Configuration

Reactor uses a single Reactor.toml at your project root. The unified reactor-server binary loads it at boot and fans configuration out to each enabled capability. Omit a [section] entirely to disable that capability.

Loading priority

Configuration merges in this order (highest wins):

Environment variables — REACTOR_* with __ for nesting
Reactor.toml — project file (or --config <path>)
CLI flags — --bind, --admin-token

# Examples
REACTOR_SERVER__BIND="0.0.0.0:9000"
REACTOR_AUTH__DATA_KEY="base64-key"
REACTOR_DATABASE__URL="postgres://..."
REACTOR_AUTH__JWT_ISSUER="my-issuer"

Complete example

# Reactor.toml — full reference example

[project]
name = "my-app"
id = "019213f5-0000-7000-8000-000000000001"
ref = "myprojectref12345678"   # optional; derived from id if omitted
env = "production"             # production | preview | dev

[server]
bind = "0.0.0.0:8000"
request_timeout_secs = 30

[database]
url = "postgres://reactor:reactor@localhost:5432/reactor"
pool_max = 20
acquire_timeout_secs = 5

[tracing]
filter = "info,reactor_auth=debug,reactor_data=debug"
fmt = "json"                   # json | pretty

[admin]
token = "your-secure-admin-token"
allow_remote = false           # restrict /_admin/* to 127.0.0.1 when false

[vault]
backend = "embedded"           # embedded | openbao
path = ".reactor/vault"
master_key = "env:REACTOR_VAULT_MASTER_KEY"

`[project]`

Project identity. Immutable after creation.

Key	Type	Default	Description
`name`	string	`"reactor"`	Human-readable project name
`id`	string	nil UUID	Immutable project UUID
`ref`	string	derived	20-char URL-safe subdomain identifier
`env`	string	`"production"`	Deployment environment

Subdomain format on Reactor.cloud: {ref}.reactor.cloud

`[server]`

HTTP server settings for the unified binary.

Key	Type	Default	Description
`bind`	socket	`0.0.0.0:8000`	Listen address
`request_timeout_secs`	u64	`30`	Global request timeout

`[database]`

Shared PostgreSQL pool used by all capabilities.

Key	Type	Default	Description
`url`	string	required	PostgreSQL connection URL
`pool_max`	u32	`20`	Maximum pool connections
`acquire_timeout_secs`	u64	`5`	Connection acquire timeout

`[tracing]`

Unified tracing for all capabilities.

Key	Type	Default	Description
`filter`	string	`"info"`	`tracing` filter directive
`fmt`	string	`"json"`	Log format: `json` or `pretty`

`[admin]`

Admin and deploy surface (/_admin/*).

Key	Type	Default	Description
`token`	string	required	Bearer token for admin endpoints
`allow_remote`	bool	`false`	Allow admin access from non-loopback

Local dev
Remote deploy

[admin]
token = "dev-token"
allow_remote = false

[admin]
token = "{{ env REACTOR_ADMIN_TOKEN }}"
allow_remote = true   # required for CLI deploy over HTTPS

`[vault]`

Secrets management. Optional — defaults to embedded file vault.

Key	Type	Default	Description
`backend`	string	`"embedded"`	`embedded` or `openbao`
`path`	path	`.reactor/vault`	Embedded vault storage path
`master_key`	string	env	32-byte hex key or `env:VAR_NAME`
`address`	string	—	OpenBao server URL
`namespace`	string	—	OpenBao namespace
`kv_mount`	string	`"secret"`	KV mount path
`transit_mount`	string	`"transit"`	Transit mount path
`auth_method`	string	`"token"`	`token` or `approle`
`token`	string	—	OpenBao token
`role_id`	string	—	AppRole role ID
`secret_id_file`	path	—	AppRole secret ID file
`cache_ttl_secs`	u64	`300`	Secret cache TTL

Use vault: prefix in config values to reference vault secrets:

[functions]
data_key = "vault:functions/data_key"

`[auth]`

Identity capability. Required — there is no anonymous mode.

