config.example.yaml

# J.A.R.V.I.S. Configuration Example
# Copy to ~/.jarvis/config.yaml and customize

daemon:
  port: 3142
  data_dir: "~/.jarvis"
  db_path: "~/.jarvis/jarvis.db"
  # Canonical public origin: OAuth callbacks, generated links, and the sidecar
  # enrollment JWTs (`brain` + `jwks`). Behind a reverse proxy or for remote
  # sidecars, set this to the externally reachable HTTPS origin — never
  # localhost or a private/container-only hostname. No path, query, or
  # credentials. Env override: JARVIS_PUBLIC_URL="https://jarvis.example.com"
  # (legacy alias: brain_domain / JARVIS_BRAIN_DOMAIN)
  # public_url: "https://jarvis.example.com"
  # Bind a unix domain socket INSTEAD of a TCP port (for a reverse proxy on
  # the same host). When set, nothing listens on TCP. See docs/SELF_HOSTING.md.
  # listen: "unix:/run/jarvis/jarvis.sock"

# IANA timezone for cron triggers and morning/evening routines. Set this when
# the server clock is not your local time (e.g. a UTC-hosted VPS).
# timezone: "Europe/Rome"

# Set local: false on headless servers (no display): the brain never launches
# a local Chromium; browser actions route to a connected sidecar's browser.
# browser:
#   local: false

# The workflow runtime can use READY-MADE artifacts instead of building its
# own: a dir of prebuilt engine bundles (<hash>/main.js), a ready-made pieces
# catalog (usable without installing; your own installs shadow it), and a
# prebuilt piece-metadata cache file. Paths may contain ${version}, expanded
# from the JARVIS_VERSION env var, for machines that keep artifacts per
# installed version. Omit any of them and jarvis does that work itself.
# workflows:
#   engine_dir: /opt/jarvis-engine/${version}
#   pieces_dir: /opt/jarvis-pieces/${version}
#   piece_metadata_cache: /opt/jarvis-cache/${version}/piece-metadata.json

# Authentication — JWT-only by DEFAULT. The dashboard, API, and WebSocket
# require a token from an enrolled device. Correct setup order:
#   1. jarvis enroll "my-desktop"     (prints the device's enrollment token)
#   2. paste the token into the sidecar (desktop app) — it connects and the
#      dashboard is reached through it.
#
# ESCAPE HATCH (first-time setup only): open the dashboard WITHOUT auth.
# Anyone who can reach this machine can then use your Jarvis. The daemon
# logs a loud warning while this is on — remove it as soon as enrollment
# is done.
# auth:
#   insecure_open_access: true

# Anonymous usage metrics (opt-out, enabled by default).
# Sends a tiny anonymous ping at startup and every hour so the project can
# count unique installs and retention. No personal data, config, or content —
# just a hashed machine id, app version, install method, and OS.
# See docs/TELEMETRY.md for exactly what is collected.
# Disable here, or via JARVIS_TELEMETRY=0, or DO_NOT_TRACK=1.
telemetry:
  enabled: true

# ── LLM configuration ──
# There is NO LLM config in this file. Providers, credentials, the single-LLM
# default, and per-tier routing are all configured from the settings dashboard
# (http://localhost:3142, Settings > LLM) and stored in the database +
# encrypted keychain. Any `llm:` block added here is ignored on load and
# stripped on save. Env vars (JARVIS_OPENAI_KEY, etc.) are no longer read for
# LLM config either.

personality:
  core_traits:
    - "loyal"
    - "efficient"
    - "proactive"
    - "respectful"
    - "adaptive"

authority:
  # Default authority level (0-5)
  # 0: No permission (ask for everything)
  # 1: Read-only operations
  # 2: Safe modifications
  # 3: Standard operations (default)
  # 4: System changes
  # 5: Full control
  default_level: 3

# System cron triggers. Each fires `cron.<name>` on the shared event bus.
# Phase 2 will hook the goal system + commitment executor onto these so the
# 15-minute heartbeat poll can be removed. Defaults shown below.
# cron:
#   morning: "0 7 * * *"   # 7am local
#   evening: "0 20 * * *"  # 8pm local
#   hourly:  "37 * * * *"  # every hour at :37

# Text-to-Speech (voice output)
tts:
  enabled: false
  provider: "edge"            # "edge" (free) or "elevenlabs" (API key required)
  voice: "en-US-AriaNeural"  # Microsoft Edge TTS voice
  rate: "+0%"                 # Speaking rate: "-20%" (slow) to "+30%" (fast)
  volume: "+0%"               # Volume adjustment
  # ElevenLabs (uncomment to use)
  # elevenlabs:
  #   api_key: "sk_..."
  #   voice_id: ""             # Leave empty for default voice, or set a specific voice ID
  #   model: "eleven_flash_v2_5"  # "eleven_flash_v2_5" (fast) or "eleven_multilingual_v2" (quality)
  #   stability: 0.5
  #   similarity_boost: 0.75

# Speech-to-Text (voice input)
# stt:
#   provider: "openai"         # openai, groq, or local
#   openai:
#     api_key: "sk-..."

# Active role (must match a filename in roles/ without extension)
active_role: "personal-assistant"