DayMug brings AI into a place your whole team can share — your laptop, your phone, your tablet. Together. In sync. Yours to keep. Pour one and pass it around.
AI is amazing when you're alone with it. DayMug makes it amazing when you're not. Bring everyone into the same conversations, pick up where someone else left off, keep your work close at hand.
Give every person their own AI — with its own name, its own job, its own rules about what it can touch. Set up a skill once and the whole team can reach for it — no copy-pasting prompts between teammates.
See the answer arrive as it's being thought of. Two people can watch the same conversation at once. Stop it mid-sentence, change your mind, hand it off to a colleague and pick up later from another device.
Conversations, files, history — they all live on a computer you choose. No tracking, no middleman, no surprise bills. Updates land with one click, and you can go back if something feels off.
Open it in any browser — laptop, phone, tablet, the cafe screen. Nothing to download. The conversation you started on the couch is still right there when you sit down at your desk.
Your conversation on one side, the files being worked on right beside it. Switch between your agents with a click. See what's happening in real time — no need to ask "did you change that yet?"
Setting up takes about five minutes. After that, everyone on your team just opens a page in their browser — there's nothing else to install on the side.
# pop this into the computer you'd like daymug to live on, # then everyone on the team can open it in their browser $ curl -fsSL https://daymug.com/install.sh | bash
DayMug listens on plain HTTP at 127.0.0.1. To let
anyone outside this machine connect, pick one of the three paths
below. The installer prints the same menu, so you can also
decide later — nothing here is locked in.
*-daymug.nows.xyz, TLS at
Cloudflare's edge, no firewall changes.
Use this when you don't own a domain, can't open ports, or just want the fastest path to a public URL.
cloudflared.
# Debian / Ubuntu sudo apt install -y cloudflared # RHEL / Fedora sudo dnf install -y cloudflared # macOS brew install cloudflared
daymug website request \ --alias your-team
DayMug-Admin → Websites.
daymug website startBrowse to
https://your-team-daymug.nows.xyz.
Use this when you already own a domain, you have a public IP (or your own reverse proxy), or your organisation requires a specific cert chain.
sudo apt install -y certbot \ python3-certbot-nginx sudo certbot --nginx \ -d chat.example.comCertbot installs a renewal timer automatically.
/etc/nginx/conf.d/daymug.conf. WebSockets need
the Upgrade headers and a long
proxy_read_timeout:
server {
listen 443 ssl http2;
server_name chat.example.com;
ssl_certificate /etc/letsencrypt/live/…/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/…/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
sudo nginx -t && sudo systemctl reload
nginx
— done.
cloudflared or
daymug website request. The installer prints the
same nginx snippet so you can paste it from the terminal.
Use this when you're evaluating it, you're the only user, or you're inside an office that already has its own VPN.
http://127.0.0.1:8080
server.addr in
~/.daymug/config.yaml from
:8080 to 0.0.0.0:8080, then
restart:
systemctl --user restart \ daymug.service
DayMug reads one YAML file at startup. Copy
docs/config.sample.yaml, change the fields below,
and restart the service when you are done.
DayMug tries --config <path>, then
DAYMUG_CONFIG, then config.yaml next
to the binary.
The file is read once. Restart with
systemctl --user restart daymug.service after a
change.
A usable file needs server.addr,
admin.bootstrap_usernames, and at least one
providers entry named default.
Network address and install identity for this DayMug instance.
HTTP listen address. Use 127.0.0.1:8090 behind
a local reverse proxy, or 0.0.0.0:8080 /
:8080 when exposing directly.
External base URL users open. Notifications use it to build clickable deep links; without it, pushes can still send text but cannot open the conversation.
Stable install UUID reported by heartbeats. The installer writes it; leaving it empty works, but each startup uses a temporary identity.
Browser session lifetime and login method switches.
Login session lifetime in Go duration syntax. The session cookie max-age follows this value.
Adds the Secure flag to the session cookie. Set true for HTTPS deployments.
Enables username and password login. Turn it off when OIDC is the only allowed sign-in path.
Recovery path for administrator access.
Usernames listed here are promoted to admin on every startup. Add yourself and restart if all admins were accidentally removed.
Default filesystem root for user working directories.
New users get <root>/<username> as
their default work directory. ~/ expands to the
service user's home and must resolve to an absolute path.
Credential pools for Claude, Codex, or MiMo. The first entry
is the new-conversation default, and one entry must be named
default.
Unique account name inside the YAML. DayMug requires at
least one provider named default.
Backend type: claude, codex, or
mimo. It decides which CLI adapter runs the
conversation.
Maximum simultaneous conversations for this account. Extra work queues and clients see a one-based queue position.
Credential directory. Claude and MiMo map it to
CLAUDE_CONFIG_DIR and can fall back to
~/.claude; Codex maps it to
CODEX_HOME and must be explicit.
Extra environment variables passed only to the child CLI.
