HTTP listen address. Use 127.0.0.1:8090 behind a local reverse proxy, or 0.0.0.0:8080 / :8080 when exposing directly.

External base URL users open. Notifications use it to build clickable deep links; without it, pushes can still send text but cannot open the conversation.

Stable install UUID reported by heartbeats. The installer writes it; leaving it empty works, but each startup uses a temporary identity.

Login session lifetime in Go duration syntax. The session cookie max-age follows this value.

Adds the Secure flag to the session cookie. Set true for HTTPS deployments.

Enables username and password login. Turn it off when OIDC is the only allowed sign-in path.

Usernames listed here are promoted to admin on every startup. Add yourself and restart if all admins were accidentally removed.

New users get <root>/<username> as their default work directory. ~/ expands to the service user's home and must resolve to an absolute path.

Unique account name inside the YAML. DayMug requires at least one provider named default.

Backend type: claude, codex, or mimo. It decides which CLI adapter runs the conversation.

Maximum simultaneous conversations for this account. Extra work queues and clients see a one-based queue position.

Credential directory. Claude and MiMo map it to CLAUDE_CONFIG_DIR and can fall back to ~/.claude; Codex maps it to CODEX_HOME and must be explicit.

Extra environment variables passed only to the child CLI. Use field names such as OPENAI_API_KEY or ANTHROPIC_AUTH_TOKEN; keep real secrets out of public docs.

Optional chat model IDs advertised for this provider type. The first non-empty list wins, and its first model becomes the default for new conversations.

Optional model for internal summaries: automatic titles and /compact.

Per-account override for process spawning: cli pipes stdio, pty wraps the CLI in a pseudo-terminal.

Global process mode. cli uses stdin/stdout/stderr pipes; pty gives CLIs a terminal-like process, useful for login commands that check isatty().

How long stdout may be silent before DayMug probes process CPU time and session logs instead of immediately killing the CLI.

Absolute limit for one stdout-silent stretch, even if the activity probe still sees work happening.

Tool shown in the admin UI and passed to Claude --allowedTools when selected.

Optional fine-grained allow patterns for a tool, such as limiting Bash to specific command prefixes.

Tool names preselected when an administrator creates a new user. An empty allowed-tools value on a user means no DayMug-side restriction.

Turns isolation on when paired with a real sandbox type. enabled: true with type: noop is normalized back to no isolation.

noop inherits the service user's filesystem access. bwrap uses Linux bubblewrap and confines normal users to their work directory.

Only meaningful for bwrap. True keeps host network access; false starts the jailed process offline.

Extra absolute host paths mounted read-only into every jailed agent, useful for shared reference assets.

Extra absolute host paths mounted read-write into every jailed agent. Keep this narrow because it expands what agents can modify.

Enables OIDC login. When false, every other OIDC field is ignored.

Identity-provider issuer URL. DayMug discovers /.well-known/openid-configuration from it.

OAuth client ID issued by the IdP for this DayMug app.

OAuth client secret. Store the real value only in private config, never in public examples or screenshots.

Callback URL registered with the IdP. It must exactly match the public app URL plus /api/auth/oidc/callback.

OAuth scopes requested. Keep profile when using Casdoor so groups, roles, and permissions are available.

Claim name DayMug reads for group membership.

Claim name DayMug reads for role membership.

Claim name DayMug reads for permission membership.

Allowed group values. If any required list is non-empty, a user needs at least one match in one configured dimension.

Allowed role values. Empty means this dimension does not restrict access.

Allowed permission values. With all required lists empty, any authenticated IdP user may enter subject to provisioning.

Creates a local non-admin user on first successful OIDC login when no local user matches the email. False makes OIDC a closed allowlist.

Text shown on the login page SSO button.

systemd unit name the watchdog restarts after swapping the binary.

user runs systemctl --user; system runs system-level systemctl.

HTTP path polled after an upgrade. Host and port are derived from the configured listen address.

Maximum time to wait for a healthy response before rolling back to the previous binary.

IANA timezone name, UTC, or Local. It controls the day boundary for usage charts; changing it does not rewrite older rows.