1
# -- DATA CONFIGURATION --
2
# Root directory for user data storage
3
dataRoot: ./data
4
# -- SERVER CONFIGURATION --
5
# Listen for incoming connections
6
listen: false
7
# Listen on a specific address, supports IPv4 and IPv6
8
listenAddress:
9
  ipv4: 0.0.0.0
10
  ipv6: '[::]'
11
# Enables IPv6 and/or IPv4 protocols. Need to have at least one enabled!
12
# - Use option "auto" to automatically detect support
13
# - Use true or false (no qoutes) to enable or disable each protocol
14
protocol:
15
    ipv4: true
16
    ipv6: false
17
# Prefers IPv6 for DNS. Enable this on ISPs that don't have issues with IPv6
18
dnsPreferIPv6: false
19
# -- BROWSER LAUNCH CONFIGURATION --
20
browserLaunch:
21
  # Open the browser automatically on server startup.
22
  enabled: true
23
  # Browser to use for opening the URL.
24
  # NOT SUPPORTED ON ANDROID DEVICES.
25
  # - Use "default" to use the system default browser
26
  # - Use "firefox", "chrome", "edge"
27
  browser: 'default'
28
  # Overrides the hostname that opens in the browser.
29
  # - Use "auto" to let the server decide
30
  # - Use options like 'localhost', 'st.example.com'
31
  hostname: 'auto'
32
  # Overrides the port for run in the browser.
33
  # - Use -1 to use the server port.
34
  # - Specify a port to override the default.
35
  port: -1
36
  # Avoids using 'localhost' as the hostname in auto mode.
37
  # Use if you don't have 'localhost' in your hosts file
38
  avoidLocalhost: false
39
# Server port
40
port: 8000
41
# Interval in seconds to write a heartbeat file. Set to 0 to disable.
42
# This is used primarily for Docker healthchecks.
43
heartbeatInterval: 0
44
# Enable HTTP/HTTPS keep-alive globally.
45
# Disabling restores old Node 18 behavior, can help if ECONNRESET and other network errors occur.
46
enableKeepAlive: false
47
# -- SSL options --
48
ssl:
49
  # Enable SSL/TLS encryption
50
  enabled: false
51
  # Path to certificate (relative to server root)
52
  certPath: "./certs/cert.pem"
53
  # Path to private key (relative to server root)
54
  keyPath: "./certs/privkey.pem"
55
  # Private key passphrase (leave empty if not needed)
56
  # For better security, use a CLI argument or an environment variable (SILLYTAVERN_SSL_KEYPASSPHRASE)
57
  keyPassphrase: ""
58
# -- SECURITY CONFIGURATION --
59
# Toggle whitelist mode
60
whitelistMode: true
61
# When enabled, whitelist will also verify IP in headers enabled in `forwardedHeaders` section.
62
enableForwardedWhitelist: true
63
# Whitelist of allowed IP addresses
64
whitelist:
65
  - ::1
66
  - 127.0.0.1
67
# Automatically whitelist Docker host and gateway IPs
68
whitelistDockerHosts: true
69
# Toggle basic authentication for endpoints
70
basicAuthMode: false
71
# Basic authentication credentials
72
basicAuthUser:
73
  username: "user"
74
  password: "password"
75
# Enables CORS proxy middleware
76
enableCorsProxy: false
77
# CORS settings (applied to all routes)
78
cors:
79
  # Enable or disable CORS middleware
80
  enabled: true
81
  # Allowed origins. Use "null" to match the default browser file origin.
82
  # You can set "*" to allow any origin, or a list of allowed origins.
83
  origin:
84
    - "null"
85
  # Allowed methods
86
  methods:
87
    - "OPTIONS"
88
  # Allowed request headers (optional)
89
  allowedHeaders: []
90
  # Exposed response headers (optional)
91
  exposedHeaders: []
92
  # Allow credentials (cookies, authorization headers)
93
  credentials: false
94
  # Preflight cache max age in seconds (optional)
95
  maxAge: null
96
# -- REQUEST PROXY CONFIGURATION --
97
requestProxy:
98
  # If a proxy is enabled, all outgoing HTTP/HTTPS requests will be routed through it.
99
  enabled: false
100
  # Proxy URL. Possible protocols: http, https, socks, socks5, socks4, pac
101
  url: "socks5://username:password@example.com:1080"
102
  # Proxy bypass list. Requests to these hosts won't be routed through the proxy.
103
  bypass:
104
    - localhost
105
    - 127.0.0.1
106
# Enable multi-user mode
107
enableUserAccounts: false
108
# Enable discreet login mode: hides user list on the login screen
109
enableDiscreetLogin: false
110
# If `basicAuthMode` and this are enabled then
111
# the username and passwords for basic auth are the same as those
112
# for the individual accounts
113
perUserBasicAuth: false
114

