Configuration
How Fosnie is configured – boot settings versus runtime settings.
Fosnie separates configuration into two layers so that day-to-day changes never need a redeploy.
Boot configuration (environment)
Endpoints, secrets, ports, and paths are read once at startup from the environment (and, on bare-metal,
a config file). These use the PAI__ prefix, with __ to nest – for example PAI__DATABASE_URL or
PAI__BYOK__MODE. Changing a boot value means restarting the service.
The full list lives in Configuration & env vars. The essentials are set during Install.
Runtime configuration (admin UI)
Operational settings live in the database and are edited in the app by an admin – no restart:
- Branding – colours, logo, favicon, login welcome message.
- Retrieval defaults – chunk size and overlap, Top-K, over-retrieval.
- Feature toggles – voice, groundedness, web search, MCP, workflows, and others (each ships off by default and is switched on here).
- Retention and tool timeouts.
Change safety
Configuration is stored as typed, validated records – not one opaque blob – and every change is
written to the audit log (config.changed), which in Fosnie is hash-chained for tamper-detection
(Ed25519 tamper-evidence is a Fosnie Enterprise capability). There is deliberately no
"import a whole config" action: each setting is edited explicitly, so a bad paste can't silently
reconfigure the platform.
Some sensitive boot settings (encryption keys, deployment endpoints) are only changeable by a break-glass super-admin, while operational settings are handled by your persistent client-admin. See Admin & teams.