set whitelist in config