115
# -- SSO LOGIN CONFIGURATION --
116
sso:
117
  # Enable's authlia based auto login. Only enable this if you
118
  # have setup and installed Authelia as a middle-ware on your
119
  # reverse proxy
120
  # https://www.authelia.com/
121
  # This will use auto login to an account with the same username
122
  # as that used for authlia. (Ensure the username in authlia
123
  # is an exact match in lowercase with that in sillytavern)
124
  autheliaAuth: false
125
  # Enable's authentik based auto login. Only enable this if you
126
  # have setup and installed Authentik as a middle-ware on your
127
  # reverse proxy.
128
  # https://goauthentik.io/
129
  # This will use auto login to an account with the same username
130
  # as that used for authentik. (Ensure the username in authentik
131
  # is an exact match in lowercase with that in sillytavern).
132
  authentikAuth: false
133
  # List of trusted proxy IPs for SSO authentication.
134
  # Supports wildcards or CIDR notation for subnets.
135
  # Example: ['127.0.0.1', '192.168.1.1']
136
  # Set to ['*'] to trust all proxies (NOT RECOMMENDED unless you have other security measures in place)
137
  trustedProxies:
138
    - ::1
139
    - 127.0.0.1
140

141
# Host whitelist configuration. Recommended if you're using a listen mode
142
hostWhitelist:
143
  # Enable or disable host whitelisting
144
  enabled: false
145
  # Scan incoming requests for potential host header spoofing
146
  scan: true
147
  # List of allowed hosts. Do not include localhost or IPs, these are safe.
148
  # Use a dot to create subdomain patterns.
149
  # Examples:
150
  # - example.com
151
  # - .trycloudflare.com
152
  hosts: []
153

154
# Perform whitelist checks against server-side HTTP requests that resolve to private IP addresses.
155
# This is an additional layer of security to prevent Server-Side Request Forgery (SSRF) attacks.
156
# Recommended when listen mode is enabled, or if your server is accessible by untrusted users.
157
privateAddressWhitelist:
158
  # Enable private address whitelist to block requests to private IP ranges.
159
  enabled: false
160
  # If true, requests to hosts that cannot be resolved will be allowed instead of blocked.
161
  allowUnresolvedHosts: false
162
  # Log blocked and allowed requests to the console.
163
  log:
164
    # Log blocked requests to the console with a warning message
165
    blockedRequests: true
166
    # Log allowed requests to the console with an info message
167
    allowedRequests: false
168
  # List of allowed private IP ranges (in CIDR notation or wildcard format).
169
  # Allows loopback IP ranges by default, but you can customize this list to fit your needs.
170
  allowedRanges:
171
    - '127.0.0.0/8'      # Loopback (IPv4)
172
    - '::1/128'          # Loopback (IPv6)
173

174
# User session timeout *in seconds* (defaults to 24 hours).
175
## Set to a positive number to expire session after a certain time of inactivity
176
## Set to 0 to expire session when the browser is closed
177
## Set to a negative number to disable session expiration
178
sessionTimeout: -1
179
# Disable CSRF protection - NOT RECOMMENDED
180
disableCsrfProtection: false
181
# Disable startup security checks - NOT RECOMMENDED
182
securityOverride: false
183
# -- LOGGING CONFIGURATION --
184
logging:
185
  # Enable access logging to access.log file and console output
186
  # Records new connections with timestamp, IP address and user agent
187
  enableAccessLog: true
188
  # Minimum log level to display in the terminal (DEBUG = 0, INFO = 1, WARN = 2, ERROR = 3)
189
  minLogLevel: 0
190
# -- RATE LIMITING CONFIGURATION --
191
rateLimiting:
192
  # Use any of the enabled headers in the `forwardedHeaders` section to identify the client IP for rate limiting.
193
  # If disabled, only the socket IP will be used, which may not work correctly if you are behind a reverse proxy.
194
  preferRealIpHeader: false
195
  # Set the maximum number of allowed failed basic authentication attempts before rate limiting is applied. Set to 0 to disable rate limiting for basic auth.
196
  basicAuthMaxAttempts: 5
197
  # Set the maximum number of allowed failed account login attempts before rate limiting is applied. Set to 0 to disable rate limiting for account logins.
198
  accountsLoginMaxAttempts: 5
199
  # Set the maximum number of allowed failed account recovery attempts before rate limiting is applied. Set to 0 to disable rate limiting for account recovery.
200
  accountsRecoverMaxAttempts: 5
201
# Set to true to enable support for real IPs in certain request headers for features like IP whitelisting, rate limiting and access logging.
202
# Only change if you are sure that you use a correctly configured reverse proxy, otherwise this may lead to IP spoofing.
203
forwardedHeaders:
204
  # X-Real-IP header (common with Nginx and Caddy)
205
  xRealIp: true
206
  # X-Forwarded-For header (common with many proxies, but may contain multiple IPs - only the first one will be used)
207
  xForwardedFor: true
208
  # CF-Connecting-IP header (used by Cloudflare Tunnels)
209
  cfConnectingIp: false
210

