fabro/docs/administration/server-configuration.mdx
2026-03-29 21:24:10 -04:00

205 lines
6.3 KiB
Text

---
title: "Server Configuration"
description: "Server config file, CLI overrides, and environment variables"
---
## Config file
The server config file at `~/.fabro/server.toml` controls how `fabro serve` behaves — API binding, authentication, run defaults, and more. The [Quick Start](/getting-started/quick-start) doesn't require one, but production deployments should configure it explicitly.
### Full reference
```toml title="server.toml"
# Maximum concurrent workflow runs (default: 5)
max_concurrent_runs = 8
# Override the default data directory (default: ~/.fabro)
data_dir = "/var/lib/fabro"
[api]
base_url = "https://fabro.example.com"
[api.tls]
cert = "/etc/fabro/tls/cert.pem"
key = "/etc/fabro/tls/key.pem"
ca = "/etc/fabro/tls/ca.pem"
# Authentication strategies (array of Jwt or Mtls)
[[api.authentication_strategies]]
type = "Jwt"
[web]
url = "https://fabro-web.example.com"
[web.auth]
provider = "Github"
allowed_usernames = ["alice", "bob"]
[git]
provider = "Github"
app_id = "123456"
client_id = "Iv1.abc123"
[log]
level = "info"
[git.author]
name = "fabro-bot"
email = "fabro-bot@company.com"
[git.webhooks]
strategy = "tailscale_funnel"
# Run defaults — applied to every run unless overridden by the run config
[llm]
model = "claude-sonnet-4-5"
provider = "anthropic"
[llm.fallbacks]
anthropic = ["gemini", "openai"]
[setup]
commands = ["npm install"]
timeout_ms = 120000
[sandbox]
provider = "daytona"
[sandbox.daytona]
auto_stop_interval = 60
[sandbox.daytona.labels]
team = "platform"
[features]
retros = true
[checkpoint]
exclude_globs = ["**/node_modules/**", "**/.cache/**"]
[vars]
default_branch = "main"
```
### CLI overrides
Several `server.toml` settings can be overridden via `fabro serve` flags:
| Flag | Default | Description |
|---|---|---|
| `--port` | `3000` | Port to listen on |
| `--host` | `127.0.0.1` | Host address to bind to |
| `--model` | — | Override default LLM model |
| `--provider` | — | Override default LLM provider |
| `--sandbox` | — | Override default sandbox provider |
| `--max-concurrent-runs` | `5` | Maximum concurrent run executions |
| `--config` | `~/.fabro/server.toml` | Path to server config file |
| `--dry-run` | — | Execute with simulated LLM backend |
CLI flags take precedence over `server.toml` values. See [Run Configuration — Precedence](/execution/run-configuration#precedence) for the full resolution order.
### Run defaults
The `[llm]`, `[setup]`, `[sandbox]`, `[checkpoint]`, and `[vars]` sections in `server.toml` act as defaults for every run. A run config TOML can override any of these. For `[vars]`, Daytona labels, and checkpoint exclude globs, values are **merged** — the run config wins on key collisions. All other fields use "first non-empty wins" precedence.
### `[log]` section
Configure the default log level without environment variables. Precedence: `FABRO_LOG` env var > `--debug` flag > `[log]` level > `"info"`.
| Key | Description | Default |
|---|---|---|
| `level` | Log level: `error`, `warn`, `info`, `debug`, `trace` | `"info"` |
### `[git.author]` section
Customize the git author identity used for checkpoint commits. When not set, defaults to `fabro` / `fabro@local`.
| Key | Description | Default |
|---|---|---|
| `name` | Git author name | `"fabro"` |
| `email` | Git author email | `"fabro@local"` |
The CLI can also set `[git.author]` in `user.toml` to override the server default.
### `[git.webhooks]` section
Enable automatic GitHub webhook delivery via Tailscale funnel. When configured, `fabro serve` binds a local HTTP listener, exposes it through `tailscale funnel`, and updates the GitHub App's webhook URL on startup. Incoming webhooks are verified with HMAC-SHA256.
| Key | Description | Values |
|---|---|---|
| `strategy` | Webhook delivery method | `"tailscale_funnel"` |
Requires a configured GitHub App (`[git]` section with `app_id` and `client_id`) and the `GITHUB_APP_WEBHOOK_SECRET` environment variable.
### `[checkpoint]` section
Configure checkpoint behavior for all runs.
| Key | Description |
|---|---|
| `exclude_globs` | Glob patterns for files to exclude from checkpoint commits (e.g. `["**/node_modules/**"]`) |
Exclude globs from `server.toml` and run configs are merged (union, deduplicated). See [Run Configuration — Checkpoint](/execution/run-configuration#checkpoint) for per-run configuration.
### `[features]` section
Toggle experimental or opt-in features. All features default to `false`.
| Key | Description |
|---|---|
| `retros` | Enable automatic [retro](/execution/retros) generation after workflow runs (experimental) |
| `session_sandboxes` | Enable session sandboxes in the web UI |
The same `[features]` section can be set in `fabro.toml` (project-level) to enable features per-project.
## Environment variables
Fabro reads environment variables from a `.env` file in the working directory (if present) and from the shell environment. Provider API keys are required for the models you want to use; everything else is optional.
### LLM provider keys
| Variable | Provider |
|---|---|
| `ANTHROPIC_API_KEY` | Anthropic (Claude) |
| `OPENAI_API_KEY` | OpenAI (GPT) |
| `GEMINI_API_KEY` or `GOOGLE_API_KEY` | Google (Gemini) |
| `KIMI_API_KEY` | Kimi |
| `ZAI_API_KEY` | Zai (GLM) |
| `MINIMAX_API_KEY` | Minimax |
| `INCEPTION_API_KEY` | Inception (Mercury) |
### Sandbox and tools
| Variable | Description |
|---|---|
| `DAYTONA_API_KEY` | Daytona cloud sandbox API key |
| `BRAVE_SEARCH_API_KEY` | Brave Search API key (for the `web_search` tool) |
### Server authentication
| Variable | Description |
|---|---|
| `FABRO_JWT_PRIVATE_KEY` | Ed25519 private key (base64-encoded PEM) for JWT signing |
| `FABRO_JWT_PUBLIC_KEY` | Ed25519 public key (base64-encoded PEM) for JWT verification |
| `SESSION_SECRET` | Session encryption secret (64-character hex string) |
### GitHub App (optional)
| Variable | Description |
|---|---|
| `GITHUB_APP_CLIENT_SECRET` | GitHub App client secret |
| `GITHUB_APP_WEBHOOK_SECRET` | GitHub App webhook secret |
| `GITHUB_APP_PRIVATE_KEY` | GitHub App private key (base64-encoded) |
### Slack integration (optional)
| Variable | Description |
|---|---|
| `FABRO_SLACK_APP_TOKEN` | Slack App-level token |
| `FABRO_SLACK_BOT_TOKEN` | Slack Bot token |
### Logging
| Variable | Default | Description |
|---|---|---|
| `FABRO_LOG` | `info` | Log level: `error`, `warn`, `info`, `debug` |