Configuration

Complete reference for what.toml. All settings, defaults, and options in one place.

[server]

Server binding and request handling.

[server]
port = 3000
host = "0.0.0.0"
max_body_size = "25mb"
fetch_timeout = 15

Framework CSS modes

css controls how much of what.css your app serves:

• full (default) — the whole design system: reset, theme variables, utilities, and component styles. About 14 KB gzipped.
• minimal — reset, theme variables, and utility classes only. Component styles (buttons, cards, forms, navigation) are cut — roughly half the file. For when you style components yourself but want the utility layer.
• none — what.css is not injected at all. Bring your own CSS. The file stays available at /static/what.css for manual linking.

[session]

Server-side session storage and cookie settings.

[session]
enabled = true
cookie_name = "my_session"
max_age = 86400        # 1 day
secure = false         # set false for local HTTP development
database = "data/sessions.db"

[cache]

In-memory page and data cache.

[cache]
enabled = true
ttl = 60

[auth]

JWT-based authentication and route protection.

[auth]
enabled = true
login_endpoint = "https://api.example.com/auth/login"
logout_endpoint = "https://api.example.com/auth/logout"
jwt_secret = "${JWT_SECRET}"
login_path = "/login"
after_login = "/dashboard"
protected_paths = ["/dashboard/*", "/admin/**"]
jwt_claims = ["id", "email", "full_name", "role"]

See Authentication for usage details.

[database]

Database backend selection. When absent, SQLite at data/app.db is used automatically. Tables are created on first write — no schema definition needed.

[database]
type = "sqlite"   # or "d1", "supabase"
path = "data/app.db"  # SQLite only

See Database for backend-specific setup (D1, Supabase).

[datasources.*]

Named datasources connect multiple external backends simultaneously. Each is accessed via the dsn: fetch prefix. See Data Sources for full usage.

[datasources.cloud]
type = "d1"
account_id = "${CF_ACCOUNT_ID}"
api_token = "${CF_API_TOKEN}"
d1_database_id = "${CF_D1_DATABASE_ID}"

[datasources.cms]
type = "supabase"
project_url = "${SUPABASE_URL}"
api_key = "${SUPABASE_KEY}"

[datasources.inventory]
type = "api"
url = "https://api.example.com"
headers = { Authorization = "Bearer ${API_TOKEN}" }

[supabase]

Supabase configuration. Required when [database] type = "supabase".

[database]
type = "supabase"

[supabase]
project_url = "${SUPABASE_URL}"
api_key = "${SUPABASE_SERVICE_KEY}"

See Database for step-by-step Supabase setup.

[uploads]

File upload handling and storage.

[uploads]
enabled = true
provider = "local"
directory = "uploads"
max_size = "25mb"
allowed_types = ["image/*", ".pdf", ".csv"]

See File Uploads for usage details.

[email]

Transactional email configuration. Choose SMTP or Resend API.

[email.smtp]

[email.api]

[email]
from = "[email protected]"
from_name = "My App"

[email.smtp]
host = "smtp.mailgun.org"
port = 587
username = "${SMTP_USER}"
password = "${SMTP_PASS}"

See Email for template syntax and form integration.

[cloudflare]

Shared credentials for Cloudflare services (D1, R2, Turnstile).

[cloudflare]
account_id = "${CF_ACCOUNT_ID}"
api_token = "${CF_API_TOKEN}"
d1_database_id = "your-d1-database-id"
r2_bucket = "my-uploads"
r2_public_url = "https://pub-abc123.r2.dev"
turnstile_site_key = "0x..."
turnstile_secret_key = "${CF_TURNSTILE_SECRET}"

[rate_limit]

Rate limiting for sensitive endpoints. Format: "requests/seconds".

[rate_limit]
enabled = true
login = "3/60"       # 3 login attempts per minute
upload = "20/60"     # 20 uploads per minute
action = "60/60"     # 60 form submissions per minute

[redirects]

URL redirect rules. Supports exact matches and wildcard prefixes.

[redirects]
"/old-page" = "/new-page"
"/blog/2023/*" = "/archive"
"/legacy/**" = "/modern"

Redirects are applied before route matching. Wildcard patterns follow the same rules as protected_paths: * matches one level, ** matches all depths.

[deploy]

Deployment configuration, saved automatically by run-what deploy.

[deploy.ssh]
host = "77.42.22.50"
user = "root"
remote_dir = "/opt/what"

[deploy.docker]
image = "my-app"
registry = "ghcr.io/username"

Full Example

A complete what.toml showing all sections:

[server]
port = 8085
host = "127.0.0.1"
max_body_size = "10mb"
fetch_timeout = 10

[session]
enabled = true
cookie_name = "w_session"
max_age = 604800
secure = true
database = "sessions.db"

[cache]
enabled = true
ttl = 300

[auth]
enabled = true
login_endpoint = "https://api.example.com/auth/login"
logout_endpoint = "https://api.example.com/auth/logout"
jwt_secret = "${JWT_SECRET}"
jwt_cookie_name = "w_token"
login_path = "/login"
after_login = "/dashboard"
protected_paths = ["/dashboard/*", "/admin/**"]
jwt_claims = ["id", "email", "full_name", "role"]

[database]
type = "sqlite"
path = "data/app.db"

[uploads]
enabled = true
provider = "local"
directory = "uploads"
max_size = "10mb"
allowed_types = ["image/*", ".pdf"]

[email]
from = "[email protected]"
from_name = "My App"

[email.smtp]
host = "smtp.mailgun.org"
port = 587
username = "${SMTP_USER}"
password = "${SMTP_PASS}"

[cloudflare]
account_id = "${CF_ACCOUNT_ID}"
api_token = "${CF_API_TOKEN}"
d1_database_id = "your-d1-database-id"
r2_bucket = "my-uploads"
r2_public_url = "https://pub-abc123.r2.dev"
turnstile_site_key = "0x..."
turnstile_secret_key = "${CF_TURNSTILE_SECRET}"

# Supabase (alternative to D1)
# [supabase]
# project_url = "${SUPABASE_URL}"
# api_key = "${SUPABASE_SERVICE_KEY}"

# Named datasources (dsn: prefix in fetch directives)
# [datasources.external_api]
# type = "api"
# url = "https://api.example.com"
# headers = { Authorization = "Bearer ${API_TOKEN}" }

[rate_limit]
enabled = true
login = "5/60"
upload = "10/60"
action = "30/60"

[redirects]
"/old-blog" = "/blog"
"/legacy/*" = "/modern"

[deploy.ssh]
host = "77.42.22.50"
user = "root"
remote_dir = "/opt/what"