move whitelist into cfg