211
## BACKUP CONFIGURATION
212
backups:
213
  # Allow users to create a full backup archive of their data
214
  allowFullDataBackup: true
215
  # Common settings for all backup types
216
  common:
217
    # Number of backups to keep for each chat and settings file
218
    numberOfBackups: 50
219
  chat:
220
    # Enable automatic chat backups
221
    enabled: true
222
    # Verify integrity of chat files before saving
223
    checkIntegrity: true
224
    # Maximum number of chat backups to keep per user (starting from the most recent). Set to -1 to keep all backups.
225
    maxTotalBackups: -1
226
    # Interval in milliseconds to throttle chat backups per user
227
    throttleInterval: 10000
228

229
# THUMBNAILING CONFIGURATION
230
thumbnails:
231
  # Enable thumbnail generation
232
  enabled: true
233
  # Image format of avatar thumbnails:
234
  # * "jpg": best compression with adjustable quality, no transparency
235
  # * "png": preserves transparency but increases filesize by about 100%
236
  # Changing this only affects new thumbnails. To recreate the old ones, clear out /thumbnails folder in your user data.
237
  format: "jpg"
238
  # JPG thumbnail quality (0-100)
239
  quality: 95
240
  # Maximum thumbnail dimensions per type [width, height]
241
  dimensions: { 'bg': [160, 90], 'avatar': [96, 144], 'persona': [96, 144] }
242

243
# PERFORMANCE-RELATED CONFIGURATION
244
performance:
245
  # Enables lazy loading of character cards. Improves performances with large card libraries.
246
  # May have compatibility issues with some extensions.
247
  lazyLoadCharacters: false
248
  # The maximum amount of memory that parsed character cards can use. Set to 0 to disable memory caching.
249
  memoryCacheCapacity: '100mb'
250
  # Enables disk caching for character cards. Improves performances with large card libraries.
251
  useDiskCache: true
252
  # Configures gzip compression for client requests with large payloads (e.g. settings or chat saves).
253
  requestCompression:
254
    # Enable request compression.
255
    enabled: false
256
    # Minimum payload size to trigger compression. Set to 0 to compress all requests regardless of size.
257
    minPayloadSize: '256kb'
258
    # Hard upper payload size limit for compression. Set to 0 to allow compression of any size.
259
    maxPayloadSize: '8mb'
260
    # Timeout for request compression in milliseconds.
261
    timeout: 4000
262

263
# CACHE BUSTER CONFIGURATION
264
# IMPORTANT: Requires localhost or a domain with HTTPS, otherwise will not work!
265
cacheBuster:
266
  # Clear browser cache on first load or after uploading image files
267
  enabled: false
268
  # Only clear cache for the specified user agent regex pattern
269
  # Example: 'firefox|safari' (case-insensitive)
270
  userAgentPattern: ''
271

272
# Allow secret keys exposure via API
273
allowKeysExposure: false
274
# Skip new default content checks
275
skipContentCheck: false
276
# Allowed hosts for card downloads
277
whitelistImportDomains:
278
  - localhost
279
  - cdn.discordapp.com
280
  - files.catbox.moe
281
  - raw.githubusercontent.com
282
# API request overrides (for KoboldAI and Text Completion APIs)
283
## Note: host includes the port number if it's not the default (80 or 443)
284
## Format is an array of objects:
285
## - hosts:
286
##   - example.com
287
##   headers:
288
##     Content-Type: application/json
289
##   - 127.0.0.1:5001
290
##   headers:
291
##     User-Agent: "Googlebot/2.1 (+http://www.google.com/bot.html)"
292
requestOverrides: []
293

294
# EXTENSIONS CONFIGURATION
295
extensions:
296
  # Enable UI extensions
297
  enabled: true
298
  # Automatically update extensions when a release version changes
299
  autoUpdate: true
300
  models:
301
    # Enables automatic model download from HuggingFace
302
    autoDownload: true
303
    # Additional models for extensions. Expects model IDs from HuggingFace model hub in ONNX format
304
    classification: Cohee/distilbert-base-uncased-go-emotions-onnx
305
    captioning: Xenova/vit-gpt2-image-captioning
306
    embedding: Cohee/jina-embeddings-v2-base-en
307
    speechToText: Xenova/whisper-small
308
    textToSpeech: Xenova/speecht5_tts
309

