Configuration reference
This page is generated from internal/config/keys.go. Edits will be overwritten on the next build — change the registry in the source repository and rerun just docs-build.
Editable in UI marks whether the key can be set at runtime from the /admin/config page. Keys with — must be set via the config file or environment variables.
When UI change takes effect describes what happens after you save from the admin UI:
- immediate — the value is applied across all instances via Postgres
LISTEN/NOTIFYwithout restart. Reserved for keys whose consuming code reads throughconfig.Overlayon every use. - after restart — the change is persisted to the database and the API returns
restart_required: true; the new value takes effect on the next process restart. Covers both keys labeled as restart-class and keys labeled hot whose consumer hasn’t yet been wired to the overlay. - not editable — the API rejects the change; set this key via the config file or environment variables instead.
Keys marked 🔒 are sensitive. Their values are redacted from logs and the /admin/config UI.
See Configuration for precedence, file search paths, and environment-variable mapping.
| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
ai.anthropic.api_key 🔒 | string | "" | ✓ | after restart | Anthropic API key |
ai.anthropic.model | string | "claude-sonnet-4-20250514" | ✓ | after restart | Anthropic model name |
ai.bedrock.access_key_id | string | "" | ✓ | after restart | AWS access key id for Bedrock. If set, uses static credentials; otherwise the AWS default credential chain (IAM role, env, IMDS, EKS Pod Identity) is used. |
ai.bedrock.endpoint | string | "" | ✓ | after restart | Optional Bedrock Runtime endpoint URL override (VPC endpoint, FIPS, custom) |
ai.bedrock.model | string | "" | ✓ | after restart | Bedrock model id (e.g. anthropic.claude-3-5-sonnet-20241022-v2:0, meta.llama3-1-70b-instruct-v1:0, mistral.mistral-large-2407-v1:0). Inference-profile ids and ARNs are also accepted. |
ai.bedrock.profile | string | "" | ✓ | after restart | Shared config / credentials file profile name. Ignored when access_key_id is set. |
ai.bedrock.region | string | "" | ✓ | after restart | AWS region for Bedrock (e.g. us-east-1, us-west-2) |
ai.bedrock.secret_access_key 🔒 | string | "" | ✓ | after restart | AWS secret access key (paired with access_key_id) |
ai.bedrock.session_token 🔒 | string | "" | ✓ | after restart | Optional AWS session token (paired with static keys when assuming a role) |
ai.checkpoint_retention | duration | "720h" | ✓ | after restart | Checkpoint retention before reclamation |
ai.embedding.auto_migrate | bool | true | — | not editable | When provider/model differs from the active embedding state, auto-start the re-embedding migration on serve startup. Set false to stay on the active model; flip back to true (or set during a maintenance window) when ready to migrate. (Auto-migrate is consulted only during startup) |
ai.embedding.batch_size | int | 64 | ✓ | after restart | Max texts per Embed batch |
ai.embedding.model | string | "" | ✓ | after restart | Embedding model id |
ai.embedding.ollama.endpoint | string | "" | ✓ | after restart | Ollama base URL (default http://localhost:11434) |
ai.embedding.openai.api_key 🔒 | string | "" | ✓ | after restart | OpenAI embedding API key |
ai.embedding.openai.dimensions | int | 0 | ✓ | after restart | OpenAI Matryoshka dimension override (3-small/large only) |
ai.embedding.openai.endpoint | string | "" | ✓ | after restart | OpenAI embedding endpoint override |
ai.embedding.openai_compatible.api_key 🔒 | string | "" | ✓ | after restart | OpenAI-compatible API key |
ai.embedding.openai_compatible.dimension | int | 0 | ✓ | after restart | Output vector dimension (required for openai_compatible) |
ai.embedding.openai_compatible.endpoint | string | "" | ✓ | after restart | OpenAI-compatible /v1/embeddings URL |
ai.embedding.provider | string | "" | ✓ | after restart | Embedding provider (openai, ollama, openai_compatible). Empty disables embeddings. |
ai.embedding.request_timeout | duration | "60s" | ✓ | after restart | Per-HTTP-call deadline for embed requests |
ai.enabled | bool | false | ✓ | after restart | Enable AI subsystem |
ai.health_poll_interval | duration | "5m" | ✓ | after restart | AI health check poll interval |
ai.max_run_duration | duration | "30m" | ✓ | after restart | Maximum active time per agent run, pinned when the run starts. Time paused waiting on a human (ask_requester, a Slack triage approval card) does not count; pauses are bounded by the agent spec’s pause timeout and pause-loop limit instead. |
ai.provider | string | "anthropic" | ✓ | after restart | AI provider (anthropic, openai, ollama, bedrock) |
