Server Settings
Change a server's model gateway, limits, sandbox defaults, credentials and variables from the Mac app, with the same tabs as the app's own Settings.
Select a server in the sidebar to open its Server Settings. The tabs are the same as the app's own Settings window: General, Credentials, Model Gateway, Environment, Limits, Sandbox and About. Anyone signed in can look; only admins can change things, and every save needs a code from the admin's authenticator.
How changes are stored#
Changes made here are kept in the server's private overlay (data_dir/secrets/remote.json, mode 0600) on top of harnessd.yaml and secrets.env. The server never rewrites those files.
Each section shows where its values come from:
- From harnessd.yaml on the server. Saving here overrides it without editing the file.
- Changed from SI Fabrik; harnessd.yaml's values are kept underneath, with a Use harnessd.yaml button that returns the section to the file's values.
Save with a code#
- Edit the tab
Change the fields. Secret fields start empty, because the server never sends values back; their placeholder says whether the server has one (set on the server — type to replace, or not set).
- Press Save
The app checks the change first and shows any problem the server would refuse, without asking for a code.
- Enter the code
Type the 6-digit code from your authenticator. One code covers the whole Save, including the secrets in it. The change is audited, by section and variable name.
After a save, every project on the server reloads, so new credentials and variables apply without a restart.
The tabs#
General#
Read-only facts about the server:
- harnessd API: the address, connection status, TLS (TLS 1.3, certificate pinned, or Off (loopback behind a proxy)) and the pinned Certificate SHA-256.
- MCP tool server for agents: the
tools_listenaddress. On Linux it should be the Docker bridge, for example172.17.0.1:7879; on a Mac with Docker Desktop,127.0.0.1. - Account: who you're signed in as and your role, the number of accounts, whether an authenticator is required for admins, the session lifetimes, and Sign Out. Accounts are managed on the server with
harnessd user. - Server: the number of projects and whether Docker is running.
Credentials#
The Anthropic API key, Claude Code OAuth token and OpenAI API key, as write-only fields. The server has a Claude credential shows when one is set. Only admins can see or change them.
Model Gateway#
The same form as on the Mac: default routing, base URL, the write-only key (saved as HARNESS_GATEWAY_API_KEY), auth header, model slots, wire API and the advanced toggles. Test Connection runs from the server, where the agents reach the gateway, using the key you typed or else the saved one: The server connected in N ms · M models.
Environment#
Server-wide variables for $VAR references and hooks, with their source. Type a value to replace one; new rows need a name. Removing a variable set from the app falls back to secrets.env's value.
Limits#
Max agents running at once, Daily budget and Daily token budget across all of the server's projects, and today's spend per project.
Sandbox#
The hosts every sandbox may reach, the Cloudflare Bridge URL and the write-only Bridge token (saved as HARNESS_CLOUDFLARE_TOKEN). Test Connection runs from the server with its saved token, so save a new token first.
About#
The app version, and which harnessd you're connected to.
Validation#
The server refuses a change, with the reason, when:
| Field | Rule |
|---|---|
| Gateway base URL | An http(s) URL without credentials |
| Auth header | bearer or x-api-key |
| Codex wire API | responses or chat |
| Model names | One line, up to 200 characters |
| Agents at once | 1 to 50 |
| Daily budget | More than $0, up to $1,000,000 |
| Daily token budget | Positive |
| Allowed hosts | Valid patterns, at most 500 |
| Bridge URL | An https URL |
| Variables | Valid names; one-line values up to 16 KB |