Use field names such as OPENAI_API_KEY or
ANTHROPIC_AUTH_TOKEN; keep real secrets out of
public docs.
Optional chat model IDs advertised for this provider type. The first non-empty list wins, and its first model becomes the default for new conversations.
Optional model for internal summaries: automatic titles and
/compact.
Per-account override for process spawning:
cli pipes stdio, pty wraps the CLI
in a pseudo-terminal.
Global CLI launch mode and silence watchdogs.
Global process mode. cli uses
stdin/stdout/stderr pipes; pty gives CLIs a
terminal-like process, useful for login commands that check
isatty().
How long stdout may be silent before DayMug probes process CPU time and session logs instead of immediately killing the CLI.
Absolute limit for one stdout-silent stretch, even if the activity probe still sees work happening.
Tool names the admin UI can grant to users for Claude runs.
Tool shown in the admin UI and passed to Claude
--allowedTools when selected.
Optional fine-grained allow patterns for a tool, such as limiting Bash to specific command prefixes.
Tool names preselected when an administrator creates a new user. An empty allowed-tools value on a user means no DayMug-side restriction.
Optional per-agent process isolation.
Turns isolation on when paired with a real sandbox type.
enabled: true with type: noop is
normalized back to no isolation.
noop inherits the service user's filesystem
access. bwrap uses Linux bubblewrap and
confines normal users to their work directory.
Only meaningful for bwrap. True keeps host
network access; false starts the jailed process offline.
Extra absolute host paths mounted read-only into every jailed agent, useful for shared reference assets.
Extra absolute host paths mounted read-write into every jailed agent. Keep this narrow because it expands what agents can modify.
Optional Casdoor or generic OpenID Connect single sign-on.
Enables OIDC login. When false, every other OIDC field is ignored.
Identity-provider issuer URL. DayMug discovers
/.well-known/openid-configuration from it.
OAuth client ID issued by the IdP for this DayMug app.
OAuth client secret. Store the real value only in private config, never in public examples or screenshots.
Callback URL registered with the IdP. It must exactly match
the public app URL plus
/api/auth/oidc/callback.
OAuth scopes requested. Keep profile when using
Casdoor so groups, roles, and permissions are available.
Claim name DayMug reads for group membership.
Claim name DayMug reads for role membership.
Claim name DayMug reads for permission membership.
Allowed group values. If any required list is non-empty, a user needs at least one match in one configured dimension.
Allowed role values. Empty means this dimension does not restrict access.
Allowed permission values. With all required lists empty, any authenticated IdP user may enter subject to provisioning.
Creates a local non-admin user on first successful OIDC login when no local user matches the email. False makes OIDC a closed allowlist.
Text shown on the login page SSO button.
Service restart and health-check settings for self-upgrade.
systemd unit name the watchdog restarts after swapping the binary.
user runs systemctl --user;
system runs system-level systemctl.
HTTP path polled after an upgrade. Host and port are derived from the configured listen address.
Maximum time to wait for a healthy response before rolling back to the previous binary.
Timezone used to group token and cost usage by day.
IANA timezone name, UTC, or Local.
It controls the day boundary for usage charts; changing it
does not rewrite older rows.
<binary_dir>/data/database.db; the self-upgrade
manifest URL is hard-coded in the server; per-user provider bindings
live in the database and are managed from the admin UI.
From signing up to your first conversation in about a minute. Nothing to read, nothing to memorise — you'll figure it out as you go.
Choose an agent for the job. Define its role, and decide exactly what it's allowed to touch.
Point each conversation at a folder. Pick a different one next time — every conversation stays in its own lane, with no spill-over between projects.
Type what you want and watch the answer come together. Hand it off to a teammate, or pick it up later from another device — the conversation is waiting where you left it.
Short answers to the things people usually wonder about. If yours isn't here, drop us a line.
AI on its own forgets. DayMug remembers — your conversations, your files, what your team has been working on. It's the difference between asking a stranger and asking a colleague who knows the room.
And because it's a website, you don't need to learn anything new. Open the link, talk to your agent, hand the conversation to a teammate when you're done.
On a computer you choose. DayMug doesn't send anything back to us — no tracking, no analytics, no surprise bills. The only thing that talks to the outside world is the AI itself, the same way it would on your laptop today.
Yes — DayMug works with whatever AI plan you're already on. We don't sell credits or stand between you and your agent. Bring your favourite, hook it up once, and DayMug just adds the friendly room around it.
Yes. If one teammate is using it, the next one waits in a polite line — and they can see how soon they're up. Or give each person their own account if you want stricter separation. Whatever fits.
Yes — open it in your phone's browser and you'll get a layout made for the smaller screen. Catch up from the train, the couch, the queue at a cafe. The conversation is the same one you started on your laptop, just sized for your hand.
Five minutes to set up. Zero minutes to learn. The AI you already know, fresh and friendly — for the whole team.