd.service
shelltrapd --config /etc/shelltrap/shelltrap.toml --check
shelltrap health

A full annotated example ships as shelltrap.toml.example, and the reference is in the configuration documentation.