[server]

The local HTTP API and dashboard - bind address, native TLS, idle shutdown and the four rate-limit buckets.

The daemon's HTTP server. It binds 127.0.0.1:3141 and serves both the dashboard and the API that grith exec talks to over loopback.

Key	Default	What it does
`enabled`	`true`	Turn the server off. `grith exec` needs it and refuses to start a session without it.
`host`	`"127.0.0.1"`	Bind address.
`port`	`3141`	Bind port. `0` is a fatal validation error.
`dashboard_dir`	`"dashboard/dist"`	On-disk dashboard build to serve instead of the copy baked into the binary. Ignored unless the path exists and holds an `index.html`.
`idle_shutdown_seconds`	`30`	Seconds after the last session exits before an auto-started daemon shuts down. `0` disables it.
`auto_open_dashboard`	`true`	Open the dashboard in a browser on startup.

idle_shutdown_seconds applies to daemons that grith exec started for you. An explicit grith daemon start disables idle shutdown regardless.

TLS

[server.tls] is real native TLS. Point it at a certificate and key and the daemon serves HTTPS.

toml

[server]
host = "0.0.0.0"

[server.tls]
cert_path = "/etc/grith/cert.pem"
key_path = "/etc/grith/key.pem"

Both keys or neither - the section is all-or-nothing and a partial one fails to parse:

terminal

$ grith --config tls.toml config
Error: configuration error: failed to parse tls.toml: TOML parse error at line 4, column 1
|
4 | [server.tls]
| ^^^^^^^^^^^^
missing field `key_path`

Binding a non-loopback address without TLS starts, but logs a security warning: everything, including tokens, crosses the network in plain text. A TLS-terminating reverse proxy is a valid alternative if you already run one - see Reverse proxy and TLS - but it is an alternative, not the only path.

Rate limits

Four buckets, each a limit on the whole server rather than per client. Over the limit is a 429 with a Retry-After header and a RATE_LIMITED body.

Key	Default	Covers
`enabled`	`true`	The limiter as a whole.
`general_rps`	`100`	Read endpoints.
`write_rps`	`10`	Writes.
`proxy_test_rps`	`20`	`POST /api/proxy/test` - cheap to call, runs the full pipeline.
`ipc_rps`	`10000`	Daemon IPC, the bucket `grith exec` uses. Do not lower it.

Any of the four rates set to 0 while the limiter is enabled is a fatal validation error.

toml

[server.rate_limit]
general_rps = 200
write_rps = 20

Dashboard access

auto_open_dashboard opens the dashboard on daemon start, handing the token off through the URL fragment so it never appears in the terminal. It is skipped automatically on headless and SSH sessions, where the CLI prints a single-use pairing link instead.

To disable it for one run, the environment override must be spelled true or false - a bare 0 is silently ignored. See Environment variables.

terminal

$ GRITH_AUTO_OPEN_DASHBOARD=false grith daemon start

The dashboard is token-authenticated even on loopback. grith daemon and grith dashboard are the same command.

[server]

TLS

Rate limits

Dashboard access

See also