> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nerdit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Engine and applications

> Keep machine settings, application configuration, and secrets in their appropriate places.

## Choose the right configuration

| Configuration | Location                               | Purpose                                                                  |
| ------------- | -------------------------------------- | ------------------------------------------------------------------------ |
| Engine        | Service user's `~/.nerdit/config.toml` | API, storage, proxy, models, database backends, security, and retention. |
| Application   | `nerdit.toml` in the deployed folder   | Name, port, startup, health checks, volumes, and AI/database bindings.   |
| Secrets       | Engine's encrypted secret store        | Credentials injected when a service launches.                            |

The CLI uses its user's connection configuration. On a remote connection, application files come from the CLI machine; builds and containers run on the Engine machine.

## Change Engine settings

Use the CLI to validate changes, preview a redacted diff, and record the update in the audit log:

```bash theme={null}
nerdit config get
nerdit config get proxy
nerdit config set proxy enabled=true --dry-run
nerdit config set proxy enabled=true
```

An admin token is required for writes. The CLI obtains the current ETag to prevent overwriting a concurrent configuration update. If a change conflicts, read the current settings and apply your intended change again.

The result reports whether a restart is required. Proxy, model/backend, service, MCP, link, and retention changes commonly need one:

```bash theme={null}
nerdit daemon restart
```

For a stopped Engine or an offline recovery, use the [service manager](/engine/installation#files-and-service-management).

## Apply a configuration file

`nerdit config set` accepts scalar `key=value` assignments. For nested tables or arrays, use a TOML file:

```toml daemon-settings.toml theme={null}
[retention]
backup_keep_last = 3
volume_backup_keep_last = 3
```

```bash theme={null}
nerdit config apply daemon-settings.toml --dry-run
nerdit config apply daemon-settings.toml
nerdit daemon restart
```

`nerdit config apply -` reads TOML from stdin. Preserve existing credentials when editing `config.toml` directly; do not replace the entire file with an example.

## Application settings

```toml nerdit.toml theme={null}
[deploy]
name = "my-app"
port = 8000
gpus = 0
start = "python -m http.server 8000 --bind 0.0.0.0"
health = "/"
volumes = ["data:/data"]
```

`port` is the container's listening port. Bind the application to `0.0.0.0` inside its container. The Engine allocates the host port; do not assume it equals `8000`.

Use `health_type = "tcp"` for a TCP probe instead of an HTTP path. Choose a probe that actually reflects readiness. Every application gets persistent `/data` storage by default; custom named volumes must use the supported `name:/container/path` form.

Inspect or update a deployed application's settings:

```bash theme={null}
nerdit config app get my-app
nerdit config app set my-app deploy health=/health --dry-run
nerdit config app set my-app deploy health=/health
```

Follow the change result's restart instructions. A later folder deploy can overwrite API-set configuration, so inspect its dry-run first. Some stored fields carry forward when omitted from a redeploy. To remove a release command explicitly:

```bash theme={null}
nerdit config app set my-app deploy release=null
```

For ordinary environment overrides:

```bash theme={null}
nerdit deploy ./my-app --env LOG_LEVEL=debug --wait
nerdit deploy ./my-app --unset-env LOG_LEVEL --wait
```

Keep credentials in the [secret store](/engine/security#application-secrets), referenced with expressions such as `${secrets.API_KEY}`. Never commit a real secret into `nerdit.toml`.

Continue with [deployment](/engine/deploy), [AI bindings](/engine/ai), [database bindings](/engine/databases), or [networking](/engine/networking).