Editing config.yaml.
DayMug reads one YAML file when it starts. This page shows where that file is and what every field does. Restart the service after editing — the file is only read at startup. Provider accounts, users and bots are not in this file — they are managed from the web UI.
Where the file is
After a one-line install the file is
~/.daymug/config.yaml. DayMug looks for its config in
this order and uses the first one that exists:
| # | Source | Example |
|---|---|---|
| 1 | --config flag | daymug serve --config /etc/daymug/config.yaml |
| 2 | DAYMUG_CONFIG env var | DAYMUG_CONFIG=/srv/daymug.yaml daymug serve |
| 3 | config.yaml next to the binary | ~/.daymug/config.yaml for ~/.daymug/daymug |
If none of them exists DayMug refuses to start instead of guessing. Lost your file? Grab a fresh, fully commented copy:
curl -fsSL https://github.com/DayMug/DayMug/releases/latest/download/config.example.yaml -o ~/.daymug/config.yaml
Want to read every field with its comment first? Open
config.example.yaml on GitHub
— it is the same template. daymug bootstrap keeps an existing
config.yaml untouched, so re-running the installer is
safe.
Field reference
Every key is optional. The default column is what you get when the key is left out.
Where the process listens and how the outside world addresses it.
Listen address. The installer writes 127.0.0.1:8090. Use 127.0.0.1:<port> behind a proxy on the same host, 0.0.0.0:<port> to expose it directly. DAYMUG_ADDR overrides it.
The URL people open, e.g. https://chat.example.com. Recommended: push notifications build their tap-to-open links from it; empty means pushes arrive but tapping them does nothing.
Browser session lifetime and which login methods are open.
How long a login stays valid (720h = 30 days).
Force the Secure cookie flag. The flag is already added automatically for HTTPS requests (direct TLS or X-Forwarded-Proto: https). Set true only when TLS ends at a proxy that drops that header. Turning it on over plain HTTP makes login impossible.
Username + password login. Set false when SSO should be the only way in.
Recovery hatch for administrator access.
Usernames promoted to admin on every start. Put your own name here before the first start.
Home directories and per-person concurrency.
New users get <root>/<username> as their work directory. Must resolve to an absolute path. Admins can override a single user's directory in the Users page; the root itself is config-only.
Tasks one person may run at once, across every account and entry point (web, API, IM bots, /compact). Extra tasks queue. Values below 1 mean "use the default".
How agent processes are supervised. These three keys sit at the top level of the file, not under a section.
After this long with no output, DayMug checks CPU time and session logs for signs of life instead of killing the agent — so a quiet long-running tool survives.
Hard ceiling on one silent stretch, even if the agent still looks busy. Must be ≥ runner_stall_timeout.
Wall-clock cap on one turn started from Slack / 飞书 / Telegram / 微信. 0s = no cap (the watchdog above still catches stuck turns).
Soft reminders for unusually expensive user messages. Counts cover the main agent only (sub-agents are not counted) and reset with every new message. The active task always finishes uninterrupted; the next user message gets one reminder and continues normally. Any threshold set to 0 is off; negative values are rejected.
Model-request threshold for reminding on the next message.
Tool-invocation threshold for reminding on the next message.
Estimated USD threshold for reminding on the next message. Off by default.
Automatic cleanup of old data. Every key defaults to 0, which turns that cleanup off — nothing is deleted unless you opt in. Conversation sweeps run in the background every 6 hours.
Delete conversations with no activity for this long, as if their owner had deleted them. Pinned conversations are kept. E.g. 336h = 14 days.
Permanently erase deleted users, agents and conversations (with their messages) this long after deletion. E.g. 168h = 7 days.
Delete uploaded files older than this, the next time something is uploaded to the same folder. Old chats that show them get broken links. E.g. 720h = 30 days.
When a long session gets compacted or retired. Both are fractions of the model's context window, so one value means the same on a 200k and a 1M window.
Run /compact automatically once a finished turn leaves the context at or above this fraction. 0 = manual only. Must be in [0, 1). 0.6–0.7 is a good start.
For agents with case-file mode on: retire an IM thread's session past this fraction and restart it from the case document. Range (0, 1). Here 0 means "use the default", not "off" — turn case mode off on the agent instead.
Optional per-process isolation around every agent run.
Turn isolation on. Only meaningful together with type: bwrap.
noop — no isolation; agents can reach whatever the service user can. bwrap — Linux bubblewrap; non-exempt users are confined to their own work directory.
bwrap only. Lets jailed agents use the network; false starts them offline.
Absolute host paths every jailed agent may read, e.g. a shared assets folder.
Absolute host paths every jailed agent may write. Keep this list short.
Optional single sign-on via Casdoor or any OpenID Connect provider. With enabled: false every other key is ignored. When enabled, a wrong issuer stops startup so mistakes surface immediately.
Show the SSO button and accept OIDC logins.
Issuer URL; endpoints are discovered from /.well-known/openid-configuration.
OAuth client ID issued by your identity provider.
OAuth client secret. Keep the file chmod 600.
Must equal your public URL + /api/auth/oidc/callback, character for character, and be registered at the IdP.
Keep profile — Casdoor puts groups/roles/permissions on userinfo only with it.
Claim names to read. Change only if your IdP uses different keys.
Access policy. A user needs at least one match in at least one non-empty list. All empty = any authenticated user may enter.
Create a local user on first SSO login (matched by email). false = only users an admin created beforehand.
Text of the SSO button on the login page.
* required only when oidc.enabled is true.
Self-upgrade watchdog: which service to restart after swapping the binary, and when to roll back.
Service unit name.
user uses systemctl --user (and the macOS LaunchAgent); system for a root-level systemd unit.
Path polled on localhost after a restart. Must start with /.
No healthy answer within this time → the previous binary is restored.
Settings → Usage: which timezone draws the day boundary, and when a conversation gets flagged. Flags only colour the report. guardrails separately schedules a reminder for the user's next message; neither mechanism interrupts a running task.
IANA name (Europe/Berlin, America/New_York), UTC or Local. A typo stops startup. Changing it does not re-bucket old rows.
Flag a conversation whose busiest turn made more model requests than this.
Same, for tool calls.
Flag a conversation that cost more than this in the selected range.
Flag a conversation whose context reached this fraction of the window. Between 0 and 1.
The SQLite database is always <binary dir>/data/database.db.
Provider accounts, models and prices live in the database and are
edited under Providers & models. Users,
account bindings and sandbox exemptions are in the Users page;
IM bots are attached to agents. An old providers:
block in YAML is imported once into an empty database and then
ignored — you can delete it.