`bwlimit`: `[clone=<LIMIT>] [,default=<LIMIT>] [,migration=<LIMIT>] [,move=<LIMIT>] [,restore=<LIMIT>]` ::

Set bandwidth/io limits various operations.

`clone`=`<LIMIT>` ;;

bandwidth limit in KiB/s for cloning disks

`default`=`<LIMIT>` ;;

default bandwidth limit in KiB/s

`migration`=`<LIMIT>` ;;

bandwidth limit in KiB/s for migrating guests (including moving local disks)

`move`=`<LIMIT>` ;;

bandwidth limit in KiB/s for moving disks

`restore`=`<LIMIT>` ;;

bandwidth limit in KiB/s for restoring guests from backups

`console`: `<applet | html5 | vv | xtermjs>` ::

Select the default Console viewer. You can either use the builtin java applet (VNC; deprecated and maps to html5), an external virt-viewer comtatible application (SPICE), an HTML5 based vnc viewer (noVNC), or an HTML5 based console client (xtermjs). If the selected viewer is not available (e.g. SPICE not activated for the VM), the fallback is noVNC.

`description`: `<string>` ::

Datacenter description. Shown in the web-interface datacenter notes panel. This is saved as comment inside the configuration file.

`email_from`: `<string>` ::

Specify email address to send notification from (default is root@$hostname)

`fencing`: `<both | hardware | watchdog>` ('default =' `watchdog`)::

Set the fencing mode of the HA cluster. Hardware mode needs a valid configuration of fence devices in /etc/pve/ha/fence.cfg. With both all two modes are used.
+
WARNING: 'hardware' and 'both' are EXPERIMENTAL & WIP

`ha`: `shutdown_policy=<enum>` ::

Cluster wide HA settings.

`shutdown_policy`=`<conditional | failover | freeze | migrate>` ('default =' `conditional`);;

Describes the policy for handling HA services on poweroff or reboot of a node. Freeze will always freeze services which are still located on the node on shutdown, those services won't be recovered by the HA manager. Failover will not mark the services as frozen and thus the services will get recovered to other nodes, if the shutdown node does not come up again quickly (< 1min). 'conditional' chooses automatically depending on the type of shutdown, i.e., on a reboot the service will be frozen but on a poweroff the service will stay as is, and thus get recovered after about 2 minutes. Migrate will try to move all running services to another node when a reboot or shutdown was triggered. The poweroff process will only continue once no running services are located on the node anymore. If the node comes up again, the service will be moved back to the previously powered-off node, at least if no other migration, reloaction or recovery took place.

`http_proxy`: `http://.*` ::

Specify external http proxy which is used for downloads (example: 'http://username:password@host:port/')

`keyboard`: `<da | de | de-ch | en-gb | en-us | es | fi | fr | fr-be | fr-ca | fr-ch | hu | is | it | ja | lt | mk | nl | no | pl | pt | pt-br | sl | sv | tr>` ::

Default keybord layout for vnc server.

`language`: `<ca | da | de | en | es | eu | fa | fr | he | it | ja | nb | nn | pl | pt_BR | ru | sl | sv | tr | zh_CN | zh_TW>` ::

Default GUI language.

`mac_prefix`: `<string>` ::

Prefix for autogenerated MAC addresses.

`max_workers`: `<integer> (1 - N)` ::

Defines how many workers (per node) are maximal started  on actions like 'stopall VMs' or task from the ha-manager.

`migration`: `[type=]<secure|insecure> [,network=<CIDR>]` ::

For cluster wide migration settings.

`network`=`<CIDR>` ;;

CIDR of the (sub) network that is used for migration.

`type`=`<insecure | secure>` ('default =' `secure`);;

Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance.

`migration_unsecure`: `<boolean>` ::

Migration is secure using SSH tunnel by default. For secure private networks you can disable it to speed up migration. Deprecated, use the 'migration' property instead!

`u2f`: `[appid=<APPID>] [,origin=<URL>]` ::

u2f

`appid`=`<APPID>` ;;

U2F AppId URL override. Defaults to the origin.

`origin`=`<URL>` ;;

U2F Origin override. Mostly useful for single nodes with a single URL.

`webauthn`: `[id=<DOMAINNAME>] [,origin=<URL>] [,rp=<RELYING_PARTY>]` ::

webauthn configuration

`id`=`<DOMAINNAME>` ;;

Relying part ID. Must be the domain name without protocol, port or location. Changing this *will* break existing credentials.

`origin`=`<URL>` ;;

Site origin. Must be a `https://` URL (or `http://localhost`). Should contain the address users type in their browsers to access the web interface. Changing this *may* break existing credentials.

`rp`=`<RELYING_PARTY>` ;;

Relying party name. Any text identifier. Changing this *may* break existing credentials.