# lfg configuration — copy to .env and edit. # # SECURITY: the web UI / API has NO authentication. It is meant to be reached # only over your tailnet (loopback bind + `tailscale serve`), never the public # internet. See the "Security" section of the README. # ---- web server ---- # Bind address. Keep 127.0.0.1 — `tailscale serve` fronts it on your tailnet. # Setting 0.0.0.0 exposes the UNAUTHENTICATED UI to every network the box is on. LFG_HOST=127.0.0.1 LFG_PORT=8766 # Live session updates use one shared WebSocket by default. Set to sse only for # compatibility with a reverse proxy that cannot pass WebSocket upgrades. # LIVE_TRANSPORT=sse # Where you keep the git repos lfg can launch agents into (scanned at runtime). # Defaults to ~/repos. LFG_REPOS_ROOT= # Default single project repo agents act on (git_log / repo_files / actions / # whatsapp). Defaults to the current working directory when unset. LFG_REPO= # Comma-separated roster for optional per-user session tagging (Gravatar avatars # in the UI). Each entry is `email` or `email:displayname` — the optional name is # shown in the UI instead of the raw email. Leave empty for single-user. # e.g. LFG_USERS=ada@example.com:ada,grace@example.com:grace LFG_USERS= # ---- Claude / report backend (used by `lfg agents`) ---- # cli (default) — spawns `claude -p` directly. # ai-sdk — Vercel AI SDK harness (ai-sdk-provider-claude-code) that # drives the same installed `claude` + subscription OAuth. LFG_CLAUDE_BACKEND=cli # Model for the ai-sdk backend: opus | sonnet | haiku | full id (claude-opus-4-8). LFG_CLAUDE_MODEL=opus # Daily coding-harness model discovery. Interpreted in Settings → Scheduling by # default. Defaults to 8:00 every morning. # LFG_MODEL_REFRESH_CRON=0 8 * * * # Optional hard override for model discovery only. # LFG_MODEL_REFRESH_TZ=America/Los_Angeles # Optional override for the claude binary. Defaults to `claude` on PATH. LFG_CLAUDE_PATH= # Optional agent binary overrides. Defaults to each binary on PATH. LFG_CODEX_PATH= LFG_OPENCODE_PATH= LFG_CURSOR_PATH= LFG_HERMES_PATH= LFG_COPILOT_PATH= # Set to 1 to pass --allow-all-tools when spawning Copilot. Off by default # because LFG's agent slice is resource-only, not a filesystem sandbox. LFG_COPILOT_ALLOW_ALL_TOOLS= # Pinned @github/copilot version installed when LFG_INSTALL_COPILOT=1. # Set to `latest` for a floating install. LFG_COPILOT_VERSION= # Optional Hermes provider override. Empty uses Hermes' configured/default provider. LFG_HERMES_PROVIDER= # Pi ships bundled with LFG (@mariozechner/pi-coding-agent). Override only if # you want a different CLI path than the package under node_modules. LFG_PI_PATH= # Optional custom agent profile for the `pi` backend: a directory with # system-prompt.md, a skills/ folder, and a `name` file. Layers extra # system-prompt text, skills, and a display-name override on top of pi's own # defaults. Empty = no customization. See docs/custom-agent-profiles.md. LFG_PI_PROFILE_DIR= # Optional: an API key instead of the interactive `claude` OAuth. ANTHROPIC_API_KEY= # Optional: Sakana Fugu (OpenAI-compatible orchestration model). # Base URL https://api.sakana.ai/v1 ; models: fugu, fugu-ultra. # Used by the opencode `fugu` provider (see ~/.config/opencode/opencode.json). SAKANA_API_KEY= # Optional: repo the security_scan collector audits. Defaults to LFG_REPO / cwd. LFG_SECURITY_REPO= # ---- optional: voice messages (speech-to-text) ---- # Dictation runs through hosted providers, selectable in Settings → Voice (the # choice is stored in data/voice-settings.json; only the *choice* is persisted — # the keys below stay server-side and never reach the browser). A provider is # greyed out in the UI until its key is set. ElevenLabs is the default and the # safe fallback; leave all keys unset to disable dictation. ELEVENLABS_API_KEY= # Optional ElevenLabs overrides (sane defaults otherwise): # ELEVENLABS_STT_MODEL=scribe_v1 OPENAI_API_KEY= # Optional OpenAI overrides: # OPENAI_STT_MODEL=gpt-4o-mini-transcribe # ---- optional: WhatsApp control sidecar (`lfg whatsapp`) ---- # Pair a dedicated number via the QR Baileys prints, then add it to your group. # Use "*" only while discovering group JIDs from logs; then pin the exact # comma-separated JID(s), e.g. 1203630xxxxxxxx@g.us. LFG_WHATSAPP_ALLOWED_GROUPS= LFG_WHATSAPP_AGENT=claude LFG_WHATSAPP_AGENT_CWD= LFG_WHATSAPP_TRIGGER=lfg LFG_WHATSAPP_ALWAYS_ON=false LFG_WHATSAPP_AUTH_DIR= # ---- optional: reach this box through a relay (`lfg connect`) ---- # No relay implementation ships with LFG — point this at an operator-run one. # See `lfg connect help` / README.md's "lfg connect" section. # LFG_RELAY_URL=wss://your-relay.example/connect # ---- optional: internal auto-agent bridges (scripts-internal/, gitignored) ---- # Control-plane read-only SQLite over SSH (cp-sql.sh). Required for DB-triage agents. # TWCLI_CP_SSH=root@your-controlplane-host # TWCLI_CP_DB=/var/lib/docker/volumes/.../controlplane.db # ---- setup-time only (scripts/setup.sh) ---- # Tailscale auth key — used ONCE to join the tailnet, never written to disk. # Pass it on the command line, not in this file: # TS_AUTHKEY=tskey-auth-… lfg setup # ── Runtime UI extensions (optional) ───────────────────────────────────────── # Comma-separated ESM URLs the server injects as