diff --git a/README.md b/README.md
index 5e77285c..7fb3c4d6 100644
--- a/README.md
+++ b/README.md
@@ -146,6 +146,21 @@ In order to see what options are available:
 cargo run -- --help
 ```
 
+#### Configuration
+
+`veilid-server` has a wealth of configuration options. Further documentation on
+the format of the `veilid-server.conf` file may be found [in the project /doc
+directory](./doc/config/config.md).
+
+When running `veilid-server` in a Unix-like environment, the application will
+look for its config file under `/etc/veilid-server/`. If the config file is not
+found in this location, `veilid-server` will follow the XDG user directory spec
+and look in `~/.config/veilid-server`.
+
+When running under Windows, the `veilid-server.conf` file may be created at
+`C:\Users\<user>\AppData\Roaming\Veilid\Veilid\`, and when running under macOS,
+at `/Users/<user>/Library/Application Support/org.Veilid.Veilid`.
+
 ### Veilid CLI
 
 In order to connect to your local `veilid-server`:
diff --git a/veilid-server/sample.config b/doc/config/sample.config
similarity index 100%
rename from veilid-server/sample.config
rename to doc/config/sample.config
diff --git a/doc/config/veilid-server-config.md b/doc/config/veilid-server-config.md
new file mode 100644
index 00000000..7332214e
--- /dev/null
+++ b/doc/config/veilid-server-config.md
@@ -0,0 +1,149 @@
+---
+title: Veilid Server Configuration
+keywords:
+- config
+- veilid-server
+status: Draft
+---
+# Veilid Server Configuration
+
+## Configuration File
+
+`veilid-server` may be run using configuration from both command-line arguments
+and the `veilid-server.conf` file.
+
+### Global Directives
+
+| Directive                 | Description                                       |
+|---------------------------|---------------------------------------------------|
+| [daemon](#daemon)         | Run `veilid-server` in the background             |
+| [client_api](#client_api) ||
+
+```yaml
+daemon:
+    enabled: false
+client_api:
+    enabled: true
+    listen_address: 'localhost:5959'
+auto_attach: true
+logging:
+    system:
+        enabled: false
+        level: 'info'
+    terminal:
+        enabled: true
+        level: 'info'
+    file: 
+        enabled: false
+        path: ''
+        append: true
+        level: 'info'
+    api:
+        enabled: true
+        level: 'info'
+    otlp:
+        enabled: false
+        level: 'trace'
+        grpc_endpoint: 'localhost:4317'
+testing:
+    subnode_index: 0
+core:
+    protected_store:
+        allow_insecure_fallback: true
+        always_use_insecure_storage: true
+        insecure_fallback_directory: '%INSECURE_FALLBACK_DIRECTORY%'
+        delete: false
+    table_store:
+        directory: '%TABLE_STORE_DIRECTORY%'
+        delete: false
+    block_store:
+        directory: '%BLOCK_STORE_DIRECTORY%'
+        delete: false
+    network:
+        connection_initial_timeout_ms: 2000
+        connection_inactivity_timeout_ms: 60000
+        max_connections_per_ip4: 32
+        max_connections_per_ip6_prefix: 32
+        max_connections_per_ip6_prefix_size: 56
+        max_connection_frequency_per_min: 128
+        client_whitelist_timeout_ms: 300000 
+        reverse_connection_receipt_time_ms: 5000 
+        hole_punch_receipt_time_ms: 5000 
+        node_id: ''
+        node_id_secret: ''
+        bootstrap: ['bootstrap.dev.veilid.net']
+        bootstrap_nodes: []
+        routing_table:
+            limit_over_attached: 64
+            limit_fully_attached: 32
+            limit_attached_strong: 16
+            limit_attached_good: 8
+            limit_attached_weak: 4
+        rpc: 
+            concurrency: 0
+            queue_size: 1024
+            max_timestamp_behind_ms: 10000
+            max_timestamp_ahead_ms: 10000
+            timeout_ms: 10000
+            max_route_hop_count: 7
+        dht:
+            resolve_node_timeout:
+            resolve_node_count: 20
+            resolve_node_fanout: 3
+            max_find_node_count: 20
+            get_value_timeout:
+            get_value_count: 20
+            get_value_fanout: 3
+            set_value_timeout:
+            set_value_count: 20
+            set_value_fanout: 5
+            min_peer_count: 20
+            min_peer_refresh_time_ms: 2000
+            validate_dial_info_receipt_time_ms: 2000
+        upnp: true
+        natpmp: false
+        detect_address_changes: true
+        enable_local_peer_scope: false
+        restricted_nat_retries: 0
+        tls:
+            certificate_path: '%CERTIFICATE_PATH%'
+            private_key_path: '%PRIVATE_KEY_PATH%'
+            connection_initial_timeout_ms: 2000
+        application:
+            https:
+                enabled: false
+                listen_address: ':5150'
+                path: 'app'
+                # url: 'https://localhost:5150'
+            http:
+                enabled: false
+                listen_address: ':5150'
+                path: 'app'
+                # url: 'http://localhost:5150'
+        protocol:
+            udp:
+                enabled: true
+                socket_pool_size: 0
+                listen_address: ':5150'
+                # public_address: ''
+            tcp:
+                connect: true
+                listen: true
+                max_connections: 32
+                listen_address: ':5150'
+                #'public_address: ''
+            ws:
+                connect: true
+                listen: true
+                max_connections: 16
+                listen_address: ':5150'
+                path: 'ws'
+                # url: 'ws://localhost:5150/ws'
+            wss:
+                connect: true
+                listen: false
+                max_connections: 16
+                listen_address: ':5150'
+                path: 'ws'
+                # url: ''
+```
diff --git a/veilid-server/src/settings.rs b/veilid-server/src/settings.rs
index d7e24c46..d487f561 100644
--- a/veilid-server/src/settings.rs
+++ b/veilid-server/src/settings.rs
@@ -752,6 +752,16 @@ impl Settings {
         Ok(())
     }
 
+    /// Determine default config path
+    ///
+    /// In a unix-like environment, veilid-server will look for its config file
+    /// in /etc/veilid-server. If a config is not found in this location, it will
+    /// follow the XDG user directory spec, and look in `~/.config/veilid-server/`.
+    ///
+    /// For Windows, a user-local config may be created at 
+    /// `C:\Users\<user>\AppData\Roaming\Veilid\Veilid`, and for macOS, at
+    /// `/Users/<user>/Library/Application Support/org.Veilid.Veilid`
+    ///
     pub fn get_default_config_path() -> PathBuf {
         #[cfg(unix)]
         {