Config reference

The donmai daemon is configured via ~/.donmai/daemon.yaml (YAML format). Run donmai host setup to generate an initial file interactively, or create the file manually using the schema described below.

The authoritative Go struct is daemon/config.go.

Top-level fields

Key	Type	Required	Default	Description
`apiVersion`	string	no	`donmai.dev/v1`	Schema version.
`kind`	string	no	`LocalDaemon`	Resource kind. Must be `LocalDaemon`.
`machine`	object	yes	-	Machine identity block.
`capacity`	object	yes	see below	Resource envelope.
`orchestrator`	object	yes	-	Orchestrator URL and auth token.
`projects`	array	no	`[]`	Allowlisted project definitions.
`autoUpdate`	object	no	see below	Auto-update preferences.
`observability`	object	no	-	Log and metrics tuning.
`workarea`	object	no	see below	Workarea surface settings.
`kit`	object	no	see below	Kit scan path settings.
`trust`	object	no	see below	Signature-verification policy.

`machine`

Key	Type	Required	Description
`id`	string	yes	Unique identifier for this machine. Used in session attribution and logs.
`region`	string	no	Optional region hint (e.g. `us-west-2`). Informational only.

`capacity`

Key	Type	Default	Description
`maxConcurrentSessions`	int	`8`	Maximum number of agent sessions that may run in parallel on this daemon.
`maxVCpuPerSession`	int	`4`	vCPU budget granted to each session.
`maxMemoryMbPerSession`	int	`8192`	Memory budget (MiB) granted to each session.
`reservedForSystem.vCpu`	int	`4`	vCPUs reserved for the host OS and daemon process.
`reservedForSystem.memoryMb`	int	`16384`	Memory (MiB) reserved for the host OS.
`poolMaxDiskGb`	int	`0`	Trigger LRU eviction of the workarea pool when total disk usage (GiB) exceeds this. `0` means no limit.

`orchestrator`

Key	Type	Required	Description
`url`	string	yes	Base URL of the orchestrator (e.g. `https://platform.donmai.dev`).
`authToken`	string	no	Bearer token used to authenticate with the orchestrator. Supports `${ENV_VAR}` substitution. Can also be set via the `DONMAI_DAEMON_TOKEN` environment variable.

orchestrator.url is required. Solo installs that pick the setup wizard's local file queue (single-user) option get a file:// queue path here instead of a remote URL; no auth token is needed on that path.

`projects`

Each entry in the projects array declares a repository that this daemon is allowed to run sessions for.

Key	Type	Required	Description
`id`	string	yes	Project identifier (matches the orchestrator project ID).
`repository`	string	yes	Git remote URL or URL pattern for this project.
`cloneStrategy`	string	no	One of `shallow` (default), `full`, or `reference`.
`git.credentialHelper`	string	no	Git credential helper override for this project.
`git.sshKey`	string	no	Path to the SSH key to use when cloning.

Example:

projects:
  - id: my-project-id
    repository: github.com/myorg/myrepo
    cloneStrategy: shallow

`autoUpdate`

Key	Type	Default	Description
`channel`	string	`stable`	Update channel. One of `stable`, `beta`, or `main`.
`schedule`	string	`nightly`	When to apply updates. One of `nightly`, `on-release`, or `manual`.
`drainTimeoutSeconds`	int	`600`	How long (seconds) to wait for sessions to drain before applying an update.

`observability`

Key	Type	Default	Description
`logFormat`	string	-	Log output format. One of `json` or `text`.
`logPath`	string	-	Override for the daemon log file path.
`metricsPort`	int	-	Port to expose Prometheus-compatible metrics. Omit to disable.

`workarea`

Key	Type	Default	Description
`archiveRoot`	string	`~/.donmai/workareas`	Directory the daemon scans for archived workareas.
`diffStreamingThreshold`	int	`1000`	Entry count above which the diff endpoint switches to NDJSON streaming.

`kit`

Key	Type	Default	Description
`scanPaths`	string[]	`[~/.donmai/kits]`	Ordered list of directories the kit registry walks to discover installed kits. Leading `~/` is expanded to the user home directory.

`trust`

Key	Type	Default	Description
`mode`	string	`signed-by-allowlist`	Signature-verification policy. One of `permissive`, `signed-by-allowlist`, or `attested`.

The compiled-in default is signed-by-allowlist: kits must be signed by an allowlisted identity or the install is rejected. When trust.mode is absent, DONMAI_KIT_TRUST_MODE can select signed-by-allowlist or attested; permissive in the environment leaves the default in force and logs a warning. An explicit YAML trust.mode takes precedence over the environment.

To allow an unsigned kit once, run donmai kit install <id> --allow-unsigned; the override is audit-logged. To disable the gate globally, set trust.mode: permissive explicitly in daemon.yaml (not recommended: unsigned kits can execute shell commands).

Minimal example

apiVersion: donmai.dev/v1
kind: LocalDaemon

machine:
  id: my-macbook

orchestrator:
  url: https://platform.donmai.dev
  authToken: ${DONMAI_DAEMON_TOKEN}

capacity:
  maxConcurrentSessions: 4

projects:
  - id: my-project-id
    repository: github.com/myorg/myrepo

Config reference

On this page