read-only configuration