Configuration

Paths

Purpose	Path	Override
Config	`~/.config/khiip/`	`XDG_CONFIG_HOME`
Data (SQLite index)	`~/.local/share/khiip/`	`XDG_DATA_HOME`
Vault (Markdown captures)	`~/khiip-vault/`	`[daemon] vault_path`
Source-tier raw bytes	`~/.local/share/khiip/` (`data_root`)	`[storage] data_root`

Point data_root at iCloud, Dropbox, an external SSD, or a network mount for cross-machine sync of the raw Source tier.

Config file

Settings live in ~/.config/khiip/config.toml. Common sections:

[daemon]
host = "127.0.0.1"
port = 8478

[storage]
data_root = "~/.local/share/khiip"

[extractors.reddit]
client_id = "…"        # optional; widens rate limits + gallery dims
client_secret = "…"    # credential-free old.reddit HTML is the default channel

[extractors.youtube]
api_key = "…"          # optional; widens the YouTube fallback chain

[media]
download_videos = false  # opt-in video preservation, off by default

[archive]
wayback_enabled = false  # default off; opt in for best-effort anonymous Wayback
                         # (archive.org's anonymous SPN is rate-limited/unreliable)

Most per-source credentials can also be supplied as environment variables (e.g. KHIIP_REDDIT_CLIENT_ID).

The daemon address — `[daemon] host` / `port`

[daemon] host/port is dual-use: khiipd serve binds it, and the clients that read config.toml — the CLI and the MCP server — dial it. (The Obsidian plugin has its own daemon-URL setting.) Since 0.2.3 the CLI and serve honor it too (previously only the MCP client did). Clients resolve the address as --host/--port flags → KHIIP_DAEMON_URL → [daemon] host/port → 127.0.0.1:8478; the full chain is on Troubleshooting.

Binding beyond localhost — `allow_non_loopback`

Because [daemon] host doubles as the client dial address, a non-loopback value there doesn’t by itself mean “expose my daemon” — and the daemon speaks plaintext HTTP, with the Bearer token as the only barrier. So a config-sourced non-loopback host requires an explicit opt-in:

[daemon]
host = "0.0.0.0"
allow_non_loopback = true

Without the key, khiipd serve binds 127.0.0.1 and warns. An explicit --host flag needs no key — a flag is a per-invocation, visible act. Read the security note on binding beyond localhost first.

`KHIIP_DAEMON_URL` (clients only)

KHIIP_DAEMON_URL points clients — khiipd capture/recall/refetch and the MCP server — at a daemon by full base URL, e.g. http://127.0.0.1:8500. It never affects where khiipd serve binds, and passing an explicit --host or --port flag suppresses it entirely.

File permissions

auth.toml (the daemon API key) is created with mode 600 automatically. config.toml is yours to author — and it can hold per-source API keys plus your license key — so khiipd serve warns at startup when the file is group/other-accessible:

chmod 600 ~/.config/khiip/config.toml

Since 0.2.4, the daemon also logs a startup warning when the file named by [tier] license_key_file is group- or other-accessible (any of the 0o077 mode bits set), since that file holds your license key. The warning is advisory only — the daemon never changes the file’s permissions and startup is not blocked — and the fix is the same chmod 600 <path>. The check is silent when the license key comes from the KHIIP_LICENSE_KEY environment variable or an inline [tier] license_key, when the file is missing/unreadable, or on non-POSIX platforms.

The `KHIIP_HOME` test knob

KHIIP_HOME redirects config + data + vault under a single root — useful for hermetic tests and demos:

KHIIP_HOME=$(mktemp -d) khiipd serve