Config File Reference

Frona is configured through a YAML config file at data/config.yaml. You can change the path by setting the FRONA_CONFIG environment variable.

Environment variables with the FRONA_ prefix override values from the config file. For example, FRONA_SERVER_PORT=9999 overrides server.port in the YAML. See Configuration for the environment variable reference.

Server

General server settings.

server:
  port: 3001
  base_url: https://frona.example.com
  static_dir: frontend/out
  max_concurrent_tasks: 10
  sandbox_disabled: false
  cors_origins: https://app.example.com
  max_body_size_bytes: 104857600

Field	Type	Default	Description
port	integer	3001	HTTP server port
base_url	string	—	Public-facing base URL, used for callbacks and links
static_dir	string	frontend/out	Directory serving the frontend static files
max_concurrent_tasks	integer	10	Maximum concurrent background tasks across all agents
sandbox_disabled	boolean	false	Disable CLI/Python sandboxing. Not recommended for production
cors_origins	string	—	Allowed CORS origins
max_body_size_bytes	integer	104857600 (100 MB)	Maximum HTTP request body size

Auth

Authentication and token settings.

auth:
  encryption_secret: change-this-in-production
  access_token_expiry_secs: 900
  refresh_token_expiry_secs: 604800
  presign_expiry_secs: 86400

Field	Type	Default	Description
encryption_secret	string	dev-secret-change-in-production	Secret used to derive the AES-256 key that encrypts JWT signing keypairs at rest. Must be changed in production
access_token_expiry_secs	integer	900 (15 min)	How long access tokens are valid
refresh_token_expiry_secs	integer	604800 (7 days)	How long refresh tokens are valid
presign_expiry_secs	integer	86400 (24 hours)	How long pre-signed URLs are valid

Change the encryption secret in production

encryption_secret is used to derive an AES-256 encryption key (via SHA-256) that protects the JWT signing keypairs stored in the database. It is not used directly for JWT signing — instead it encrypts the private keys that do the signing.

A built-in default is provided for local development, but you must set your own value in production. If the default is left in place and database files are ever exposed (backup leak, file traversal, shared host), an attacker could decrypt the signing keypairs and forge authentication tokens for any user.

Generate a strong random secret:

openssl rand -base64 32

SSO

OpenID Connect single sign-on. Disabled by default.

sso:
  enabled: true
  authority: https://auth.example.com
  client_id: your-client-id
  client_secret: your-client-secret
  scopes: email profile offline_access
  only: false
  signups_match_email: true
  allow_unknown_email_verification: false
  client_cache_expiration: 0

Field	Type	Default	Description
enabled	boolean	false	Enable OIDC authentication
authority	string	—	OpenID Connect authority URL
client_id	string	—	OAuth client ID
client_secret	string	—	OAuth client secret
scopes	string	email profile offline_access	OpenID scopes to request
only	boolean	false	Force SSO-only authentication. Disables local login
signups_match_email	boolean	true	Match SSO signups to existing accounts by email
allow_unknown_email_verification	boolean	false	Accept emails not verified by the identity provider
client_cache_expiration	integer	0	Client metadata cache expiration in seconds

Database

database:
  path: data/db

Field	Type	Default	Description
path	string	data/db	Path to the SurrealDB data directory

Browser

Headless Chrome configuration for browser automation. Optional. If not configured, browser tools are unavailable.

browser:
  ws_url: ws://browserless:3333
  profiles_path: /profiles
  connection_timeout_ms: 30000

Field	Type	Default	Description
ws_url	string	—	WebSocket URL of the Browserless instance
profiles_path	string	/profiles	Directory for storing browser profiles
connection_timeout_ms	integer	30000 (30s)	Timeout for connecting to the browser service

Search

Web search provider configuration. Optional. If not configured, search tools are unavailable.

search:
  provider: searxng
  searxng_base_url: http://searxng:8080

Field	Type	Default	Description
provider	string	—	Search provider: searxng, tavily, or brave
searxng_base_url	string	—	Base URL of the SearXNG instance

Storage

File storage paths.