310
# Git backend for plugin/extension repository operations.
311
# - Use "auto" to prefer system git, falling back to the integrated backend
312
# - Use "system" to force system backend
313
# - Use "builtin" to force integrated backend
314
git:
315
  backend: auto
316

317
# Additional model tokenizers can be downloaded on demand.
318
# Disabling will fallback to another locally available tokenizer.
319
enableDownloadableTokenizers: true
320
# -- OPENAI CONFIGURATION --
321
# A placeholder message to use in strict prompt post-processing mode when the prompt doesn't start with a user message
322
promptPlaceholder: "[Start a new chat]"
323
openai:
324
  # Will send a random user ID to OpenAI completion API
325
  randomizeUserId: false
326
  # If not empty, will add this as a system message to the start of every caption completion prompt
327
  # Example: "Perform the instructions to the best of your ability.\n" (for LLaVA)
328
  # Not used in image inlining mode
329
  captionSystemPrompt: ""
330
# -- DEEPL TRANSLATION CONFIGURATION --
331
deepl:
332
  # Available options: default, more, less, prefer_more, prefer_less
333
  formality: default
334
# -- MISTRAL API CONFIGURATION --
335
mistral:
336
  # Enables prefilling of the reply with the last assistant message in the prompt
337
  # CAUTION: The prefix is echoed into the completion. You may want to use regex to trim it out.
338
  enablePrefix: false
339
# -- OLLAMA API CONFIGURATION --
340
ollama:
341
  # Controls how long the model will stay loaded into memory following the request
342
  # * -1: Keep the model loaded indefinitely
343
  # * 0: Unload the model immediately after the request
344
  # * N (any positive number): Keep the model loaded for N seconds after the request.
345
  keepAlive: -1
346
  # Controls the "num_batch" (batch size) parameter of the generation request
347
  # * -1: Use the default value of the model
348
  # * N (positive number): Use the specified value. Must be a power of 2, e.g. 128, 256, 512, etc.
349
  batchSize: -1
350
# -- ANTHROPIC CLAUDE API CONFIGURATION --
351
claude:
352
  # Enables caching of the system prompt (if supported).
353
  # https://platform.claude.com/docs/en/build-with-claude/prompt-caching
354
  # -- IMPORTANT! --
355
  # Use only when the prompt before the chat history is static and doesn't change between requests
356
  # (e.g {{random}} macro or lorebooks not as in-chat injections).
357
  # Otherwise, you'll just waste money on cache misses.
358
  enableSystemPromptCache: false
359
  # Enables caching of the message history at depth (if supported).
360
  # https://platform.claude.com/docs/en/build-with-claude/prompt-caching
361
  # -- IMPORTANT! --
362
  # Use with caution. Behavior may be unpredictable and no guarantees can or will be made.
363
  # Set to an integer to specify the desired depth. 0 (which does NOT include the prefill)
364
  # should be ideal for most use cases.
365
  # Any value other than a non-negative integer will be ignored and caching at depth will not be enabled.
366
  cachingAtDepth: -1
367
  # Use 1h TTL instead of the default 5m.
368
  ## 5m: base price x 1.25
369
  ## 1h: base price x 2
370
  extendedTTL: false
371
  # Enables adaptive thinking for supported models (Opus 4.6+).
372
  # Disable to enforce legacy thinking mode (with thinking budget).
373
  # https://platform.claude.com/docs/en/build-with-claude/adaptive-thinking
374
  enableAdaptiveThinking: false
375
# -- GOOGLE GEMINI API CONFIGURATION --
376
gemini:
377
  # API endpoint version ("v1beta" or "v1alpha")
378
  apiVersion: 'v1beta'
379
  # Adds thought signatures to requests (if available). Only for Gemini 3 and above.
380
  thoughtSignatures: true
381
  # Enables caching of the system prompt (if supported). Only for OpenRouter.
382
  # -- IMPORTANT! --
383
  # Use only when the prompt before the chat history is static and doesn't change between requests
384
  # (e.g {{random}} macro or lorebooks not as in-chat injections).
385
  # Otherwise, you'll just waste money on cache misses.
386
  enableSystemPromptCache: false
387
  # https://ai.google.dev/gemini-api/docs/imagen#imagen-configuration
388
  image:
389
    # Leave empty to use the API-default value.
390
    personGeneration: 'allow_adult'
391
# -- SERVER PLUGIN CONFIGURATION --
392
enableServerPlugins: false
393
# Attempt to automatically update server plugins on startup
394
enableServerPluginsAutoUpdate: true