Key	Type	Default	Description
`data_key`	string	required	Base64 AES-256-GCM key (32 bytes)
`jwt_issuer`	string	`"reactor-auth"`	JWT `iss` claim
`jwt_audience`	string	`"reactor"`	JWT `aud` claim
`access_ttl_secs`	u64	`3600`	Access token lifetime
`refresh_ttl_secs`	u64	`2592000`	Refresh token lifetime (30 days)
`public_url`	string	required	Public URL for email links

`[auth.smtp]`

Optional email delivery for verification and magic links.

Key	Type	Default	Description
`host`	string	required	SMTP hostname
`port`	u16	`587`	SMTP port
`user`	string	—	SMTP username
`password`	string	—	SMTP password
`from`	string	required	From address
`tls`	string	`"starttls"`	`starttls`, `tls`, or `none`

`[data]`

PostgREST-style data API with RLS.

Key	Type	Default	Description
`migrations_dir`	path	—	User schema migrations directory
`run_migrations`	bool	`true`	Auto-run migrations on boot
`user_schema`	string	`"public"`	PostgreSQL schema for user tables
`max_embed_depth`	u8	`5`	Max `?select` embed depth
`max_limit`	u32	`1000`	Maximum page size
`default_limit`	u32	`100`	Default page size

`[storage]`

Object storage with signed URLs.

Key	Type	Default	Description
`backend`	string	`"fs"`	`fs` or `s3`
`fs_base_path`	string	—	Local path (required for `fs`)
`s3_bucket`	string	—	S3 bucket (required for `s3`)
`s3_region`	string	—	AWS region
`s3_endpoint`	string	—	Custom endpoint (MinIO, R2)
`signing_secret`	string	required	HMAC secret for signed URLs
`signed_url_expiry_secs`	u64	`3600`	Signed URL TTL
`max_upload_size`	u64	`104857600`	Max upload size (100 MB)

Filesystem
S3 / R2

[storage]
backend = "fs"
fs_base_path = "./.reactor/blobs"
signing_secret = "your-hmac-secret"

[storage]
backend = "s3"
s3_bucket = "my-bucket"
s3_region = "auto"
s3_endpoint = "https://xxx.r2.cloudflarestorage.com"
signing_secret = "your-hmac-secret"

`[functions]`

Serverless functions (WASM, Bun, Lambda).

Key	Type	Default	Description
`workdir`	string	`.reactor/functions`	Bundle and runtime directory
`data_key`	string	required	Encryption key for function env secrets
`runtimes`	array	`["wasm"]`	Enabled runtimes
`invoke_default_timeout_ms`	u64	`30000`	Default invoke timeout
`invoke_max_timeout_ms`	u64	`300000`	Maximum invoke timeout
`bundle_max_bytes`	u64	`52428800`	Max bundle size (50 MiB)
`bun_bin`	string	`"bun"`	Path to Bun binary
`bun_idle_ttl_secs`	u64	`300`	Bun warm instance idle TTL
`bun_max_instances_per_fn`	u32	`8`	Max warm Bun instances per function
`lambda_region`	string	—	AWS Lambda region
`lambda_role_arn`	string	—	Lambda execution role
`lambda_bundle_s3_bucket`	string	—	S3 bucket for Lambda bundles

`[jobs]`

Scheduled and event-driven background jobs.

Key	Type	Default	Description
`worker_count`	usize	`4`	Concurrent worker tasks
`scheduler_interval_ms`	u64	`1000`	Scheduler poll interval
`default_timeout_ms`	u64	`600000`	Default job timeout (10 min)
`max_timeout_ms`	u64	`3600000`	Maximum job timeout (1 hour)
`webhook_secret`	string	required	Webhook token encryption secret
`max_org_concurrent_runs`	u32	`50`	Max concurrent runs per org
`max_payload_bytes`	u64	`1048576`	Max job payload (1 MiB)

`[sites]`

Static sites and SSR hosting.

Key	Type	Default	Description
`workdir`	string	`.reactor/sites`	Site bundle directory
`bundle_max_bytes`	u64	`524288000`	Max bundle size (500 MiB)
`isr_enabled`	bool	`true`	Enable ISR
`isr_default_revalidate_secs`	u64	`60`	Default ISR revalidation period
`preview_subdomain`	string	`"preview"`	Preview deployment prefix
`revalidation_secret`	string	—	ISR invalidation secret
`default_org_slug`	string	`"reactor"`	Default org for deployments

`[ai]`

LLM gateway capability.

