Configuration
Erebros keeps its configuration in a few well-known places. All of them live on your machine.
.env.local
Section titled “.env.local”Provider credentials and runtime switches, in the project root. It is gitignored and never included in a release zip. Read only at startup — restart after editing, or edit through Settings → Secrets, which writes the same file and applies at once.
Only set the keys you use; each provider turns on when its key is present. The commonly used ones:
KIMI_API_KEY= # Kimi engine (platform.moonshot.ai)ZAI_API_KEY= # Z.AI GLM engine (set from the Chat account panel)QWEN_CLOUD_KEY= # Qwen + DeepSeek on the Alibaba Model Studio planOPENAI_API_KEY= # Codex fallback, infographicsOMNIROUTE_API_KEY= # OmniRoute gatewayOPENROUTER_API_KEY= # PROVIDERS — any one of the three is enoughFREEINFERENCE_API_KEY=TOKENROUTER_API_KEY=FAL_KEY= # image/video engines (Thumbnails, S-Forge, OpenMontage)KIE_API_KEY= # second image/video providerMAGNIFIC_API_KEY= # X-ForgeSUNO_API_KEY= # M-Forge → MusicELEVENLABS_API_KEY= # paid narration / dubbing (free Supertonic needs nothing)GEMINI_API_KEY= # Google TTS / infographicsTAVILY_API_KEY= # R-Forge, N-Forge web search, Ad ScoutFIRECRAWL_API_KEY=MESHY_API_KEY= # G-Forge (test mode without it)HF_TOKEN= # M-Forge cloud watermark removalGITHUB_EREBROS_UPDATE= # read token for the in-app updater (private repo)Claude, Grok, Codex, Antigravity, Qwen Code, Hermes, OpenClaw, OpenCode, Ollama and Open Design need no key here — each uses its own login.
EREBROS_VAULT_DIR— the Obsidian folder where chats, goals and journal entries append, one markdown file per day. Point it at any writable folder if you do not use Obsidian. The vault root is its parent:~/Obsidian/Erebrosby default, withMemories/,Notebooks/,Pipeline/,Room/and one folder per Forge app.EREBROS_VAULT_BROWSE_ROOT— what the Memory app reads (search + graph) across all your vaults; defaults to~/Obsidian. Read-only.~/.erebros— runtime state, created automatically and never shipped:settings.json(global model, per-app config),chat/history,jobs/logs, per-app engines and venvs, the remote-access PIN, update bookkeeping.
agents.config.json
Section titled “agents.config.json”The CLI-agent fleet: one entry per agent (id, name, command, args with
{prompt}, colour, glyph, skills wiring). It is re-read on refresh — no restart — and
the updater never overwrites it. Any new CLI agent gets the skills.sh picker
(skillsShAgent + skillsDir); Hermes is the exception and uses its own registry.
Settings
Section titled “Settings”The gear in the sidebar footer opens Settings — a left rail plus search:
- Updates — check now, the two daily check hours, auto-update on/off. See Updating.
- Model routing — skip providers that just failed and fall back to another model, both off by default.
- Secrets — every key, masked; add, rotate or remove without touching the file.
- Security — the remote-access PIN, allowed hosts and the daily spend ceiling. See Security & remote access.
- Appearance — theme (Black / Navy), sound, language (EN / UK / RU).
- Models / Agents / Forge / Self — card toggles that show or hide any sidebar entry, with per-section Hide all / Show all. Hiding an app removes it from the sidebar, the Dashboard fleet and the radar; it does not stop anything.
Preferences that are purely visual live in localStorage; everything else in
~/.erebros/settings.json.
Model Manager
Section titled “Model Manager”The Models button in the top bar lists every model family this install can reach, what each costs, and a switch to turn any family or individual model off everywhere. Every picker in every app — Chat’s engine row, the global-model box, the Forge pickers, the Mastermind roster — is filtered through it. The manager itself is never filtered, so you can always switch something back on. See Model Manager.
next.config.ts — allowed dev origins
Section titled “next.config.ts — allowed dev origins”Next’s dev mode refuses its /_next/* resources from any origin other than
localhost. The list is pre-set to 127.0.0.1, localhost, the hostname, the LAN IP
and *.local. If you reach the dev server another way, add that host to
allowedDevOrigins and restart — otherwise pages load blank. (Remote hosts also
need the security gate — see Security.)