Settings

vaigil config list
vaigil config explain session.idle
vaigil config set session.idle 30m
vaigil config unset session.idle

Every default is the safer value. Setting a weaker one needs --accept-risk and a reason that is recorded, and then goes to a second administrator before it applies. Some settings have hard bounds no reason steps outside, such as the hour NIST SP 800-63B-4 sets for an unused session.

Setting	What it is
session.idle, session.max	How long a session lasts unused (an hour, at most), and at most in all. Anybody who can grant access is signed out after fifteen minutes unused.
admin.base_url, admin.behind_tls_proxy	The console's public address, and whether a proxy in front of it ends TLS.
network.mode	Open, or offline: refuse every connection that would leave the host.
auth.throttle.*	When failed sign-ins start to be delayed, and how long a delay grows.
security.contact	Where your security team is reached.
siem.stream.url	Where the audit log is sent as it is written.
passkey.require_hardware, passkey.authenticators	Which authenticators may hold a passkey.
token.ttl.default, token.ttl.max	How long a token lasts by default, and at most.