All docs
Docs · Reference
Chassis runtime
Operator reference for txco serve: personalities, listeners, data on disk, and the flags that matter in production.
Every flag can also be set as an environment variable using the TXCO_ prefix and underscores (--ingress-config ↔ TXCO_INGRESS_CONFIG). --env (default dev) names the environment
and is embedded in database filenames.
Personalities
--personalities selects which heads the chassis boots. Default: cron,tcp,web,admin. Opt-in: lmtp (inbound mail — see lmtp.md) and dns (authoritative DNS for
delegated zones, required for the built-in ACME TLS path — see dns.md).
| Head | Flag | Default | Notes |
|---|---|---|---|
| web | --web-addr | :8080 | Event inlet, plain HTTP. TLS terminates at a front proxy by default. |
| tcp | --tcp-listen-addrs | :5050 | Line-delimited JSON. Comma list of name=addr or bare addr; a named entry sets _txc.tcp.listener for ingress routing. |
| admin | --admin-addr | :8081 | Mutating API + admin UI — see admin-api.md. |
| lmtp | --lmtp-listen-addrs | :2424 | Only binds when lmtp is in --personalities. |
| cron | --cron-period | 60 | Seconds between ticks. |
--web-tls-addr (e.g. :8443) makes the chassis terminate TLS itself,
obtaining wildcard certificates via ACME DNS-01 against its own DNS
head — requires the dns personality and --acme-email. Empty
(default) leaves TLS to your reverse proxy.
Data on disk
All state is local files — back these up.
| Path | What |
|---|---|
./chassis/data/db/runtime-$env.db | Runtime SQLite DB (rules, tenants, hostnames) |
./chassis/data/db/auth-$env.db | Auth SQLite DB (actors, keys, invitations) |
./chassis/data/kv/ | KV store (BoltDB by default) |
./chassis/data/secrets/txco-master.key | Secret-store master key — back up separately; see the secret-store runbook |
./chassis/data/continuations/ | Suspended-run state (--continuation-store=file) |
./chassis/data/artifacts/ | Compute artifacts (wasm modules) |
./data/trace/ | Trace output when --trace-mode ≠ off |
Roots are configurable (--db-root-dir, --kvstore-addrs, --secret-master-key, --trace-dir, …).
Dispatch limits
| Flag | Default | Meaning |
|---|---|---|
--op-timeout | 5s | Per-op timeout when a rule sets none |
--op-timeout-max | 10m | Ceiling for any rule’s WITH timeout |
--op-payload-max | 4194304 | Max op payload, bytes (4 MiB) |
--max-fuel-per-request | 100000 | Fuel budget per request — see fuel.md |
--compute-max-memory-mb | 32 | Memory cap per sandboxed nano-op |
--compute-max-wall | 250ms | Wall-clock cap per nano-op invocation |
Network policy
--egress-policy controls what ops may dial out to: private (default)
blocks loopback, RFC 1918, link-local, CGNAT, cloud-metadata ranges, and
anything in --egress-deny-cidrs; open allows any address. The default
is private so a chassis running tenant-authored ops can’t be steered
into an SSRF against 169.254.169.254 (cloud metadata), the admin API,
or other internal services. Set --egress-policy=open (or whitelist a
specific range with --egress-allow-cidrs) only when your own rules must
reach internal/localhost services. txco dev and start.sh opt into open for local development.
AI gateway
The web head also serves the AI-gateway inlet (POST /v1/messages), which forwards to
an upstream model provider after running the request through the tenant’s _llm stack.
It is per-tenant opt-in — a tenant enables it by authoring an _llm stack, so there is no
enable flag. Full reference: llm-gateway.md.
| Flag | Default | Meaning |
|---|---|---|
--llm-upstream-url | https://api.anthropic.com | Base URL forwarded to; invalid fails at boot |
--llm-context-max-tokens | 2000 | Estimated-token cap on injected context |
--llm-context-max-items | 8 | Item cap on injected context |
Context injection needs both caps positive. Setting either to 0 disables injection
entirely, and stack-emitted items are then dropped with only a debug log.
Routing and tenancy
--ingress-config— path to a staticingress.yaml; empty (default) disables the YAML layer. Hostname bindings in thetenant_hostnamestable work either way — see ingress.md.--ingress-miss-action—fallthrough(default) sends unmatched events to theboot/%/0entry;rejectreturns a clean 404 without invoking the processor. Userejectwhen everything routes viatenant_hostnames.--require-hostname-verification—falseby default; settruein production so unverified hostname bindings don’t route. (--dev-auto-verify-local-hostnames, defaulttrue, auto-verifieslocalhost-style names for development.)
Set --require-hostname-verification=true in production. It’s false by default
(convenient for dev), which means unverified hostname bindings still route — a
tenant could route a hostname it hasn’t proven it owns.
Admin auth
--auth-mode is one of basic, signed, or both (default both); --admin-user / --admin-pass set the basic credentials. With no
basic credentials and no enrolled signing keys, the chassis runs in
open-dev mode (requests get an admin:all context, source: "open")
— local development only. Details and the enrolment flow: admin-api.md.
Observability
--trace-modeoff(default) |summary|full;--trace-dir(default./data/trace);--trace-async(defaultfalse) moves trace writes off the request path — see trace.md.- Prometheus metrics are exported under the
txconamespace (--prom-namespace). --log-ops(defaultdisabled) writes per-op logs to--log-ops-dir.