Configuration Reference

Tascarrel reads host-wide settings from $TASCARREL_HOME/config/server.toml and workspace settings from each workspace’s config.toml and settings.json. Unknown fields are rejected.

Server Configuration

The optional server.toml file uses kebab-case fields and is limited to 64 KiB. Hostd reads it at startup.

[remote-access]
public-origin = "https://tascarrel.example.com"

[authentication]
secret-file = "/run/secrets/tascarrel-auth"

Relative authentication key paths resolve beside server.toml. Restart hostd after changing this file.

Workspace config.toml files use kebab-case fields and are limited to 4 MiB.

Virtual Machine and Features

Configure Tools and Processes

Image ENV values have the lowest precedence, followed by [env], .env, and per-process values. Tascarrel-owned identity and service variables take final precedence.

Secrets

Initial secrets supplied by the workspace creation page are encrypted before the workspace is published. Hostd uses the user’s default id_ed25519 or id_rsa SSH key pair and requires its private-key file to work non-interactively.

Setup and Initialization

Caches and Repositories

Runtime-owned paths and overlapping cache destinations are rejected.

Git Policy

A single * stays within one slash-delimited component; ** crosses components.

Network Policy

Each [[network.secret-injection]] entry supports:

When a host matches one or more injection rules, the host proxy rejects a request unless at least one matching rule lists its method. Only rules listing the request method participate in secret injection.

Portable Interface Settings

The host-owned settings.json file contains portable interface preferences and the Tasci model catalog. It uses camelCase names and can be edited through Workspace → Settings.

Harness Model Preferences

The optional chat.harnesses object has codex and claudeCode entries. Each entry supports:

Tasci Endpoints and Models

Tasci is bundled with Tascarrel. Its chat.tasci settings map workspace-local model aliases to OpenAI-compatible Chat Completions endpoints:

{
  "chat": {
    "tasci": {
      "defaultModel": "development",
      "endpoints": {
        "local": {
          "protocol": "OpenAiChatCompletions",
          "baseUrl": "http://host.tascarrel.internal:18080/v1"
        }
      },
      "models": {
        "development": {
          "endpoint": "local",
          "model": "provider-model-id",
          "displayName": "Development Model",
          "toolCalls": true
        }
      }
    }
  }
}

An endpoint supports:

The token stays out of settings.json; authorization refers to a configured secret:

{
  "header": "Authorization",
  "prefix": "Bearer ",
  "credential": {
    "provider": "project",
    "secret": "MODEL_API_TOKEN"
  }
}

Tascarrel resolves that secret only for a selected Tasci session and delivers the complete header to its private pod process.

A model supports:

pricing contains catalogVersion, a positive tokenCount, required input and output monetary amounts, and optional cacheReadInput and cacheWriteInput amounts. Each amount has an ISO 4217 currency and an integer amount in that currency’s minor unit.