storage:
  workspaces_path: data/workspaces
  files_path: data/files
  shared_config_dir: resources

Field	Type	Default	Description
workspaces_path	string	data/workspaces	Directory for agent workspace files
files_path	string	data/files	Directory for file uploads and attachments
shared_config_dir	string	resources	Directory containing shared prompts and agent configurations

Scheduler

Background job intervals.

scheduler:
  poll_secs: 60
  space_compaction_secs: 3600
  insight_compaction_secs: 7200

Field	Type	Default	Description
poll_secs	integer	60 (1 min)	How often the scheduler checks for due tasks
space_compaction_secs	integer	3600 (1 hour)	Interval for space context compaction
insight_compaction_secs	integer	7200 (2 hours)	Interval for memory insight compaction

Inference

LLM inference settings.

inference:
  max_tool_turns: 200
  default_max_tokens: 8192
  compaction_trigger_pct: 80
  history_truncation_pct: 90

Field	Type	Default	Description
max_tool_turns	integer	200	Maximum tool call iterations per agent response
default_max_tokens	integer	8192	Default max tokens for LLM responses
compaction_trigger_pct	integer	80	Context usage percentage that triggers message compaction
history_truncation_pct	integer	90	Context usage percentage that triggers history truncation

Voice

Twilio voice call configuration. Optional. If not configured, voice tools are unavailable.

voice:
  provider: twilio
  twilio_account_sid: your-account-sid
  twilio_auth_token: your-auth-token
  twilio_from_number: "+15551234567"
  twilio_voice_id: Polly.Matthew
  twilio_speech_model: enhanced
  callback_base_url: https://frona.example.com

Field	Type	Default	Description
provider	string	—	Voice provider. Currently only twilio is supported
twilio_account_sid	string	—	Twilio account SID
twilio_auth_token	string	—	Twilio auth token
twilio_from_number	string	—	Twilio phone number for outbound calls (E.164 format)
twilio_voice_id	string	—	Twilio voice ID for text-to-speech
twilio_speech_model	string	—	Twilio speech recognition model
callback_base_url	string	—	Public URL for Twilio callbacks. Overrides server.base_url for voice

Providers

LLM provider API keys and endpoints. Providers can also be auto-discovered from environment variables (e.g., ANTHROPIC_API_KEY, OPENAI_API_KEY).

providers:
  anthropic:
    api_key: sk-ant-...
    enabled: true
  openai:
    api_key: sk-...
    enabled: true
  ollama:
    base_url: http://localhost:11434/v1
    enabled: true

Field	Type	Default	Description
api_key	string	—	API key for the provider
base_url	string	—	Custom base URL (for self-hosted models like Ollama)
enabled	boolean	true	Whether this provider is active

Supported providers: anthropic, openai, groq, openrouter, deepseek, gemini, cohere, mistral, perplexity, together, xai, hyperbolic, moonshot, mira, galadriel, huggingface, ollama.

Models

Model groups define which LLM an agent uses. Each group has a primary model and optional fallbacks.

models:
  primary:
    main: anthropic/claude-sonnet-4-5-20250514
    fallbacks:
      - openai/gpt-4o
    max_tokens: 8192
    retry:
      max_retries: 10
      initial_backoff_ms: 1000
      backoff_multiplier: 2.0
      max_backoff_ms: 60000

Field	Type	Default	Description
main	string	required	Primary model in provider/model-id format
fallbacks	list	[]	Fallback models if the primary fails
max_tokens	integer	—	Override max tokens for this group
temperature	float	—	Model temperature
context_window	integer	—	Override context window size
retry.max_retries	integer	10	Maximum retry attempts on failure
retry.initial_backoff_ms	integer	1000 (1s)	Initial backoff between retries
retry.backoff_multiplier	float	2.0	Exponential backoff multiplier
retry.max_backoff_ms	integer	60000 (60s)	Maximum backoff duration

Sensitive values

These fields are automatically redacted in logs: auth.encryption_secret, sso.client_secret, voice.twilio_account_sid, voice.twilio_auth_token, and all providers[*].api_key values.