TeamCity Configuration and Maintenance

To change the server configuration, go to Administration | Global Settings. The following blocks of settings are available:

TeamCity Configuration

Setting	Description
Database	The database used by the running TeamCity server.
Data Directory	The \< TeamCity Data Directory \> path with the ability to browse the directory.
Artifact directories	The list of the root directories used by the TeamCity server to store Build Artifact, build logs and other build data. The default location is `system/artifacts`. Note that artifacts can also be stored on external storage. The list can be changed by specifying a new-line delimited list of paths. Absolute and relative (to TeamCity Data Directory) paths are supported. All the specified directories use the same structure. When looking for build artifacts, the specified locations are searched for the directory corresponding to the build. The search is done in the order the root directories are specified. The first found build artifacts directory is used as the source of artifacts of this build. Artifacts for the newly starting builds are placed under the first directory in the list.
Caches directory	The directory containing TeamCity internal caches (of the VCS repository contents, search index, other). You can manually delete files from this directory to clear caches.
Server URL	The configurable URL of the running TeamCity server.

Build Settings

Setting	Description
Maximum build artifact file size	Maximum size in bytes. KB, MB, GB or TB suffixes are allowed. \-1 indicates no limit.
Maximum number of artifacts per build	Limits the number of artifacts published per build. This helps prevent memory consumption problems in case multiple builds publish many artifacts in parallel. This setting does not consider hidden artifacts, which have their own limit. If the number of hidden artifacts your build produces exceeds this separate threshold, TeamCity reports the "Failed to publish artifacts" error. To fix this issue, add the `teamcity.artifact.limit.internalArtifactsNumber=<value>` internal property (the default value is 1000).
Default build execution timeout	Maximum time for a build. Can be overridden when defining build failure conditions.

Version Control Settings

Setting	Description
Default VCS changes check interval	Set to 60 seconds by default. Specifies how often TeamCity polls the VCS repository for VCS changes. Can be overridden when configuring VCS roots. Additionally, you can enforce the interval of VCS changes check as a minimum polling interval for all VCS roots on the server. This way, Project Administrators will only be able to set intervals that are larger than the default one. This helps restrict the frequency of polling requests thus offloading the server.
Default VCS trigger quiet period	Set to 60 seconds by default. Specifies a period (in seconds) that TeamCity maintains between the moment the last VCS change is detected and a build is added into the queue. Can be overridden when configuring VCS triggers.

Setting

Description

Default VCS changes check interval

Set to 60 seconds by default. Specifies how often TeamCity polls the VCS repository for VCS changes. Can be overridden when configuring VCS roots.

Additionally, you can enforce the interval of VCS changes check as a minimum polling interval for all VCS roots on the server. This way, Project Administrators will only be able to set intervals that are larger than the default one. This helps restrict the frequency of polling requests thus offloading the server.

Default VCS trigger quiet period

Set to 60 seconds by default. Specifies a period (in seconds) that TeamCity maintains between the moment the last VCS change is detected and a build is added into the queue. Can be overridden when configuring VCS triggers.

Encryption Settings

TeamCity protects all secret values and SSH keys using an internal scrambling algorithm. These scrambled values are stored in TeamCity Data Directory, so their safety relies on the overall security of your environment.

You can set the Custom encryption key option in Encryption Settings section of TeamCity server settings. In this case both secrets and SSH keys will get encrypted by this 128-bit key encoded with Base64.

The custom encryption key is stored in the TeamCity Data Directory/config/encryption-config.xml file, so make sure you do not store this folder in a remote VCS repository that can be accessed by 3rd-party users.

When you generate or enter a new custom encryption key, it becomes the default for encrypting newly added secrets and SSH keys. Existing data remains encrypted with the previously used keys, which are stored in the encryption-config.xml file.

<?xml version="1.0" encoding="UTF-8"?>
<encryption-settings>
  <key value="oldKey1" />
  <key value="oldKey2" />
  <key value="currentKey" default="true" />
</encryption-settings>

Artifacts' Domain Isolation

Setting	Description
Enable isolation protection	If enabled, build artifacts will be loaded from a separate domain and any potential malicious content will not be able to communicate with the TeamCity server on behalf of the user viewing this content. This mitigates the risk of XSS attacks through artifacts and of other related vulnerabilities. Note that this mode requires configuring a dedicated domain for TeamCity. To continue using artifacts for displaying some build results (for example, custom reports), you need to specify this domain's URL below.
Artifacts' URL	Specify a URL to serve build artifacts from. Note the URLs for artifacts isolation and the TeamCity server must have different hostnames. Using different ports of the same hostname for both resources may lead to various problems, including failed builds and issues with signing in to TeamCity. On receiving a request for a content of some artifact, TeamCity will redirect your browser to a temporary URL that uses this artifacts' URL as a base. The temporary URL expires after some time to prevent unauthorized access to the artifact. Upon accessing the expired URL, a regular authentication will be performed and a new URL will be generated. The same logic applies to the custom report tabs because their content also comes from the build artifacts. For a personal TeamCity installation, which is accessible via localhost only, a URL like `http://127.0.0.1[:port]/` would be sufficient. For a TeamCity server used by an organization, a new DNS name, or a `CNAME`, should be registered either for the machine where the server is installed or for a reverse proxy server if TeamCity is accessible through the proxy. The URL with this new hostname should be specified in the artifacts' URL. No extra configuration on the proxy side is required. Note: as this is a special URL which exists for serving artifacts only, users will not be able to sign in to the TeamCity interface via it.

Setting

Description

Enable isolation protection

If enabled, build artifacts will be loaded from a separate domain and any potential malicious content will not be able to communicate with the TeamCity server on behalf of the user viewing this content. This mitigates the risk of XSS attacks through artifacts and of other related vulnerabilities.

Note that this mode requires configuring a dedicated domain for TeamCity. To continue using artifacts for displaying some build results (for example, custom reports), you need to specify this domain's URL below.

Artifacts' URL

Specify a URL to serve build artifacts from. Note the URLs for artifacts isolation and the TeamCity server must have different hostnames. Using different ports of the same hostname for both resources may lead to various problems, including failed builds and issues with signing in to TeamCity.

On receiving a request for a content of some artifact, TeamCity will redirect your browser to a temporary URL that uses this artifacts' URL as a base. The temporary URL expires after some time to prevent unauthorized access to the artifact. Upon accessing the expired URL, a regular authentication will be performed and a new URL will be generated.
The same logic applies to the custom report tabs because their content also comes from the build artifacts.

For a personal TeamCity installation, which is accessible via localhost only, a URL like http://127.0.0.1[:port]/ would be sufficient.

For a TeamCity server used by an organization, a new DNS name, or a CNAME, should be registered either for the machine where the server is installed or for a reverse proxy server if TeamCity is accessible through the proxy. The URL with this new hostname should be specified in the artifacts' URL. No extra configuration on the proxy side is required.

Note: as this is a special URL which exists for serving artifacts only, users will not be able to sign in to the TeamCity interface via it.

29 September 2025