Configuration

Every key in .madelog/config.toml with its type, default and the command that reads it; every environment variable; where the config and the device key live on macOS, Linux and Windows.

Settings live in .madelog/config.toml, one file per repository, written by madelog init and changed with madelog config set. A missing file means defaults. The file is TOML and you can edit it by hand; a key madelog does not know is an error when the file is read, so a typo fails loudly rather than silently doing nothing.

The file madelog init writes, plus the two keys madelog publish adds later:

# madelog configuration. `madelog config set <key> <value>` edits this file.
[llm]
provider = "auto"
model = "qwen3:4b"
remote = false
# host = "http://box.lan:11434"                      # optional, unset by default

[server]
url = "https://madelog-server-production.up.railway.app"
device_id = "5ea56900-b0d3-4683-aa32-fe1e3eca821c"   # written by madelog publish
slug = "north-fable-4xt3"                            # written by madelog publish

[privacy]
redact = []

[project]
name = "ledger"

Reading and changing keys

$ madelog config list
llm.provider = auto
llm.model = qwen3:4b
llm.host =
llm.remote = false
server.url = https://madelog-server-production.up.railway.app
server.device_id =
server.slug =
privacy.redact =
project.name = ledger
project.delivered_url =
project.screenshot =
$ madelog config get llm.model
qwen3:4b
$ madelog config set privacy.redact "^secrets/, [.]env$, credentials"
privacy.redact = ^secrets/, [.]env$, credentials

set prints the key and its new value, rewrites the whole file, and validates where there is something to validate. An empty value clears an optional key (llm.host, server.device_id, server.slug, project.delivered_url, project.screenshot); for a list it means an empty list.

$ madelog config set llm.provider openai
madelog: llm.provider must be one of auto, ollama, none (got `openai`)
$ madelog config set llm.remote maybe
madelog: expected true or false, got `maybe`
$ madelog config set privacy.redact "(unclosed"
madelog: privacy.redact pattern `(unclosed` is not a valid regex: regex parse error:
    (unclosed
    ^
error: unclosed group
$ madelog config get nope
madelog: unknown config key `nope`. Known keys: llm.provider, llm.model, llm.host, llm.remote, server.url, server.device_id, server.slug, privacy.redact, project.name, project.delivered_url, project.screenshot

Each of these exits 1 and changes nothing. A key that is in the file but not in that list stops every command that reads the config:

$ madelog config list
madelog: parsing /Users/ana/projects/ledger/.madelog/config.toml: TOML parse error at line 6, column 1
  |
6 | temperature = 0.2
  | ^^^^^^^^^^^
unknown field `temperature`, expected one of `provider`, `model`, `host`, `remote`

Keys

server.device_id and server.slug belong to one server. When you move a repository to another server, clear both so the next publish registers afresh.

Two more values are stored outside this file. The answers to madelog init live in the newest intent event, which the page and the hook read, and in .madelog/intent.md, which is a copy for you; editing the Markdown file changes nothing on the page. Whether AI sessions are recorded is record_ai_sessions in that event. The device key lives outside the repository entirely.

Environment variables

No variable turns on a network call. server.url and --server are the only ways to choose where a page goes, and madelog publish --local ignores both. An empty --server "" is refused rather than silently falling back to server.url. OLLAMA_HOST only changes where a local model is looked for, and llm.host overrides it.

File locations

madelog does not use XDG_CONFIG_HOME or %APPDATA%; the config directory is .config/madelog under the home directory on every platform, unless MADELOG_CONFIG_DIR says otherwise. Inside <repo>/.madelog/:

The device key

device.key is 64 hex characters plus a newline: the 32-byte ed25519 secret key. The directory is created with mode 0700 and the file with 0600 on macOS and Linux; on Windows the user profile's ACL applies. It is created by the first madelog init (or onboard) on the machine, through a temporary file that is hard-linked into place, so two concurrent runs cannot leave a half-written key. It is loaded, never rewritten, by publish and unpublish.

The public half is what the server knows. POST /v1/devices maps it to a device_id, the same id every time for the same key, and that id is what server.device_id stores. The secret never leaves the file. A page belongs to the key that published it: to replace or remove it from another machine, copy device.key there, or run madelog unpublish first and publish afresh. A corrupt file is reported by path: madelog: /Users/ana/.config/madelog/device.key is not a hex device key.