root-only configuration