Key	Type	Description
`openrouter_api_key`	string	OpenRouter API key
`aws_access_key_id`	string	Bedrock access key
`aws_secret_access_key`	string	Bedrock secret key
`aws_session_token`	string	STS session token (optional)
`aws_bedrock_region`	string	Bedrock region
`azure_foundry_endpoint`	string	Azure AI Foundry endpoint
`azure_foundry_api_key`	string	Azure Foundry API key
`registry_overlay`	path	Local model registry overlay
`registry_url`	string	Remote registry overlay URL
`default_alias`	string	Default model alias

`[connect]`

Third-party data connectors (Airbyte-style sync).

Key	Type	Default	Description
`data_key`	string	required	Credential encryption key
`jobs_url`	string	`http://localhost:8000/jobs/v1`	Jobs API URL
`data_url`	string	`http://localhost:8000/data/v1`	Data API URL
`storage_url`	string	`http://localhost:8000/storage/v1`	Storage API URL
`refresh_interval_secs`	u64	`300`	Token refresh interval
`sandbox_ttl_secs`	u64	`86400`	Sandbox schema TTL
`max_concurrent_syncs`	u32	`10`	Max concurrent syncs per org

`[analytics]`

Product analytics ingestion and querying.

Key	Type	Description
`internal_secret`	string	Service-to-service auth
`geo_db_path`	path	MaxMind GeoLite2 database
`honor_dnt`	bool	Respect Do Not Track headers
`max_properties_bytes`	usize	Max event property size
`quota_per_org_monthly`	u64	Monthly event quota
`retention_days`	u32	Event retention period
`batch_interval_ms`	u64	Batch flush interval
`sample_rate`	f64	Global sampling rate (0.0–1.0)

`[cloud]`

Multi-tenant control plane routing (C6@fly shared cluster).

Key	Type	Default	Description
`base_domain`	string	`"reactor.local"`	Tenant subdomain base
`backend_target`	string	`"localhost:8000"`	Upstream target
`tls_mode`	string	`"none"`	TLS mode for routes
`provider`	string	—	`single_node` or `shared_cluster`
`multi_tenant`	bool	`false`	Enable host-based tenant routing
`tenant_cache_ttl_secs`	u64	`300`	Tenant resolution cache TTL

`[cloud.shared_pool]`

Key	Type	Default	Description
`max_active_tenants`	usize	`5000`	Tenant adapter cache size
`idle_timeout_secs`	u64	`600`	Idle tenant eviction timeout
`cold_load_concurrency`	usize	`16`	Parallel cold tenant loads
`per_tenant_pool_size`	u32	`5`	DB connections per tenant
`shared_postgres_url`	string	—	Shared cluster Postgres URL

`[cloud.realtime]` / `[cloud.pubsub]`

Key	Type	Default	Description
`backend`	string	`"in_process"`	`in_process` or `nats`
`nats.servers`	array	—	NATS server URLs
`nats.credentials_file`	path	—	NATS credentials

`[cloud.quotas.free]`

Key	Type	Default
`requests_per_minute`	u32	`1000`
`concurrent_functions`	u32	`10`
`db_connections`	u32	`5`
`storage_gb`	u32	`1`
`bandwidth_gb_per_month`	u32	`5`

Validation

reactor-server validates at boot and exits with structured errors:

Exit code	Cause
1	Migration failure
2	Missing required config
3	Port bind failure
4	Auth signing key derivation failure

Run a dry check:

reactor-server doctor
# or
curl -H "Authorization: Bearer $TOKEN" http://localhost:8000/_admin/doctor

Self-hosting — deployment walkthroughs
Security — secrets and admin hardening
Deployment grades — topology selection

Configuration

Loading priority

Complete example

[project]

[server]

[database]

[tracing]

[admin]

[vault]

[auth]

[auth.smtp]

[data]

[storage]

[functions]

[jobs]

[sites]

[ai]

[connect]

[analytics]

[cloud]

[cloud.shared_pool]

[cloud.realtime] / [cloud.pubsub]

[cloud.quotas.free]