config.toml field reference
The non-secret operator settings in config.toml, by section.
config.toml holds non-secret operator settings; secrets live in
environment variables. The shipped file documents
every field inline - this is the quick reference. Any field can be overridden with
an EDDYTOR__SECTION__KEY env var (see
resolution order).
[server]
| Field | Meaning |
|---|---|
public_url | The HTTPS hostname users hit. Drives cookies, OAuth, and JWKS - must match the real address. |
cookie_domain | Auth cookie domain; set to the apex (e.g. .eddytor.example.com) for cross-subdomain SSO. |
web_redirect_uris | Allowed OAuth redirect URIs (e.g. the Web UI callback). The env override replaces this list. |
oauth_redirect_base | Override when the callback host differs from public_url (rare). |
[server.cors]
| Field | Meaning |
|---|---|
allowed_origins | Allowlist of origin patterns (literal or * globs; every glob needs a literal label after *). |
allow_credentials | Allow credentialed requests. A bare * origin with this true is fatal at boot. |
max_age_secs | Preflight cache duration. |
See CORS.
[engine]
| Field | Meaning |
|---|---|
host | How the server reaches the engine - localhost (dev), service name (Compose), DNS discovery (k8s edition). Plaintext h2c; secure the hop at the network. |
See TLS.
Resolution & reload
EDDYTOR__SECTION__KEYenv override → 2.$EDDYTOR_CONFIG_FILE→ 3../eddytor.toml→ 4./etc/eddytor/config.toml→ 5. defaults. Config is read at boot, not hot-reloaded - restart after editing. See Where config lives.
Good to know
The shipped
config.toml is the authoritative,
fully-commented list. This page covers the fields operators touch most; consult
the file for the complete set.