ai.provider_retry.max_attempts | int | 5 | ✓ | after restart | Most times an agent run sends one provider request when it keeps failing with a transient error (429, 5xx, connection failure), the first included. Between attempts the run waits durably (a shutdown parks it and the wait resumes elsewhere), which does not count toward ai.max_run_duration. 1 disables retries; when attempts run out the run fails. |
ai.provider_retry.max_wait | duration | "60s" | ✓ | after restart | Longest single wait between provider retry attempts. The wait is the provider’s Retry-After when sent, otherwise exponential backoff with jitter from 1s; either is capped at this value. |
ai.resolver_confidence_threshold | float64 | 0.8 | ✓ | after restart | Minimum confidence for autonomous resolution |
| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
auth.bootstrap_admin_email | string | "" | — | not editable | If set with auth.bootstrap_admin_password, create this admin on first start. Idempotent. (Bootstrap admin is consulted only during startup) |
auth.bootstrap_admin_name | string | "Admin" | — | not editable | Display name for the env-bootstrapped admin user. (Bootstrap admin is consulted only during startup) |
auth.bootstrap_admin_password 🔒 | string | "" | — | not editable | Initial password for the env-bootstrapped admin (>=8 chars). Only used if the user does not already exist. (Bootstrap admin is consulted only during startup) |
auth.local_auth_enabled | bool | true | ✓ | immediate | Allow local password authentication |
auth.login_lockout_duration | duration | "15m" | ✓ | immediate | Login lockout duration |
auth.login_max_attempts | int | 5 | ✓ | immediate | Max failed login attempts before lockout |
auth.session_absolute_timeout | duration | "8h" | ✓ | immediate | Session absolute timeout |
auth.session_idle_timeout | duration | "30m" | ✓ | immediate | Session idle timeout |
database
Section titled “database”| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
database.auto_migrate | bool | true | — | not editable | Apply pending goose migrations automatically on serve startup. Set false to require a separate docket migrate up step (recommended for scaled deployments). (Auto-migrate is consulted only during startup) |
database.max_conns | int | 25 | ✓ | after restart | Maximum database connections |
database.url 🔒 | string | "" | — | not editable | PostgreSQL connection URL (Database connection cannot be changed at runtime) |
| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
dbos.executor_id | string | "" | — | not editable | DBOS executor ID for this instance. Must be unique among running instances; empty generates hostname + UUIDv7 at startup. The DBOS__VMID environment variable takes precedence. (Per-instance identity; a value shared through the database would make instances re-run each other’s workflows) |
| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
email.enabled | bool | false | ✓ | after restart | Enable email integration |
server
Section titled “server”| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
server.host | string | "" | — | not editable | HTTP listen host (Server bind address cannot be changed at runtime) |
server.port | int | 8080 | — | not editable | HTTP listen port (Server bind port cannot be changed at runtime) |
server.shutdown_predrain_delay | duration | "5s" | ✓ | after restart | On SIGTERM, how long to keep serving while reporting /readyz as not-ready, so load balancers can deregister this instance before draining begins |
server.shutdown_timeout | duration | "30s" | ✓ | after restart | Graceful shutdown timeout |
| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
sla.default_resolution_threshold_minutes | int | 480 | ✓ | after restart | Default resolution SLA threshold (minutes) |
sla.default_response_threshold_minutes | int | 60 | ✓ | after restart | Default response SLA threshold (minutes) |
sla.sweeper_interval | duration | "1m" | ✓ | after restart | SLA sweeper check interval |
| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
slack.client_id 🔒 | string | "" | ✓ | after restart | Slack app client ID |
slack.client_secret 🔒 | string | "" | ✓ | after restart | Slack app client secret |
slack.enabled | bool | false | ✓ | after restart | Enable Slack integration |
slack.signing_secret 🔒 | string | "" | ✓ | after restart | Slack signing secret |
slack.triage_timeout | duration | "15m" | ✓ | after restart | Slack triage escalation timeout |
telemetry
Section titled “telemetry”| Key | Type | Default | Editable in UI | When UI change takes effect | Description |
|---|---|---|---|---|---|
telemetry.enabled | bool | false | — | not editable | Enable OpenTelemetry (Telemetry must be configured before startup) |